HaxRob

@haxrob

I enjoy breaking things. Telco / mobile and IoT security. Surfing the information super highway one keystroke at a time.

Australia

Pinned
HaxRob
@haxrob
Jul 5, 2023
A friend asked me to find out why his connected lightbulb app was asking for his location, so I ducked out to Australia’s favourite hardware store, Bunnings, and grabbed one to check out. The Android grid connect app has 500k+ downloads. Let’s take a quick look! 🧵 (1/n)
105
HaxRob
@haxrob
Mar 27
#BPFDoor controller's source code (likely) originating from an owned host based in 🇰🇷. Found by pivoting on details in #rapid7's post, published today. Find the reconstructed / deobfuscated source here: github.com/haxrob/BPFDoor…
1
HaxRob
@haxrob
Jul 13, 2025
A relatively unknown but particularly stealthy technique to hide files on Linux hosts. On unhardened boxes, unprivileged users can conceal files from even the root user. Disk content remains in memory, hindering disk acquisition during forensic investigation. (1/7) 👇
3
HaxRob
@haxrob
Jul 12, 2025
Forget compliance by severity color, how about compliance by emoji happiness level? #systemd, stay classy. 🙃
1
HaxRob
@haxrob
Jun 2, 2025
Newer variants of the #BPFDoor has an interesting modification made that avoids detections looking for processes with raw sockets. The kernel reports SOCK_DGRAM rather then rather loud "SOCK_RAW". Here we have a sample found in the recent SKT telco breach. (1/20)
1