Nostr notes by Xeno Kovah

Arbitrary achievement unlocked! "Filling 2 pinboards with ...

2026-09-21T11:25:53Z

Arbitrary achievement unlocked! "Filling 2 pinboards with badges!"😄
Achieved after this year's DEF CON (npub1dqd…8xy4), but I'm hoping that in the future I can also track this achievement via the accomplishments gamification mechanism at #OST2 with all these conferences sponsoring it!🤞🤝😊
From: OpenSecurityTraining2 (npub1vlj…38ew)
https://infosec.exchange/@OpenSecurityTraining2/117308628929158742

Video released for "Reverse engineering Realtek RTL8761B* ...

2026-02-23T12:34:54Z

Video released for "Reverse engineering Realtek RTL8761B* Bluetooth chips, to make better Bluetooth security tools & classes" (from hardwear.io). Slides & video link here:
https://darkmentor.com/publication/2025-11-hardweario/

Misc story time: tldr: I've been collecting security ...

2025-11-24T00:36:25Z

Misc story time:
tldr: I've been collecting security conference stickers for 20+ years and just now got around to using them ¯\_(ツ)_/¯

I'm not the kind of person to put stickers on my laptop. This means that for 23 years (apparently), when I got stickers from a conference, I kept them, put them in a bag, moved them from house-to-house, but never actually did anything with them. Until now.

I finally found a usage; which is decorating the otherwise-sketchy-looking metal ammo case which Veronica Kovah (npub1uux…gmqc) & I are now using to carry phones with us to trainings. We watched some videos on youtube that make it seem like those LiPo fire-protection bags would do a whole lot of not-much in the event that a fire broke out on one of the batteries. But a simple metal box seemed to do a lot better in terms of containing the flames.

So we of course expect that airport security will always stop us when traveling with them (though at least this time our TSA pre-check status seemed to give us a pass on the way out). But the expectation is that contrary to what you might thing, adding hacking conference stickers will actually be disarming, rather than alarming, with security personnel - at least when compared to the alternative of seeing a raw ammo canister ;)

The oldest sticker seems to be from DEF CON 10 (X), circa 2002 (my first DEF CON was 8 FWIW). In general I don't seek out stickers, but I do think the BadBIOS and "I want to believe" ones are things I probably got from Joe Fitz as they were of-the-moment and relevant to my interests. (If you're not familiar with the latter, it's from a very FUDish cover article [1]). I could have completely filled them, but I left a little bit of space for the future. Check out the larger pics for a potential stroll down memory lane. (RIP Shmoocon, Hackademic.info, NoSuchCon. Memento mori conference organizers ;))

#DEFCON, #BlackHat, #ShmooCon, #BlueHat, #RingZer0, #HackLU, #HardwearIO, #DistrictCon, #HackFest, #NoSuchCon, #DeepSec, #HITB, #HackersOnTheHill

[1] https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

Those "hacked" crosswalk buttons last week were most ...

2025-04-21T00:26:28Z

Those "hacked" crosswalk buttons last week were most likely just things that hadn't changed the default password (from "1234"), and then someone used the Polara app to upload new audio (which is part of its core functionality.) Today I decompiled the Android app and added the UUIDs (pic1) to CLUES: https://github.com/darkmentorllc/CLUES_Schema

So now Blue2thprinting https://github.com/darkmentorllc/Blue2thprinting, and other tools that use CLUES, like WHAD https://github.com/whad-team/whad-client, can more easily identify Polara BLE-enabled crosswalks.

If the assumption is that the devices which were maliciously modified were not reconfigured away from default, then it would be reasonable to assume that devices which still have default names matching the patterns shown in pic2, are more likely to be vulnerable. And of course WiGLEnet (npub14ra…ss7p) shows plenty of hits for such devices. And indeed, I used WiGLE to go drive to an intersection one county over and confirm that the 4x default-looking devices there were indeed broadcasting the Polara UUIDs (since WiGLE doesn't report the UUIDs, which would be useful for confirmation.)

Thanks to Mike Ryan Mike Ryan (npub1tup…eetn) for pointing out a video from Deviant Ollam Deviant Ollam (npub1ly0…d6he) from last year which made it more obvious what was going on. https://www.youtube.com/watch?v=mvvVSTlbqEI

It is indeed possible that they continue to use HCI even in the ...

2025-03-10T14:18:37Z

In reply to nevent1q…wawd
_________________________

It is indeed possible that they continue to use HCI even in the single chip architecture. However, within Espressif’s response (https://www.espressif.com/en/news/response_esp32_bluetooth) is the statement “If ESP32 is used in a standalone application and not connected to a host chip that runs a BLE host, the aforementioned HCI commands are not exposed and there is no security threat.”. And my interpretation of that is that the ESP32 can also be used in 2-chip architectures in which HCI is the interface, per the Tarlogic researchers’ implied architecture.

I was addressing the research in the context in which it was ...

2025-03-10T12:10:22Z

In reply to nevent1q…x74m
_________________________

I was addressing the research in the context in which it was given. I’m aware that chips can have varying architectures (attached but non-animated examples from future class), and that a HCI-using architecture is not necessarily the most likely in the case of the ESP32. And indeed given that the research focused on IoT devices in the last few slides, it seems like the least likely place for HCI to matter in some sense. But I didn’t want to muddy the water with speculation, and I have no direct knowledge of population distribution of different architectures in the ESP32-specific ecosystem. So it’s basically “OK, if they want to talk about a vulnerability under the assumption of HCI, let’s talk about it under that assumption”.

I’ve posted a detailed explanation of why the claimed ESP32 ...

2025-03-09T12:49:57Z

I’ve posted a detailed explanation of why the claimed ESP32 Bluetooth chip “backdoor” is not a backdoor. It’s just a poor security practice, which is found in other Bluetooth chips by vendors like Broadcom, Cypress, and Texas Instruments too. https://darkmentor.com/blog/esp32_non-backdoor/