Live Last read · last published · next check
TL;DR Introduction In late 2024, we found multiple vulnerabilities in GivEnergy home battery systems that could allow attackers to access customers’ home networks, disrupt battery operation, and potentially violate UK product security regulations. While GivEnergy updated installer guidance for newer deployments, older installations may still be exposed, with no clear remediation plan communicated…
TL;DR A secret is only as safe as the route it takes Secrets are supposed to let systems authenticate without leaving credentials sitting in plain view. However, a secret still has to be created, stored, retrieved by a workload, used and eventually replaced. Every stage creates another opportunity for it to appear somewhere it shouldn’t. Cloud service providers offer dedicated tools such […] The…
TL;DR Why I built PenAI PenAI started as a project at a hackathon organised by Encode Club. It’s an AI agent that could work through Hack The Box-style lab machines on its own. Upload a VPN file, give it a target IP, pick a scope, set stealth mode and iteration limits, hit run, and let […] The post If you’re going to vibe code it, why not vibe pen test it? appeared first on Pen Test Partners .
TL;DR The Problem In this online world it’s been easier than ever to order what you need, when you need and to the exact specifications you want… mostly. The clothing world, alongside many other sectors, is plagued by fakes to the cost of billions, and these figures have increased year upon year for quite a while. Now what if the clothing you are worried about is not your […] The post Click.…
Why is the world so alarmed about taking the Flipper on board planes? Is it just poorly educated armchair cyber commentators of the ‘don’t use open Wi-Fi / USB juicejacking’ style of fearmongering, or is there something to it? TL;DR Why are people worried? I’m sure you’ve seen the odd post on social media about people having their […] The post Flying with the Flipper Zero appeared first on Pen…
TL;DR Why EN 303 645 matters ETSI EN 303 645 has given consumer IoT security a much-needed baseline. It gives manufacturers, assessors, and product teams a shared view of reasonable IoT security and something concrete to work against. But after years of assessing products against it, one thing is clear: passing the standard is not the same as building a secure product. It is possible to build…
TL;DR Introduction Recently in a test I had the joy of reverse engineering the custom binary that acts as a webserver and system controller for their ARM based device. Normally this isn’t a problem: extract the binary, throw it into Ghidra, do stuff. The problem here was that the binary was written in Rust. Which does a lot of things differently from […] The post Decoding Rust strings appeared…
TL;DR Not your usual cybersecurity event Our PTP Cyber Fest returned this year as part of a busy week for the cybersecurity community in London. The cyber community came together over two days at The Fox, located next to Infosecurity Europe at ExCeL London. Some came for the talks. Some came for the demos. Some came […] The post PTP Cyber Fest 2026. Built for people to get involved appeared first…
TL;DR Introduction At the start of this year, I wrote a blog on how 2025 was the ‘year of the infostealer’, and it doesn’t look like that is going to change anytime soon. We’re now into June and the ‘fix’ attacks have continued to soar as they did last year. The difference now is that the lure has become easier to package, […] The post ClickFix, CrashFix and the growing family of copy and paste…
TL;DR Background I recently wrote a blog post on the Shelly Gen 4 open access point issue. While I was investigating that, I started looking more broadly at the Bluetooth configuration across Shelly’s modern device range and found another issue, this time with the Wall Display. The modern Shelly devices now include Bluetooth and by default […] The post Shelly Wall Display exposed RPC over…
