@_cwerling
 Berlin, Deutschland
user.tu-berlin.de/cwerling/
Joined May 2018
  • Tweets31
  • Following256
  • Followers219
1Media
Christian Werling retweeted
Max Hoppenstedt@m_hoppenstedt27 Dec 2023
The researchers also say they were able to prove the existence of the "Elon mode" (non restricted, fully self driving) and they were able to turn the mode on. All by a voltage glitch attack on the board with cheap equipment #37c3 Full story in German :spiegel.de/netzwelt/gadgets/…

(S+) Tesla: Berliner Hacker knacken den Autopilot

Drei IT-Sicherheitsforscher konnten tief in die Hardware von Teslas Fahrassistenten eindringen und auf Firmengeheimnisse zugreifen. Sie schafften es sogar, einen mächtigen »Elon-Modus« zu aktivieren.

spiegel.de
1
1
3
3,748
Christian Werling retweeted
Max Hoppenstedt@m_hoppenstedt27 Dec 2023
Security researchers say they were able to access restricted parts of the autopilot board in Tesla vehicles, access the neural networks and reverse engineer most of the program. Even recover deleted footage from a Tesla vehicle. Here is what they told me: spiegel.de/netzwelt/gadgets/…

(S+) Tesla: Berliner Hacker knacken den Autopilot

Drei IT-Sicherheitsforscher konnten tief in die Hardware von Teslas Fahrassistenten eindringen und auf Firmengeheimnisse zugreifen. Sie schafften es sogar, einen mächtigen »Elon-Modus« zu aktivieren.

spiegel.de
2
3
2
3,440
Christian Werling retweeted
Max Hoppenstedt@m_hoppenstedt27 Dec 2023
Drei Berliner Sicherheitsforschern haben mir berichtet, dass sie per Voltage-Glitch Teslas Autopilot-Platine gehackt und den gesperrten Elon-Modus eingeschaltet haben. Heute stellen Sie beim #37c3 ihre Forschung ausführlich vor, hier eine Übersicht spiegel.de/netzwelt/gadgets/…

(S+) Tesla: Berliner Hacker knacken den Autopilot

Drei IT-Sicherheitsforscher konnten tief in die Hardware von Teslas Fahrassistenten eindringen und auf Firmengeheimnisse zugreifen. Sie schafften es sogar, einen mächtigen »Elon-Modus« zu aktivieren.

spiegel.de
1
6
10
2,251
Christian Werling retweeted
Lionel Rivière@mangeurdpommes4 Aug 2023
blackhat.com/us-23/briefings… Why testing fault injection attacks on integrated circuits matters? ⚡️🚗🔐 At BlackHat 23, a research team from @TUBerlin: Christian (@_cwerling), Niclas, Hans and Oleg will show voltage glitch attack against AMD Secure Processor (ASP) used in Tesla cars!
5
1
11
2,193
Disk encryption is critical in securing your data when you lose your device or an attacker gets physical access. But we found that if you don't use a BitLocker passphrase on an AMD system (before Windows even comes up), your data is not adequately secured: arxiv.org/abs/2304.14717

faulTPM: Exposing AMD fTPMs' Deepest Secrets

Trusted Platform Modules constitute an integral building block of modern security features. Moreover, as Windows 11 made a TPM 2.0 mandatory, they are subject to an ever-increasing academic...

arxiv.org
4
64
7
146
33,316
Find all code and data to mount the attack here: github.com/PSPReverse/ftpm_a…
1
4
24
3,005
Christian Werling retweeted
Positive Security@positive_sec21 Feb 2022
We built a stealth AirTag clone that is not detected by Apple’s tracking protection. It works by only sending one beacon per generated public key. positive.security/blog/find-…

Find You: Building a stealth AirTag clone | Positive Security

We built an AirTag clone capable of silently and continuously tracking someone. The device accomplishes this by sending just one beacon per generated public key, thereby staying invisible to tracking...

positive.security
5
34
3
67
Christian Werling retweeted
Positive Security@positive_sec7 Dec 2021
New blog post: Windows 10 RCE via an argument injection in the ms-officecmd URI handler. While our RCE vector (MS Teams) has been fixed, the argument injection still persists. positive.security/blog/ms-of…

Windows 10 RCE: The exploit is in the link | Positive Security

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for...

