Farewell Tim Curry, you man, myth, and legend. May you rest easy and dance your heart out and sing forever more in our hearts.
Rest in Peace you true Icon
someone just plugged a cable into a Tesla charger and turned it into a computer virus.
@ScepticCtf compromised a Tesla Universal Wall Connector through the charging cable itself.
the chain:
β compromise the Tesla Wall Connector through the charging cable itself (SWCAN protocol on the Control Pilot line, the wire that's supposed to just talk power levels)
β the charger then hacks the car's infotainment system over wifi. on its own
β the car parks near chargers from other brands
β the infotainment system hacks an Autel MaxiCharger and a ChargePoint Home Flex over bluetooth. also on its own
one plug-in. four vendors. zero clicks after the first move.
but the exploit isn't the interesting part.
the wall connector firmware is bare metal ARM, binary only, no source, no symbols.
testing it live on the device gets you one attempt every few seconds and a single bit of feedback: did it crash.
they built an emulator to run the firmware off the actual hardware. same testing, 1000x faster. that's the difference between "this chip is unfuzzable" and finding a critical bug in hours.
the bug: a signed integer read from the firmware header turns into a memory write past where it should stop, during the exact step meant to verify the firmware is legit. it had been sitting there through however many people read that code.
slides in the reply.
this might be my favorite Black Hat talk this year.
The monster PR paving the way for the new Proxmark5 has finally been merged!
Still lots to do, but it's a great start.
Massive thank you DXL and Doegox!! π
Bleeding edge as always:
https://t.co/WKv3DC4vJc
Aww, 3 years ago this week, cDc debuted the @VeilidNetwork
This week, we had our first video calls over the network, we've got apps debuting regularly, and VeilidChat is almost ready for re-release.
Things are happening, the people are ready to TAKE BACK CONTROL
Howdy all,
Now that we're all back from Defcon, the store is back active and just a reminder that I still have these for sale and will kep selling them until I sell 20 of each design. I am giving the profits to UwU to support all the awesome stuff they do for us.
Thank you so much for checking this out. For those of you who did buy badges and people wanted them at Defcon, just steer them towards my lil ol' store. Thanks!
@vrtualv01d @mrjhnsn@Cthulhu_Answers Damn. My package was missing a tentacle dildo. Someone at USPS is having an awesome time while Iβm #foreveralone.