Here it is, the first public exploit of Humanoid Robots from @d0tslash and me:
github.com/Bin4ry/UniPwn

But this vulnerability is present in the whole new generation product line of @UnitreeRobotics . The vulnerability is even wormable, an attacker can not only take over the robot but also embed themselves on the devices and then infect the next devices in range.

Niiiiiice! The redux variant is lit and includes @n0tsa !!

Nice, nice, nice one, thanks @Bin4ryDigit ! Those stickers are amazing!

Time to defend my family honor today against an aggressor… got a few hours left. Trying to find strength for any words I’ll need to speak today. Highest priced lawyer in town vs little ole me for daring to speak up for my son. 🤷

QQSpeed/QQ飞车 desktop one-click RCE. TTBOMK theres millions of concurrent users. Could publish 系统消息 (System Messages) in public/game chat chaining a sanitization bypass + unsafe PV canonicalization + a weird unrestricted Lua execution sink into arb cmd. Was paid out $515 🤷‍♂️

Drone to GCS Vulns & Exploits
github.com/nicholasaleks/…

Hardware-based mitigation needs more time to deploy. For example, the @Starlink user terminal is the first non- smartphone IoT device that I've actually seen to have ARM PAC enabled (only in the kernel tho).

I am very grateful to @n0tsa! He send me this care package ❤️ thank you my friend

Btw @n0tsa “spilled alllll of the tea”, including the candid exchange between @Bin4ryDigit @mammotiontech and I, plus my offer to step around them and talk to @AgilexRobotics staff if they kept dragging their feet… x.com/n0tsa/status/2…

I couldn’t be more happy with having met @n0tsa and he allowing @Bin4ryDigit and I to train him in the fine art of “hoodrat stuff” 🤣 “it’s fun to do bad things” youtube.com/watch?v=qcqOgn…

We published our Mammotion security research.
Unauthenticated admin takeover, ~337k users enumerable, fleet, wide device data leaks and account takeover that let an attacker drive someone else’s mower from the official app including camera.

Writeup:
github.com/ClankerPwn/Mam…
Research by @n0tsa, @Bin4ryDigit, @d0tslash

Mammotion l4wnm0w3r sometimes you have to mow someone else’s lawn.

Full research here ~337000 lawnmowers

🔴 Des tondeuses robots piratables à distance : des chercheurs révèlent 14 failles chez Mammotion, avec environ 337 000 comptes potentiellement exposés dans 85 pays. La France figure parmi les pays comptant le plus d’utilisateurs concernés. frenchbreaches.com/blog/mammotion…

Our latest research, again a lawnmower 😂

we only mowed one lawn.
on purpose.
writeup, emails, vulnz -> github.com/ClankerPwn/Mam…
w/ @n0tsa @Bin4ryDigit @d0tslash

we hack @d0tslash lawn mower without touching it.
from a different country.
live camera.
joystick.
blades on.
then we mow his lawn
Thread 🧵

At least 2 more wormable chains are still there and I'm sure all of us in this thread know them🤪
Some people raise tens of billions of dollars through an IPO but still don't really respect security, that's why.

Cybersecurity firm VulnCheck just revealed that over 100,000 Chinese-made Zbtlink routers contain factory-installed backdoors capable of secretly hijacking network traffic. Named Darklantern and Speakingstone, these covert implants give remote operators unauthenticated root ployed worldwide.

Jacob Baines, chief technology officer at VulnCheck, discovered the hidden code while analyzing firmware on a white-labeled router purchased right here in the United States.

The compromised hardware, manufactured by Shenzhen Zhibotong Electronics, is rebranded and sold under dozens of common commercial labels across Amazon, Shopify, and Alibaba.

One of the implants was caught silently harvesting credentials, executing remote commands, and redirecting web traffic. When Baines registered an unused server domain tied to the code, nearly 400 unique routers immediately checked in from across the globe.

Zbtlink spokesperson Michael Xia claims these features are merely legitimate tools intended for authorized customer maintenance. However, security experts warn that shipping unencrypted, hardcoded surveillance capabilities into consumer hardware leaves every connected network completely vulnerable.

Check that sir github.com/xn0tsa/skypixe…

A+ naming choice on the UniBLEed... 😍

My boy @olivier_boschko just published the awesome and massive research on @UnitreeRobotics named #UniBLEed. He and friends showed a novel way to exploit the Unitree G1 via BLE! AGAIN a wormable BLE hack on a Unitree G1, the same class of exploits as @d0tslash and my #UniPwn which was the first exploit on a Humanoid, also via BLE and wormable. But this blog article and reserach goes much deeper, read it now!
boschko.ca/g1-ble-rce/