Danila Parnishchev

Application security specialist

[Flipper Devices @flipper_net]

We're finally ready to talk about Flipper One — a project we've been grinding on for years and have rebuilt from scratch several times. Read blog post >>
https://t.co/tTywwytXzO

[konata @konatabrk]

Remote Exploitation of Nissan Leaf: Controlling Critical Body Elements from the Internet

At Black Hat Asia, @_moradek_ and I presented proof that attackers can remotely pwn your vehicle using only 3 stack bof 😱 Including control of a steering wheel! 🚘

https://t.co/UvG2hCWFbc

[Binni Shah @binitamshah]

Proof-of-concept: Getting root access on Volkswagen MIB3 via Bluetooth https://t.co/CCAvJWfGfp

Over the Air Compromise of Modern Volkswagen Group Vehicles : https://t.co/RucJj5pb4q (Slides*)

[Denis Laskov 🇮🇱 @it4sec]

With a one-time RCE via Bluetooth, attackers infect the car and are able to record in-car audio, take screenshots, and download contacts from a Skoda Superb, all while it is being driven, over the Internet! 🚘😱 🔥

PDF: https://t.co/EyThh1lEWV
Video PoC: https://t.co/CfRahf5MNO

[Alex_S @A1ex_S]

The huge update for NFC mitm scripts is on the public repo now!
Works with our CardShark badge from PaymentVillage. Check it out!

https://t.co/Ut2aYx37qw
Please feel free to report any issues

@paymentvillage

#emv #nfc #replay #hack

[PCA Cyber Security @PCACyberSec]

@BlackHatEvents announced our talk "Over the Air: Compromise of Modern Volkswagen Group Vehicles". We will uncover now fixed vulnerabilities in MIB3 infotainment, affecting millions of vehicles. Hope to see you there! Further details of the talk: https://t.co/6GUwh2M9o9

[PCA Cyber Security @PCACyberSec]

Last week PCAutomotive received a cool Tesla test bench for security research. Huge thanks to @Tesla for such a present, and for funny Easter eggs!

[TheZDIBugs @TheZDIBugs]

[ZDI-24-844|CVE-2024-23923] (Pwn2Own) Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability (CVSS 8.8; Credit: PCAutomotive) https://t.co/n49DvtXetW

[TheZDIBugs @TheZDIBugs]

[ZDI-24-873|CVE-2024-23973] (Pwn2Own) Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8; Credit: PCAutomotive) https://t.co/68HNQ53w2R

[TheZDIBugs @TheZDIBugs]

[ZDI-24-872|CVE-2024-24737] (Pwn2Own) Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability (CVSS 6.5; Credit: PCAutomotive) https://t.co/Z07nMNkvhX

[paymentvillage @paymentvillage]

The Payment Village has opened its call for volunteers at DEF CON 32. If you would like to be part of the team and will be in Las Vegas this summer, please fill out the form. We are growing and would like to add some incredible people to the team https://t.co/ealOLoECcV

[Danila Parnishchev @zero_wf]

Isn't that case for automotive infotainment test bench cool? Designed by @A1ex_S and @moe_hw

[PCA Cyber Security @PCACyberSec]

Ready for @AutoISAC EU Summit!
@VWGroup MIB3 test bench for security tests is 3D-designed, printed, and ready to go. Meet us live for more details about automotive ECU pentesting. Stay tuned for cool security research later this year!

[Danila Parnishchev @zero_wf]

After wiring several such setups I'm starting to think my job is car electrician) @ivachyou hacked component protection, @moe_hw and @A1ex_S designed a cool case for it. More photos later, live demo at Auto-ISAC summit this year

[PCA Cyber Security @PCACyberSec]

Excited to present our test bench at the Auto-ISAC Summit! We’re showcasing a Volkswagen MIB3 unit with speakers, a mic, and USB. See the impact of vulnerabilities we identified in 2022 at our booth 7. Full disclosure later this year. Stay tuned! #AutoISAC #CyberSecurity

[PCA Cyber Security @PCACyberSec]

Excited to present our test bench at the Auto-ISAC Summit! We’re showcasing a Volkswagen MIB3 unit with speakers, a mic, and USB. See the impact of vulnerabilities we identified in 2022 at our booth 7. Full disclosure later this year. Stay tuned! #AutoISAC #CyberSecurity

[PCA Cyber Security @PCACyberSec]

🏆 Big win in Tokyo! Our team secured a $40K prize at #Pwn2Own Automotive with a slick UAF exploit on the Alpine Halo9 iLX-F509. Huge thanks to our team for their hard work & to @thezdi for an epic contest. #P2OAuto

[Danila Parnishchev @zero_wf]

We did it! @konatabrk very cool job!

[TrendAI Zero Day Initiative @thezdi]

The PCAutomotive Team (@PC_Automotive) successfully targeted the Alpine Halo9 iLX-F509. Results will be confirmed in the disclosure room. #Pwn2Own

[TrendAI Zero Day Initiative @thezdi]

The PCAutomotive Team (@PC_Automotive) successfully targeted the Alpine Halo9 iLX-F509. Results will be confirmed in the disclosure room. #Pwn2Own

[PCA Cyber Security @PCACyberSec]

We are the first ones in the Alpine Halo 9 category, and the 4th ones in Enel X JuiceBox category!
@k0nata_ @_moradek_ @moe_hw good luck out there!

The full schedule of #Pwn2Own Automotive 2024 is at https://t.co/MEcPwsNHFO

[PCA Cyber Security @PCACyberSec]

Next week our team will compete in #Pwn2Own Automotive in Tokyo! Organizers @thezdi and @VicOneAuto revealed targets: #Tesla, IVI, EV Chargers & OS. Last year Synacktiv's team won $75K with an impressive infotainment system exploit. #P2OAuto
https://t.co/ywd4O3jro0

[PCA Cyber Security @PCACyberSec]

🚗 Missed our presentation at escar Europe 2023? No worries! Watch Danila Parnishchev's talk on "Top 10 Security Issues in Modern Vehicles." Thanks to @isitsag for an amazing event in Hamburg. Catch up here ➡️ https://t.co/wtkzDE5x5A