Xeno Kovah

🤔

☝️🧐 “Summarization is the last refuge of the scoundrel!”

😃

Added 24 summary slides to see how much work I have left to do…current slide count is 266. Thoughts and prayers appreciated 💀 (but realistically this deck will form the basis for a future “RE like me: Realtek edition” class)

#Doomscrolling

And a new paid 3-day training with @veronicakovah.bsky.social where we take you from the bottom of the stack to the top, to build the next generation of Bluetooth Low Energy hackers! (hardwear.io/netherlands-...)

Anticipate many more BT hackers in a couple years, and prepare accordingly ;)

a free workshop (hardwear.io/netherlands-...) (where you get to borrow some of my hardware to get a taste of my free 1-day #OST2 class ost2.fyi/BT2222)…

🧵Alright! I pulled off the hat trick 🎩 at hardwear.io this November! I've got a talk on 100% new firmware reverse engineering research (hardwear.io/netherlands-... tagline:SUFFERING BUILDS STRENGTH!)…

That’s it for now! LMK anything missing on the timeline!

2024-06-06
"Breaktooth: Breaking Security and Privacy in Bluetooth Power-Saving Mode"
By Keiichiro Kimura et al.
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#Brea...

2024-12-27
"From fault injection to RCE: Analyzing a Bluetooth tracker"
By Nicolas Oberli
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#From...

🧵And because apparently I can only thread to 10, the thread continues here!

2025-03-20
"CVE-2024-58101" (Samsung Galaxy Buds 1/2)
By Antonio Vázquez Blanco & Jesús María Gómez Moreno
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#CVE-...

2025-06-24
"Using KT6368A-SOP8 Bluetooth Host Chip to Receive Tire Pressure Sensor Data on E-Bikes"
By Junluan Tsui
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#Usin...

2025-06-17
"Watch Out! Bluetooth Analysis of the COROS PACE 3"
By Moritz Abrell
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#Watc...

2025-07-03
Stealtooth: Breaking Bluetooth Security Abusing Silent Automatic Pairing
By Keiichiro Kimura et al.
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#Stea...

2025-07-21
"Firmware Analysis of the COROS PACE 3"
By Jan Wütherich
Added to the Bluetooth Security Timeline: darkmentor.com/bt.html#Firm...

2025-08-21->09-04
"Start hacking Bluetooth Low Energy today! (parts 1-3)"
By Sam Thom
darkmentor.com/bt.html#Star...

2025-09-17
"The Cybersecurity of a Humanoid Robot"
By Víctor Mayoral Vilches
darkmentor.com/bt.html#The%...

2025-09-20
"Unitree Robot BLE Service Command Injection Analysis"
By Andreas Makris, Kevin Finisterre
darkmentor.com/bt.html#Unit...

2025-09-25
"Hacking Furbo - A Hardware Hacking Research Project – Part 5: Exploiting BLE"
By Julian B.
darkmentor.com/bt.html#Hack...

🔵🦷🔒📈🆙‼️Bluetooth Security Timeline Update 2025-10-11!🧵
11 new talks from 2024-2025 added to the Bluetooth Security Timeline at
darkmentor.com/bt.html

WiFi security researchers: I want to get a TX amp to let my BT research tools connect back to further-away advertisers. I’m considering www.digikey.com/en/products/... . Is there a better option that’s used in the WiFi space that I could be considering?(Needs to work with USB BT dongles)

🙌We're happy to announce OST2 now has over 31k students registered! 🥳 By the time we noticed we crossed the 30k mark, we were already at 30.5, so we figured we'd wait for 31k, which is now!🎉

👏Kudos to all the students taking and finishing classes!👏

Fuzzing 1001: Introductory Fuzzing - YouTube View the full free MOOC at https://ost2.fyi/Fuzz1001. This hands-on fuzzing course introduces a software-testing technique for finding security vulnerabiliti...

We have made Francesco Pollicino's "Fuzzing 1001: Introductory Fuzzing" class playlist public here: www.youtube.com/playlist?lis... for those who'd like to download the videos for offline consumption.

If elected to the role of Global Supreme Documentation Overlord Czar, I promise a chicken in every pot, and a README.md in every subfolder!

But I know some people would prefer to read rather than listen (and videos have poor random-access properties, even with subtitles). So I'll continue to think on it.

I’m not sure if I want to create a whitepaper for this or not. I feel like slides with animations are a much more effective and succinct way to get across what I’m trying to say, compared to e.g. taking a half-page to saying the same thing as 3-4 animated slides...

The good news is also the bad news: 2 days of slide-making and I’m over 100 slides…to describe the first 5 days of the work 😬 There’s no way I’m going to be able to include everything in the talk. I’ll post a “Kovah Cut” on the DarkMentor website like in the past, but may have to break into 2 talks

Mad props to the Realtek people for making their stuff Just Work in Linux in the first place, and of course the Linux contributors. (Of course...I'm not saying this completely-unverified firmware architecture is a good *security* architecture...but that's a point for a different time 😉)

I am quite simply gobsmacked that this worked on the first try! Nothing's ever this easy on Linux! 🤯

When I compress the output file and put it in to /lib/firmware/rtl_bt/rtl8761bu_fw.bin.zst on Ubuntu 24.04, all attached RTL8761B-based USB BT dongles Just Work with a patched BDADDR and clear presence of the custom LMP packet logging capability!