Dennis Giese
@dgi_DE
IoT Hacker, Cybersecurity Researcher, Lockpicker
What's inside the #MediaTekchips powering your Wi-Fi? 🤔 At #NullconBerlin2025, Daniel Wegemer & Edoardo Mantovani reveal how they reverse engineered the firmware, cracked hidden security, and discovered secret features like ICAP & CSI 👉 nullcon.net/berlin-2025/sp… #chipsecurity
Hardwear.io US in Santa Clara is coming up next week, with the #HardPWN hardware hacking contest (everyone with a conf. ticket can participate). I am organizing it again this year. Feel free to pm me. schedule, targets and info: hardwear.io/usa-2025/hardp… #hw_ioUSA2025

Now Available @hardwear_io ! #ClubMate #hw_ioUSA2025 #hw_io
I also want to point out that this BLE exploit, as well as the HTTP one in previous models, is fundamentally about sloppy programming. They pass parameters from external protocols directly into a shell without proper sanitization. This hardly shows a commitment to security.
NEW: Hackers could abuse flaws in Ecovacs robot vacuums and lawn mowers to turn on their microphones and cameras, researchers found. Ecovacs has not answered to their (nor our) messages. So the vulnerabilities are likely to not have been patched yet. techcrunch.com/2024/08/09/eco…
Finally, Ecovacs responds to the researchers' findings, saying it won't fix the bugs. "Users can rest assured that they do not need to worry excessively about this," Ecovacs said in a statement. (Including the whole statement here.) techcrunch.com/2024/08/09/eco…
We heard that @ecovacsrobotics made some claims about our @DEFCON and upcoming @HacksInTaiwan talk, claiming it being a hard attack (we don't agree). @0xHexHijinx also found it also independently and reported it (March '24). A playlist with our demos: youtube.com/playlist?list=…
Finally, Ecovacs responds to the researchers' findings, saying it won't fix the bugs. "Users can rest assured that they do not need to worry excessively about this," Ecovacs said in a statement. (Including the whole statement here.) techcrunch.com/2024/08/09/eco…
In regard to our talk: Someone was messing with our presentation pc at @DEFCON, so part was messy. We did not show a working BLE payload. Hopes are that @ecovacsrobotics will patch it now. An updated talk at @HacksInTaiwan next week will publish some tools+test payloads for BLE.


I uploaded my @DEFCON slides here: dontvacuum.me/talks/ There you find our talks about smart locker locks (Open sesame) and Ecovacs robots. We had some last minute changes and annotations, so you find there the latest versions. Many thanks to everyone attending our talks!
Check it out! RL's very own @paulfroberts spoke with @doctorow, @tarah, @WeldPond & @dgi_DE in this @defcon 32 panel "Bricked and Abandoned." Follow @securesilient to stay up to date with efforts related to building secure tech ecosystems.