Hacking instant messaging system for airplanes: security analysis and attacks on CPDLC. โ๏ธ๐๐ผโก๏ธโ ๏ธ
Security researchers Mehdi Ziazi and Martin Strohmeier present their security analysis of CPDLC (Controller-Pilot Data Link Communications) - the core system for aircraft/ground communication in modern civilian aviation. IM for airplanes!
From the basics of communication and building a lab to the analysis of protocols, implementations, and demos of attacks on live networks - this is one of the very few public research materials on this topic.
Super interesting, and thanks to the authors for making their work public! Learning time!
More details:
Sliding into the Flight Deck's DMs: Practical Message Attacks on CPDLC [PDF]: https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Martin%20Strohmeier%2C%20Mehdi%20Ziazi%20-%20Sliding%20into%20the%20Flight%20Deck%E2%80%99s%20DMs%20Practical%20Message%20Attacks%20on%20CPDLC%20-%20v1.pdf
Security researchers Mehdi Ziazi and Martin Strohmeier present their security analysis of CPDLC (Controller-Pilot Data Link Communications) - the core system for aircraft/ground communication in modern civilian aviation. IM for airplanes!
From the basics of communication and building a lab to the analysis of protocols, implementations, and demos of attacks on live networks - this is one of the very few public research materials on this topic.
Super interesting, and thanks to the authors for making their work public! Learning time!
More details:
Sliding into the Flight Deck's DMs: Practical Message Attacks on CPDLC [PDF]: https://media.defcon.org/DEF%20CON%2034/DEF%20CON%2034%20presentations/DEF%20CON%2034%20presentations/DEF%20CON%2034%20-%20Martin%20Strohmeier%2C%20Mehdi%20Ziazi%20-%20Sliding%20into%20the%20Flight%20Deck%E2%80%99s%20DMs%20Practical%20Message%20Attacks%20on%20CPDLC%20-%20v1.pdf
๐5
Hack a CASIO watch into a romantic present: Keep the case, use PCB & screen to emulate the watch. ๐จ๐ฝโ๐ญโโฏโฏ๐โค๏ธ
Security researcher Ruulian, in his 182-second (!!!) talk, shares some technical details about a CASIO watch being simulated inside a CASIO watch... Why? Because the author wanted to present a special gift - a CASIO watch with some extra features.
So romantic idea became a hardware research project:
1๏ธโฃ Buy a real CASIO watch and PCBs for Sensor Watch
2๏ธโฃ Emulate CASIO on the PCB to run instead of the real CASIO
3๏ธโฃ Add extra features (kind words + music)
A month and a half of work, and it was received as "it is the best gift I ever had." Cool story and a reminder that sometimes things aren't quite what they seem :) Enjoy!
More details:
How Did I Seduced My Girlfriend Using The FCSC [Youtube]: https://www.youtube.com/watch?v=8N03vFVPkGs
The Sensor Watch [Github]: https://joeycastillo.github.io/Sensor-Watch-Documentation/index.html
Security researcher Ruulian, in his 182-second (!!!) talk, shares some technical details about a CASIO watch being simulated inside a CASIO watch... Why? Because the author wanted to present a special gift - a CASIO watch with some extra features.
So romantic idea became a hardware research project:
1๏ธโฃ Buy a real CASIO watch and PCBs for Sensor Watch
2๏ธโฃ Emulate CASIO on the PCB to run instead of the real CASIO
3๏ธโฃ Add extra features (kind words + music)
A month and a half of work, and it was received as "it is the best gift I ever had." Cool story and a reminder that sometimes things aren't quite what they seem :) Enjoy!
More details:
How Did I Seduced My Girlfriend Using The FCSC [Youtube]: https://www.youtube.com/watch?v=8N03vFVPkGs
The Sensor Watch [Github]: https://joeycastillo.github.io/Sensor-Watch-Documentation/index.html
๐4
Binary exploitation workshop online: on Linux with GDB and tools. Trainer: Leigh Trinity. ๐ง๐ช๐๐ชฒ๐ฉโ๐
Security researcher and trainer Leigh Trinity shared a few month ago her Binary Exploitation workshop online in full: two (almost 3 with add-ons) hours of hardcore Linux binary ripping with GDB and Python.
Very interesting and super useful for anyone looking to evaluate their Linux security knowledge, from basics to an advanced level. So grab it and do it this weekend.
