Sep 22POTAEbox: The Lost Pentest Dropbox PrototypeOne of my biggest regrets during the last years is that I have never got enough time to continue a side project that I care(d) quite a lot: POTAEbox. What’s it? It’s a Pentest Dropbox, in particular, it stands for Penetration Over The Air & Ethernet box.Red Team Tools8 min readRed Team Tools8 min read
Published inInfoSec Write-ups·May 7, 2021[Full-Disclosure] Hideez Key 2 FAIL: How a good idea turns into a SPF (Security Product Failure)TL;DR: This is a deep-dive into a nice concept for a security token & password manager that turned into a horrible product due to lack of proper R&D and Threat Modeling. Prologue: After my first success in bypassing APPROTECT readout protection of the NRF52-based Slok smartlock with #PocketGlitcher (i.e. …7 min read7 min read
Apr 20, 2021Hacking a X-RAY Machine with WHIDelite & EvilCrowRFRecently I bought a X-RAY machine from China to have some ghetto-style desktop setup in order to inspect/reverse engineer some PCBs and hardware implants.Hacking3 min readHacking3 min read
Jul 27, 2020Hacking IoT & RF Devices with BürtleinaBoard™Yet another Multipurpose Breakout Board to hack hardware in a clean and easy way! Few months ago I have presented #FocacciaBoard: a similar multipurpose breakout board that uses the famous FT232H to handle multiple protocols commonly found in (I)IoT devices (i.e. UART, JTAG, SWD, SPI, I2C).Infosec4 min readInfosec4 min read
Feb 18, 2020Hacking IoT devices with Focaccia-BoardA Multipurpose Breakout Board to hack hardware in a clean and easy way! TL;DR: Go grab a copy of the Gerbers and 3D-printed Case STL files at https://github.com/whid-injector/Focaccia-Board and print through your favorite FAB. Prologue Even before the appearance of the word (I)IoT, I was breaking hardware devices, as many of…Hardware Security6 min readHardware Security6 min read
Published inInfoSec Write-ups·Sep 25, 2019USBsamurai For DummiesIn the previous post https://medium.com/@LucaBongiorni/usbsamurai-a-remotely-controlled-malicious-usb-hid-injecting-cable-for-less-than-10-ebf4b81e1d0b I have talked a bit about USBsamurai based on C-U0007. With this blog-post I wanna bring more light regarding: Which are the differences between C-U0007 & C-U0012 How to Build USBsamurai with a C-U0012 How to flash the C-U0012 with the LIGHTSPEED FirmwareHardware8 min readHardware8 min read
Published inInfoSec Write-ups·Aug 15, 2019USBSamurai — A Remotely Controlled Malicious USB HID Injecting Cable for less than 10$TL;DR: The Video is self-explanatory. (Wanna know how to make it? Read the article below.) All started with this Tweet last April, when I wanted a damn cheap USB implant capable of injecting keystrokes. It had to be: Remotely Controllable Fast in Typing Tiny as f***k Cheaper than a…Red Team3 min readRed Team3 min read
Aug 8, 2019Cloning Fingerprints Like A Boss: 101 EditionFew months ago I was testing some TCP & Wiegand based Access Control Systems that also had RFID reading capability and a lovely Fingerprint reader embedded. Most of my time was spent on hardware security related tasks. However, since I love to mess-up with chemical compounds… I decided to test…Security5 min readSecurity5 min read
Aug 4, 2019Hacking Radio Blasting Systems for Fun & ExplosionsWhile driving to work I have seen the advertisement of a Fireworks Festival that’s going to happen in the city. And, as usual, my curiosity brought me to one question: “How they trigger the fireworks?” Back when I was a contractor I have worked for a company which the main…Internet Of Things5 min readInternet Of Things5 min read
Published inInfoSec Write-ups·Jul 30, 2019How to Reverse Engineer, Sniff & Fuzz Vulnerable RF Adult Toys with WHID EliteAs you may know, I am close to release WHID Elite. And as pedantic hardware developer I wanna be sure everything works, even the smallest details. Last week I was looking for new targets to test WHID Elite’s Radio Hacking capabilities and suddenly I found an interesting one: an Electrocuting…Security4 min readSecurity4 min read
![[Full-Disclosure] Hideez Key 2 FAIL: How a good idea turns into a SPF (Security Product Failure)](https://miro.medium.com/v2/da:true/resize:fill:224:224/0*4wROWelRhp7Jkz-Z.gif)
![[Full-Disclosure] Hideez Key 2 FAIL: How a good idea turns into a SPF (Security Product Failure)](https://miro.medium.com/v2/da:true/resize:fill:160:112/0*4wROWelRhp7Jkz-Z.gif)
