Pinned Tweet
I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.
Google fixed the issue in the November 5, 2022 security patch. Update your devices!
bugs.xdavidhu.me/google/2022/11…
Google fixed the issue in the November 5, 2022 security patch. Update your devices!
bugs.xdavidhu.me/google/2022/11…
81
1,235
4,567
"Tesla Model 3's Brain on a Desk" 🏎️
Slides from my talk today at @BSidesNYC:
docs.google.com/presentation/d…
Slides from my talk today at @BSidesNYC:
docs.google.com/presentation/d…
0
4
10
715
I'll be presenting my Tesla security research this Saturday, Oct 17 at @BSidesNYC! 🗽
bsidesnyc.org/schedule/ #BSidesNYC
bsidesnyc.org/schedule/ #BSidesNYC
0
3
21
1,619
David Schütz retweeted
Developer Preview for Meta Ray-Ban Display is rolling out. 👓📷
Build web apps for display glasses with HTML, CSS, and JavaScript, or extend your mobile apps with the Meta Wearables Device Access Toolkit.
Start building today 📷👉 developers.meta.com/blog/build-for…
Build web apps for display glasses with HTML, CSS, and JavaScript, or extend your mobile apps with the Meta Wearables Device Access Toolkit.
Start building today 📷👉 developers.meta.com/blog/build-for…
29
66
408
80,279
Managed to make it charge & shift into drive! -- Found a post from @jwardell with a 2018 raw CAN data recording and replayed it with a Raspberry Pi to the MCU:
5
1
53
6,260
Managed to connect the Raspberry Pi to the Tesla's CAN bus -- for some reason only seeing traffic on the "Chassis" bus, the other two (Vehicle, Party) are silent.
2
1
21
2,922
Did you know you can boot up a Tesla's brain without the rest of the car?
I was always curious about how Tesla cars work under the hood. To start security research on their products, I set up a Model 3's computer running on a desk, car-less:
bugs.xdavidhu.me/tesla/2026/03/…
I was always curious about how Tesla cars work under the hood. To start security research on their products, I set up a Model 3's computer running on a desk, car-less:
bugs.xdavidhu.me/tesla/2026/03/…
2
3
34
2,408
How I archived 10 years of memories using Spotify - the system I use since 2015:
notes.xdavidhu.me/notes/how-i-ar…
notes.xdavidhu.me/notes/how-i-ar…
0
0
6
1,146
David Schütz retweeted
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12/0…
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12/0…
172
1,014
3,903
2,593,111
$1 Million USD - Meta's higest bounty so far!
Meta is bringing WhatsApp, Meta Quest and Ray-Ban Meta glasses to #Pwn2Own this October with new payout categories (not all of them native!):
Meta is bringing WhatsApp, Meta Quest and Ray-Ban Meta glasses to #Pwn2Own this October with new payout categories (not all of them native!):
. @WhatsApp, Meta Quest and Ray-Ban Meta glasses are coming to Pwn2Own this October, with our highest bounties ever!
- $1 million USD for a 0-click RCE in WhatsApp
- $150K USD for 0-click RCE in Quest or Ray-Ban Meta
- And more...
Rules & how to register: zerodayinitiative.com/blog/2025/7/30…
0
4
13
4,058
So cool! Perks of being a @metabugbounty researcher in 2012:
18 yo me getting a bug bounty debit card from @metabugbounty (Facebook) 🥵
1
2
63
7,261
David Schütz retweeted
I'm honestly still in disbelief... grateful to receive a $100k bounty from @Meta. Feels surreal. Sharing this to show that with time and dedication, it's possible. This was my first and only submission to Facebook - something I've been chasing for a decade! 🙏 Big thank you to @metabugbounty!
538
430
11,908
1,068,294
"First time flying business" - my introduction to the non-economy world:
notes.xdavidhu.me/notes/first-ti…
notes.xdavidhu.me/notes/first-ti…
0
0
5
1,769
Some more personal, and less security content from me: Notes.
First piece I share here, "To be liked by all":
notes.xdavidhu.me/notes/to-be-li…
First piece I share here, "To be liked by all":
notes.xdavidhu.me/notes/to-be-li…
0
4
27
5,491
David Schütz retweeted
Security: Custom Tab HTTP Header Injection (reward: $3000) crbug.com/1340879
0
7
40
7,435
David Schütz retweeted
This is sad to hear but, unfortunately, this kind of thing is not an uncommon story: secure key management is very difficult to do right for people with experience and training; it’s nigh impossible for everyone else.
This is something the industry as a whole needs to do better.
This is something the industry as a whole needs to do better.
PSA: My PGP key is compromised, and at least many of my bitcoins stolen. I have no idea how. Help please. #Bitcoin
3
6
31
15,109
These are the sorts of things that make Tesla different to me. They seem to care enough to keep adding these random but pretty impresive features.
Being on the edge of what is possible, even if it doesn't make a lot of practical sense. I think I support that.
Being on the edge of what is possible, even if it doesn't make a lot of practical sense. I think I support that.
Schedule your own Light Show on multiple vehicles simultaneously to create your own orchestra of light
3
2
9