Kulkan Security

@kulkansecurity

Creative minds breaking your Apps. Our team of security experts will plan and execute controlled attacks and help you improve the security of your applications.

USA

kulkan.com

Replies Reposts Media

Kulkan Security
@kulkansecurity
Aug 26
📝 New blog post: Matias Fumega documents the process of obtaining a root shell on a Xiaomi L09G smart speaker. The post covers how he went from an interactive U-Boot shell to patching BL33 in Ghidra, bypassing signature verification, and booting a fully custom kernel image. 👇
1
Kulkan Security
@kulkansecurity
Aug 4
📝 New blog: @nahueldsanchez_ analyzes vulnerable GitHub Actions workflows. Looking into TeamPCP's exploitation of GitHub repositories, he found the method in one of those cases was simple, yet very effective: inject malicious code via a comment in a newly created issue. 👇
1
Kulkan Security
@kulkansecurity
Jul 28
Kulkan is heading to @BlackHatEvents and @defcon! We bring our attacker mindset to the most influential events shaping global cybersecurity, sharing what we've learned across 25+ years in pentesting so more businesses can raise their security bar. 🛡️ Will you be there? 👇
1
Kulkan Security
@kulkansecurity
Jul 21
📝 Our latest blog covers a vuln our team reported in pyzipper, a Python library recommended by LLMs for creating AES-encrypted Zip files. A single-character typo in the library silently downgraded AES encryption and left a CRC32 checksum in plaintext. How did we find it? 👇
1
Kulkan Security
@kulkansecurity
Jun 9
Smart devices at home are more vulnerable than you think, and Matias Fumega demonstrates it once again! 📝 In our latest blog post, he analyzes how a commercial weather station's RF protocol was decoded and how tampered data was successfully injected and read by the station. 👇
1