PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Product Security Review Methodology for Traeger Grill Hack

bishopfox.com | blog | #hardware-hacking | #uart | #product-security | #iot-security | #esp32 | #firmware-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How Bishop Fox reviewed the Traeger D2 Wi-Fi grill controller: opening the PCB, tracing ESP32 UART pins, forcing download mode to dump firmware, and analyzing the pairing HTTP server for flaws.
Published
Collected

Related coverage

blog · bishopfox.com
Invasion of the Face Changers: Halloween Hijinks with Bluetooth LED Masks
A Bluetooth LED mask with no pairing or authentication, white-labeled across brands, can be hijacked by anyone nearby; the AES key is public on GitHub, and a CircuitPython script can push new faces.
blog · yeswehack.com
‘One challenging thing about Bug Bounty is when it’s black box’: sunshinefactory on bug hunting, CTFs and hardware hacking
YesWeHack interviews sunshinefactory (Yuewei Wu), part of the winning team at the SPIRITCYBER hardware contest, on IoT hacking methodology, CTF versus bug bounty, and career advice.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên thiết bị D-link
A researcher dissects a buffer overflow in the D-Link DIR-601 web service: request paths are concatenated via strcat without length checks, so a long URL overflows the buffer on this EOL router.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên dòng ONT IGate GW040
Research on ONT IGate GW040 routers: the crontab and weakly secured TR-069 features allow easy botnet recruitment, and firmware analysis uncovered command injection in /bin/httpd via IPSec requests.
blog · bishopfox.com
Accidental Engineer: Building My First Hardware Tool the Hard Way
A Bishop Fox consultant with no hardware background builds a field-ready badge cloning tool for physical assessments, sharing lessons on rapid learning and how hardware punishes unchecked assumptions.
blog · bishopfox.com
Bishop Fox Wrapped: Research Worth Replaying
Bishop Fox Wrapped: the year's most-revisited research, sessions, and posts, covering social engineering, vulnerability research, mobile testing, deepfakes, IoT hacking, and LLM pen testing.
Back