Finding and fixing a stack-exhaustion vulnerability in a secure element’s host SDK
How a 4-byte certificate can exhaust the stack of a host talking to a TROPIC01 secure element: found, proven, and fixed upstream through coordinated disclosure.
Research & Write-ups
Vulnerability research, project write-ups and the stories behind them
The FCC router ban: a case for testing what's already in your home
The FCC's ban on foreign-made routers raised a broader question: how secure are the legacy devices already in our homes? I decided to find out firsthand.