More details:
Binary Exploitation Workshop with Leigh Trinity [Youtube]: https://www.youtube.com/watch?v=nvlCEjZptR8
Code [Github]: https://github.com/Leigh-Trinity/binary-exploitation-basics
MX Linux [Page]: https://mxlinux.org/download-links/
Setup:
Part 1 [Youtube]: https://www.youtube.com/watch?v=chZNdrgQwvw
Part 2 [Youtube]: https://www.youtube.com/watch?v=zId8Nr-Hecc
Prerequisites:
Part 1 [Youtube]: https://www.youtube.com/watch?v=u0Am456IJIE
Part 2 [Youtube]: https://www.youtube.com/watch?v=OUDhS9zoSQI
Security researcher and trainer Leigh Trinity shared a few month ago her Binary Exploitation workshop online in full: two (almost 3 with add-ons) hours of hardcore Linux binary ripping with GDB and Python.
Very interesting and super useful for anyone looking to evaluate their Linux security knowledge, from basics to an advanced level. So grab it and do it this weekend.
More details:
Binary Exploitation Workshop with Leigh Trinity [Youtube]: https://www.youtube.com/watch?v=nvlCEjZptR8
Code [Github]: https://github.com/Leigh-Trinity/binary-exploitation-basics
MX Linux [Page]: https://mxlinux.org/download-links/
Setup:
Part 1 [Youtube]: https://www.youtube.com/watch?v=chZNdrgQwvw
Part 2 [Youtube]: https://www.youtube.com/watch?v=zId8Nr-Hecc
Prerequisites:
Part 1 [Youtube]: https://www.youtube.com/watch?v=u0Am456IJIE
Part 2 [Youtube]: https://www.youtube.com/watch?v=OUDhS9zoSQI
๐5
Hacking & defending modern farms: a hacker's guide to an "OT environment with cows" ๐จ๐ปโ๐ปแแ||แ๐๐ฎ๐
Security researcher Dr. Melisa A. Joyner, aka Dr. J., gave an eye-opening presentation last month about how modern farming has become a cyber-physical environment and why it matters to all of us.
Why it matters - because farming is the only way to get food. :) And now, with all the tech and connectivity in place, those facilities have become food manufacturing sites: "OT environments with cows."
From risks to how a modern farm can be mapped on the Purdue model to some real-world use cases of how modern farms are attacked by online gangs and state-sponsored actors - interesting and insightful.
It looks like an interesting direction to explore for a career in the near future, and definitely a cool and huge area for new cyber-physical security research. Join the fun!
More details:
Old MacDonald Had a Breach: Cyber Risks on the Connected Farm [Youtube]: https://www.youtube.com/watch?v=Rr5CqQk86lE
Security researcher Dr. Melisa A. Joyner, aka Dr. J., gave an eye-opening presentation last month about how modern farming has become a cyber-physical environment and why it matters to all of us.
Why it matters - because farming is the only way to get food. :) And now, with all the tech and connectivity in place, those facilities have become food manufacturing sites: "OT environments with cows."
From risks to how a modern farm can be mapped on the Purdue model to some real-world use cases of how modern farms are attacked by online gangs and state-sponsored actors - interesting and insightful.
It looks like an interesting direction to explore for a career in the near future, and definitely a cool and huge area for new cyber-physical security research. Join the fun!
More details:
Old MacDonald Had a Breach: Cyber Risks on the Connected Farm [Youtube]: https://www.youtube.com/watch?v=Rr5CqQk86lE
๐4
Hacking Bluetooth of Anker power banks & solar batteries: why do they even have one?! ๐แฏค๐จ๐ปโ๐ป๐จ๐
Security researcher Marc Newlin made an interesting observation: some power banks and solar batteries have Bluetooth on them, with no obvious need. So he decided to dig deeper into why and how it works there.
The devices in focus are:
- Anker Prime A1340 power bank
- Anker Solix C200D/A1727 solar battery.
One of the findings is that both devices use Bluetooth and Wi-Fi to pass telemetry, logs, and firmware-update messages between the battery, phone app, and cloud backend. Most of the time - completely unencrypted :)
Enjoy the presentation, and note the mindset of a true researcher - sometimes, things around you can be the beginning of a new and very exciting project.
More details:
Why does my battery have Bluetooth? [Youtube]: https://www.youtube.com/watch?v=C9Xwnkq7rSU
Security researcher Marc Newlin made an interesting observation: some power banks and solar batteries have Bluetooth on them, with no obvious need. So he decided to dig deeper into why and how it works there.
The devices in focus are:
- Anker Prime A1340 power bank
- Anker Solix C200D/A1727 solar battery.
