Het Mehta
@hetmehtaa • 42,860 subscribers
Security Engineer | Content Creator | I talk about Cybersecurity, Tech, Privacy, AI & Startups | Building @Sentynio @100xSecurity
Videos
someone just plugged a cable into a Tesla charger and turned it into a computer virus. Tobias Scharnowski compromised a Tesla Universal Wall Connector through the charging cable itself. the chain: → compromise the Tesla Wall Connector through the charging cable itself (SWCAN protocol on the Control Pilot line, the wire that's supposed to just talk power levels) → the charger then hacks the car's infotainment system over wifi. on its own → the car parks near chargers from other brands → the infotainment system hacks an Autel MaxiCharger and a ChargePoint Home Flex over bluetooth. also on its own one plug-in. four vendors. zero clicks after the first move. but the exploit isn't the interesting part. the wall connector firmware is bare metal ARM, binary only, no source, no symbols. testing it live on the device gets you one attempt every few seconds and a single bit of feedback: did it crash. they built an emulator to run the firmware off the actual hardware. same testing, 1000x faster. that's the difference between "this chip is unfuzzable" and finding a critical bug in hours. the bug: a signed integer read from the firmware header turns into a memory write past where it should stop, during the exact step meant to verify the firmware is legit. it had been sitting there through however many people read that code. slides in the reply. this might be my favorite Black Hat talk this year.
Het Mehta165,699 просмотров • 2 месяцев назад
Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:
Het Mehta153,565 просмотров • 5 месяцев назад
two XSS vulnerabilities. individually, each was practically useless. together, they stole your session, hijacked your OAuth token, and silently turned on your webcam. here's the chain. Zoom's web client allowed XSS in two places, and both were in self-XSS situations where you could only inject into your own context. programs usually ignore these as "No Impact." but Zoom uses OAuth for authentication. the OAuth authorization code gets passed via URL after login. if you can intercept that redirect, you get the code, you get the token, you get the account. the trick: "OAuth dirty dancing." when a victim clicks a link, the XSS on domain A sends a message to domain B using postMessage. domain B uses the XSS there to initiate an OAuth flow. the authorization code in the redirect gets sent back to the attacker. the attacker now has a valid auth code. they exchange it. full session. Bonus: Zoom's web client requests browser permissions (camera, microphone) once and remembers them. after account takeover, the attacker can silently activate those permissions in a tab the victim can't see. also: they found that the WAF could be tricked into flagging the victim as malicious by sending crafted requests that made the WAF think the victim's browser was the attacker. the victim gets blocked. denial of service via WAF frame-up. two "useless" XSS bugs. one $15,000 bounty. three attack chains. Blog:
Het Mehta15,047 просмотров • 3 месяцев назад
Больше нет контента для загрузки