Quentin Kaiser

Offensive (embedded) security @onekey_sec / @konkretesec founder / @ecoswtf initiator

[Quentin Kaiser @qkaiser]

I would answer multiple times with random CVE IDs and fake case numbers, ending with the “My apologies if you receive this email in error or more than once” signature.

[Ryan Naraine @ryanaraine]

Good lord 🤮

[Quentin Kaiser @qkaiser]

@mahal0z Yes, workflow would be for the agents to save its work (comments, renames, etc) so a human can open it.

[Quentin Kaiser @qkaiser]

@mahal0z Will definitely try it out !

[Pass the SALT Conference @passthesaltcon]

HW & IoT SESSION
Another day, another discovery🔥

- Firmware Encryption Reversing by @qkaiser 🔬
- Sighthouse for Seamless Function Detection by Sami Babigeon & @Mad5quirrel 💻
- Deep dive and Design Your First PCB with @tcccorp 🛠️

🎟️ Booking: https://t.co/MXseOECfpK

[Quentin Kaiser @qkaiser]

https://t.co/X4BQjTzrCk

[Quentin Kaiser @qkaiser]

I can’t attend but it looks fun !! It’s on June 2, link below

[Quentin Kaiser @qkaiser]

one was reported today and I expect an advisory within 90 days
the other I reported in 2025 is a shit show because they need to rotate their keys

different platforms, different bugs

[Quentin Kaiser @qkaiser]

2026 year of secure boot bypasses

[rekdt @rekdt]

It’s really funny watching companies learn things like patching at high velocity isn’t a cybersecurity silver bullet

The state of cybersecurity is so bad in tech today, they’re recreating defense in depth from first principles

[Quentin Kaiser @qkaiser]

What if the 100+ bugs being recently fixed in Chrome and Firefox were not sourced from Big Sleep / Mythos but from AI assisted vulnerability researchers that do not know about disabling crash reporting ?

[Quentin Kaiser @qkaiser]

@catc0n @Junior_Baines Advisory: “A vulnerability affecting some component of one of our product may allow a user under certain conditions to trigger a DoS”
Changelog: “26-05-12 - fixed a security issue”
Reality: unauth RCE via stack overflow, no hardening

[Quentin Kaiser @qkaiser]

@n_o_t_h_a_n_k_s Back from the vuln mines I see

[Brad Spengler @spendergrsec]

Upstream's covering up of security information they're aware of at time of commit is directly related to why your distros have no fixes for the https://t.co/OSvuOIxZ0Z vuln. Completely irresponsible.

[Quentin Kaiser @qkaiser]

If you’re looking for an offensivecon ticket, DM within the next 48 hours.

[Quentin Kaiser @qkaiser]

@moyix it’s a thin line, but usually conditional checks on country are good “code smell”. Netgear had this 3rd party “gaming speed improvement service” only enabled in China. https://t.co/QrscvfjKI5

[Quentin Kaiser @qkaiser]

And thanks to our intern we also support UFS so you can find bugs in those shiny firewall firmware running FreeBSD 😁

[Quentin Kaiser @qkaiser]

Back in Sept ’25, I projected format support requests would decrease based on trend. Then automotive showed up and boy was I wrong.

Anyway, we can handle QNX SAFEFS, QNX IFS embedded in ELF, QNX deflate, UCL compression, and some more obscure format with unblob now.

[Quentin Kaiser @qkaiser]

We also have an F2FS extractor that we did not communicate about. Started seeing Android firmware with F2FS around June 2025.

This format is *cursed*, almost lost it working on it.