Resources

Blogs

15 Risks & Rewards of Pentesting in a Production Environment

Wondering how much penetration testing costs? Learn what impacts pricing, from scope to methodology, and how to avoid paying for low-value, checkbox tests.

By

Warren Moynihan

・

14 min read

Differentiating Federated Identities: OpenID Connect, SAML v2.0, and OAuth 2.0

Compare OpenID Connect, SAML v2.0, and OAuth 2.0. Understand key differences, roles, and security risks in modern federated identity systems.

Hacking Furbo - A Hardware Research Project: Part 6 – The Finale

Final chapter: insecure Wi-Fi credentials, risky S3 log uploads, long-lived device tokens, and global MQTT activity exposure, plus our June 23, 2025 disclosure to Tomofun.

Hacking Furbo - A Hardware Hacking Research Project – Part 5: Exploiting BLE

This post examines Furbo’s Bluetooth Low Energy (BLE) communication, finding vulnerabilities that expose Wi-Fi credentials, enable device resets, and reveal hidden GATT characteristics. The team demonstrates how attackers could hijack video streams or re-register devices.

Hacking Furbo - A Hardware Research Project - Part 4: Debugging, DeviceIDs, and Dev Tools

In Part 4 of the Hacking Furbo series, we provide a detailed analysis of Furbo devices. Through logging and debugging, we uncovered developer features and exploited two flaws: Denial of Service and an Application Logic Bypass, enabling unlimited trial licenses.

Hacking Furbo - A Hardware Research Project – Part 3: Chip Off and Persistence

In this third part of our Hacking Furbo blog series, we’ll focus on the Furbo hardware. We’ll detail our attempts to perform a chip off procedure to dump and re-apply our customized firmware. We’ll also discuss our struggles with the XGecu T48 programmer, the correct adapter, and our sad attempt at using a Probe Reader.

Hacking Furbo - A Hardware Research Project – Part 2: Mobile and P2P Exploits

We reverse the Android app, hook TUTK Kalay P2P with Frida, capture commands, find token remnants in memory, trigger SSRF to custom.wav, and show a treat-toss DoS.