One of the findings is that both devices use Bluetooth and Wi-Fi to pass telemetry, logs, and firmware-update messages between the battery, phone app, and cloud backend. Most of the time - completely unencrypted :)
Enjoy the presentation, and note the mindset of a true researcher - sometimes, things around you can be the beginning of a new and very exciting project.
More details:
Why does my battery have Bluetooth? [Youtube]: https://www.youtube.com/watch?v=C9Xwnkq7rSU
๐4
Intro to hardware hacking by Lennert Wouters: When the attacker has the device in hand. ๐จ๐ปโ๐ป๐ฌ๐โก๐
Security researcher & hardware hacking legend Lennert Wouters gave a presentation last month introducing hardware hacking & embedded-device security. If you don't know Lennert's work - ask your favorite GenAI. :)
What's inside:
1๏ธโฃ Side-channel attacks: use power consumption, electromagnetic emissions, sound etc
2๏ธโฃ Fault injection: disturb voltage, clock, electromagnetic fields, temperature, or use lasers.
3๏ธโฃ Chip imaging & reverse engineering: use X-rays, optical microscopes, or electron microscopes
4๏ธโฃ Microprobing & focused ion beams: directly observe & modify microscopic signals & structures inside a semiconductor
... & more!
Huge opportunity to learn not only the basics, but also the context and way of thinking. Enjoy learning, and please share with your colleagues and friends
More details:
An Introduction to Hardware Hacking - Tools and Techniques [Youtube]: https://www.youtube.com/watch?v=NMw_sG2ogHg
Security researcher & hardware hacking legend Lennert Wouters gave a presentation last month introducing hardware hacking & embedded-device security. If you don't know Lennert's work - ask your favorite GenAI. :)
What's inside:
1๏ธโฃ Side-channel attacks: use power consumption, electromagnetic emissions, sound etc
2๏ธโฃ Fault injection: disturb voltage, clock, electromagnetic fields, temperature, or use lasers.
3๏ธโฃ Chip imaging & reverse engineering: use X-rays, optical microscopes, or electron microscopes
4๏ธโฃ Microprobing & focused ion beams: directly observe & modify microscopic signals & structures inside a semiconductor
... & more!
Huge opportunity to learn not only the basics, but also the context and way of thinking. Enjoy learning, and please share with your colleagues and friends
More details:
An Introduction to Hardware Hacking - Tools and Techniques [Youtube]: https://www.youtube.com/watch?v=NMw_sG2ogHg
๐3
Hacking bomb-disposal robots: PackBot EOD from iRobot (yes!) and whatโs inside. ๐ฃ๐ค๐จ๐ปโ๐ป๐น๏ธ๐ดโโ
Security researchers Emily Astranova and Patrick Kiley earlier this month presented their project: a security analysis of PackBot bomb-disposal robots. The journey started with buying surplus devices and continued with reverse-engineering their hardware, software, networking, and control protocols.
Now I know that iRobot creates not only vacuum cleaners but also bomb-disposal robots. I wonder if they share any code...
And of course, there are vulnerabilities, including bot hijacking! I believe it is remote hijacking, but I am not 100% sure from the slides alone. :)
Enjoy the slides, and maybe share them with your fellow tech teams that use this equipment - maybe they should update.
Stay safe!
More details:
Render Safe: Reverse Engineering and Exploiting an EOD Robot [PDF]: https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Kiley-Render_Safe-Slides.pdf
Security researchers Emily Astranova and Patrick Kiley earlier this month presented their project: a security analysis of PackBot bomb-disposal robots. The journey started with buying surplus devices and continued with reverse-engineering their hardware, software, networking, and control protocols.
Now I know that iRobot creates not only vacuum cleaners but also bomb-disposal robots. I wonder if they share any code...
And of course, there are vulnerabilities, including bot hijacking! I believe it is remote hijacking, but I am not 100% sure from the slides alone. :)
Enjoy the slides, and maybe share them with your fellow tech teams that use this equipment - maybe they should update.
Stay safe!
More details:
Render Safe: Reverse Engineering and Exploiting an EOD Robot [PDF]: https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Kiley-Render_Safe-Slides.pdf
๐4
RF hacking and radio piracy: The intro for hackers who want to learn new skills. ๐จโ๐ป๐ผแแ||แ๐ฉ๏ธ๐
Security researcher Noรซ Flatreaud aka Beemo gave a really interesting presentation a couple of months ago - for those of us who know cybersecurity and have some skills, but want to get into radio hacking today.
From the basics of how it works, to the most popular tools that one can buy online and use today, to the most famous radio hacks of the past - the author did a really nice job assembling the basics of RF hacking into a 20-minute talk.