positive.security
1
101
2
249
#PSPTool 2.2 now supports JSON output thanks to @OrangeCMS 🎉 pypi.org/project/psptool/

psptool

PSPTool is a tool for dealing with AMD binary blobs

pypi.org
1
1
2
Here we go again, #PSPTool 2.3 with several bugfixes and minor improvements is now available 🚂 pypi.org/project/psptool/2.3…

psptool

PSPTool is a tool for dealing with AMD binary blobs

pypi.org
1
3
Christian Werling retweeted
Positive Security@positive_sec22 Jun 2021
Unpatched, critical vulnerabilities in the PlingStore app and Pling-based Linux marketplace websites and patched, lower-severity vulnerabilities in KDE Discover and the Gnome Shell Extensions website positive.security/blog/hacki…

Linux marketplaces vulnerable to RCE and supply chain attacks | Positive Security

We're disclosing patched vulnerabilities in KDE Discover and the Gnome Shell Extensions website, as well as unpatched vulnerabilities in the PlingStore app and Pling-based Linux marketplace websites...

positive.security
4
7
Different port, same exploit: Our research found how a patched vulnerability in ZyXEL NAS devices was still exploitable due to incomplete patching srlabs.de/bites/zyxel-zero-d…
5
8
Christian Werling retweeted
Positive Security@positive_sec12 May 2021
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices: positive.security/blog/send-…

Send My: Arbitrary data transmission via Apple's Find My network | Positive Security

Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microco...

positive.security
4
96
12
168
Christian Werling retweeted
dmnk.bsky.social@domenuk30 Apr 2021
After months of hard work, we're releasing #LibAFL ✔️Scales across cores and machines ✔️Windows, Android, no_std, ... ✔ Different Modes like binary-only Frida mode (120k execs/sec on a phone anyone?) ✔ Easy to extend with grammar fuzzing, etc. ✔️Rust ;)
Andrea Fioraldi@andreafioraldi30 Apr 2021
#libafl is now public! github.com/AFLplusplus/LibAF… We decided to make it public even without so much documentation so people can start hacking on it. With @domenuk @srubenst1341 @hackerschoice

GitHub - AFLplusplus/LibAFL: Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales...

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ... - AFLplusplus/LibAFL

github.com
2
65
2
209
Christian Werling retweeted
Positive Security@positive_sec15 Apr 2021
Insecure URI handling leads to 1-click #RCE in many popular desktop applications: #Telegram #Nextcloud #VLC #LibreOffice #OpenOffice #Bitcoin #Dogecoin #Wireshark #Mumble Check our post for more details: positive.security/blog/url-o…

Allow arbitrary URLs, expect arbitrary code execution | Positive Security

Insecure URL handling leading to 1-click code execution vulnerabilities in Telegram, Nextcloud (CVE-2021-22879), VLC, LibreOffice (CVE-2021-25631), OpenOffice (CVE-2021-30245), Bitcoin/Dogecoin...

positive.security
32
44
utk-web now allows for marking #PSP blobs. Click a PSP card to select it! Fun trivia: Even entries from the same "directory" are scattered across a #firmware flash image. Try it out: hostile.education/utk-web/A3… #UEFI #AMD #reverseengineering
1
2
3
So let's add some JSON output support to #PSPTool for further processing. :) Thanks a ton @_cwerling for the awesome project! \o/
1
1
1
Christian Werling retweeted
Patrick Wardle
@patrickwardle27 Sep 2020
📝 New Blog: "FinSpy Filleted 🐟" 🔬🦠 Dives into FinFisher's (commercial) macOS implant FinSpy: patreon.com/posts/42064704 Builds on @amnesty's writeup (amnesty.org/en/latest/resear…), detailing the malware's 🔓other exploits ⚙️ kernel-mode rootkit ...& more! H/T @botherder 🙏
1
59
3
131
Over one year we collected Android patch data from phone firmwares. Today we published an analysis detailing patch coverage and time-to-patch for the different vendors: srlabs.de/bites/android-patc… (1/3)
1
5
5
The AMD Secure Processor is a CPU in your CPU you do not control. It’s a Trusted Execution Environment to protect VMs from host access or copyrighted work from distribution. At #36c3 I will present our PSP hacking and how we regained control over it. fahrplan.events.ccc.de/congr…
3
87
9
237
You can now find a recording of our talk here: media.ccc.de/v/36c3-10942-un… Code: github.com/PSPReverse Slides: fahrplan.events.ccc.de/congr…

Uncover, Understand, Own - Regaining Control Over Your AMD CPU

The AMD Platform Security Processor (PSP) is a dedicated ARM CPU inside your AMD processor and runs undocumented, proprietary firmware pr...

media.ccc.de
3
15
1
36
Load more