PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EVerest security audit

blog.quarkslab.com | research | #appsec | #vulnerability-research | #vulnerability | #audit | #automotive | #ostif | #everest | #ev-charging
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's first public security audit of EVerest, the open-source EV charging stack: 6 high, 6 medium and 5 low severity issues found, including RFID cloning and several DoS flaws.
Published
Collected

Related coverage

research · blog.quarkslab.com
Audit of Kuksa, the open-source shared building blocks for Software Defined Vehicles
Quarkslab's OSTIF-organized audit of Eclipse Kuksa: static analysis and fuzzing of the KUKSA.val databroker and Python SDK surfaced 19 vulnerabilities, including two high-severity crashes.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
research · blog.quarkslab.com
Scala Security Audit
Quarkslab's security audit of Scala 3 for OSTIF: threat modeling, manual review, static analysis and fuzzing across the compiler, standard library, REPL, TASTy Inspector and doc generator.
Back