Viewing profile — bdelay

How much notification did you give the developers before you disclosed? Did you enforce a timeline?

If you're new, it's the same advice as any other field. Find a way to stand out. Build a portfolio, have great grades, come from a good university program, ping contacts from your …

It looks like you made the best of a frustrating situation and, at the very least, have an excellent piece for your portfolio. With the rise in number of new security engineers all…

I took Seacord's virtual class (CMU SEI? Can't remember) on Secure C coding a few years back and own, love, and regularly use the The CERT C Secure Coding Standard. I learned from …

See the Note from Harman section. Hence, as the check wasn't working, I never ran into the check. Dat file signatures may very well be in the header or stored somewhere else.

Thanks! I wish there was a service I could pay for where I could ask lawyers vague security-research related questions like this. Right now I wouldn't even know where to begin look…

Not sure. Have an extra Tesla you can send me?

Okay, that's really cool. Tempted to see if I can get some AWS credits or spend a bit of cash and throw an 8xGPU instance at this for a few days...

Never assume anything. Well done. :)

I agree, but I don't have a consulting-firm/reputation/team of lawyers etc. to hide behind. Reporting flaws to companies related to embedded is often still scary today. The point o…

You are correct. I don't believe those accounts worked over ssh due to a lack of password, just local serial.

Two reasons I didn't do that: 1. I believe Harman had a previous device hacked back around 2014 due to a weak shadow hash. My guess was that they learned their lesson and made the …

My guess is that yes, absolutely, but very few people know about it / a Doctor or nurse was blamed. Medical system security does not seem very good. When I was operating in the are…

Just read the r7800 had the best range for an all-in-one unit. Not sure if it's true, but it has been an amazing router. I picked one up for myself -- they are 130$ refurbished on …

Parents live in a smaller town with two awful ISP selections. They had a bunch of WiFi devices on an ISP router and the connection quality and latency was just terrible when more t…

Well done to the author. I always found working on more obscure systems to be a lot more entertaining as a hobby and I'd definitely recommend it -- you'll almost never run into the…

I don't think anyone with experience hacking kindles believed it was a permanent solution. Unfortunately, most of the technical expertise in that area is fleeting. I'd recommend an…

I don't believe Amazon officially pays for security flaws. They ended up sending me a free Kindle (pretty funny) and got an interview out of it. That didn't end up going anywhere, …

Started out cracking software on embedded systems a long time ago. That led to an understanding of ASM and reverse engineering. Going from there to exploitation isn't a giant leap.…

Correct. At the time, this worked on the Paperwhite 2, 3, Voyage, and Touch. Forgot which version of the touch, they update that one a lot. I'll try to clarify that a bit better wh…