Important: Before you jump into it, check your local regulations and laws. Some activities may be OK, while others may be regulated or prohibited. Make sure you cover your back before you start your research.
If youโve always wanted to learn RF hacking, but it always felt too complicated, try this presentation as a good first step. Enjoy, and use this knowledge for good.
More details:
So You Want To Start RadioHacking ?[Youtube]: https://www.youtube.com/watch?v=4c-cTBLzjIQ
Security researcher Noรซ Flatreaud aka Beemo gave a really interesting presentation a couple of months ago - for those of us who know cybersecurity and have some skills, but want to get into radio hacking today.
From the basics of how it works, to the most popular tools that one can buy online and use today, to the most famous radio hacks of the past - the author did a really nice job assembling the basics of RF hacking into a 20-minute talk.
Important: Before you jump into it, check your local regulations and laws. Some activities may be OK, while others may be regulated or prohibited. Make sure you cover your back before you start your research.
If youโve always wanted to learn RF hacking, but it always felt too complicated, try this presentation as a good first step. Enjoy, and use this knowledge for good.
More details:
So You Want To Start RadioHacking ?[Youtube]: https://www.youtube.com/watch?v=4c-cTBLzjIQ
๐4
60 seconds to install a hackerโs hardware into a Boeing 737: New physical attacks on airplanes. ๐ฅท๐ป๐น๏ธโ๏ธ๐ป๐พ
A group of academic security researchers from the US bring into focus the importance of physical attacks in aviation cybersecurity. It takes only 60 seconds to install a malicious implant into Boeingโs 737 maintenance system.
All commercial airplanes frequently visit different airports where many people work. The authors took on a research project to design, build, and test a device that connects to and attacks the internal ARINC 429 communication bus.
The implant was created from Boeing components on a budget and interfered with comms inside the plane, which can affect both the flight route and the safety of the flight.
Super interesting and insightful paper. Enjoy the read, and if you know someone in aviation security, please share it with them.
More details:
Design and Implementation of a Physical Implant Attack on the Boeing 737 [PDF]: https://www.usenix.org/system/files/usenixsecurity26-crow.pdf
A group of academic security researchers from the US bring into focus the importance of physical attacks in aviation cybersecurity. It takes only 60 seconds to install a malicious implant into Boeingโs 737 maintenance system.
All commercial airplanes frequently visit different airports where many people work. The authors took on a research project to design, build, and test a device that connects to and attacks the internal ARINC 429 communication bus.
The implant was created from Boeing components on a budget and interfered with comms inside the plane, which can affect both the flight route and the safety of the flight.
Super interesting and insightful paper. Enjoy the read, and if you know someone in aviation security, please share it with them.
More details:
Design and Implementation of a Physical Implant Attack on the Boeing 737 [PDF]: https://www.usenix.org/system/files/usenixsecurity26-crow.pdf
๐4
New vulnerability in NFC immobilizer for BYD Leopard 3 cars: vehicle takeover in 20 seconds ๐๐ช๐๐ชฒ๐ฑ
Security researcher and automotive expert Yan Semenov shared a few weeks ago a new and, to my knowledge, not yet patched vulnerability in the BYD Leopard 3 that allows an attacker to bypass the immobilizer, unlock the doors, and start the engine.
The vulnerability is in the NFC module located in the driver's mirror. But the weak part is not on the RF side - it's on the internal CAN-FD side. The command sequence that sent from the NFC ECU to the internal immobilizer is static. ๐คฏ According to the author, the exploitation takes 20 seconds in total.
Of course, the vulnerability requires the hijacker to be in physical contact with the car, open the mirror, and connect to the bus, but for a skilled criminal it can take another couple of minutes.
It's still unclear if other BYD models are affected. Please share it with BYD owners - it's worth checking with dealers to see when the update is available.
Stay safe!
Security researcher and automotive expert Yan Semenov shared a few weeks ago a new and, to my knowledge, not yet patched vulnerability in the BYD Leopard 3 that allows an attacker to bypass the immobilizer, unlock the doors, and start the engine.
The vulnerability is in the NFC module located in the driver's mirror. But the weak part is not on the RF side - it's on the internal CAN-FD side. The command sequence that sent from the NFC ECU to the internal immobilizer is static. ๐คฏ According to the author, the exploitation takes 20 seconds in total.
Of course, the vulnerability requires the hijacker to be in physical contact with the car, open the mirror, and connect to the bus, but for a skilled criminal it can take another couple of minutes.
It's still unclear if other BYD models are affected. Please share it with BYD owners - it's worth checking with dealers to see when the update is available.
Stay safe!
๐3