/ OBSERVATIONS · IDEAS · PRACTICE
Alexey’s notes
Senior Director, Head of Security at HERE Technologies. 20+ years in offensive security, from exploit development and car hacking to leading security teams. Here I write about risk, AI and security strategy, but not only. What you'll find is a mix of my personal thoughts — they are not the position of my employer.
AI
The Vulnpocalypse Is a Race
AI floods the world with vulnerabilities, yet breaches have not moved. A forest-fire model explains why and shows where the damage will land next.
Read noteARCHIVE Historical notes11 notes · 2015–2018First era · restarted in 2026
Cisco Webex Teams Remote Code Execution Vulnerability (CVE-2018-0387)
Hello all, This time I want to talk about our internal Red Team experience. Just want to share my bug-story for Cisco WebEx Teams (previously known as Cisco Spark). We are using this awesome messenger because it can…
Data exfiltration with Metasploit: meterpreter DNS tunnel
Meterpreter is a well-known Metasploit [1] remote agent for pentester's needs. This multi-staged payload is a good, flexible and easy-to-use platform that allows pentesters to have remote control over pwned…
Next page in CANToolz life
Hello to all CANToolz users (And I know both of them, yeah..)! There are few things happened. First of all, unfortunately for me it is very difficult to work on new features and maintain the project... one of the…
How I have tested EndPointProtection solution...
Just finished evaluation for some EPP products. And I found difficult this challenge: how to chose solution that will fit your organisation. Of course first you need to understand if it is reasonable to spend money…
Bypassing Exploit protection of NORTON Security
Hey, today I am not going to talk about CANToolz! Surprise 8) Let me start this story from the beginning - I just got a new laptop, and by default there was installed a Norton Security . And I have 60 days evaluation…
PHDays: CAR4ALL challenge (part 1)
CAN reversing with CANToolz PHDays happened on May 17-18, in Moscow. It was a really great event and I believe PHDays is one of the best IT-Security event in Russia (but of course Zeronights is the best of the best).…
CANToolz: ISO-TP and DIFF updates
Hello all, Want to summarize all updates and features in CANToolz that help us to understand CAN network of vehicles. First of all I have ported CANToolz to Python 3.x, and have added CANSocket support. So new module…
CANToolz: mod_stat - diff mode
Small updates in CANToolz in version 1.5-0: Have added DIFF mode to mod_stats module. This can be useful if you want to find what frames are new in the traffic. For example you have traffic dump, then you enable diff…
CANToolz: mod_stat features
Playing with some dumps of CAN traffic I am trying to implement not smart traffic-detection features in CANToolz . Main problem - when you see a lot of CAN frames you can't easily find some interesting data and…
Yet Another Car Hacking Tool
Few days ago I had a small talk (on our local Defcon group meeting - DC#7812) regarding CAN ( Controller Area Network ) and ECU analysis with help of CANToolz framework. Therefore, here I would like to repeat some of…
Head Unit as a target for hackers
Head Unit as a target for hackers. In recent years the problem of car hacking is raised more and more frequently. It concerns almost everyone: car manufacturers, OEM and information security specialists. Of course,…
ALSO