Xeno Kovah

@wilhelm@infosec.exchange please file an issue under Blue2thprinting as I’m off for defcon and won’t be able to get to it until I’m back

🔵🦷🔒📈🆙‼️Bluetooth Security Timeline Update 2026-07-18!
(Meant to post this last week but forgot) 2026-06-27 "Pwning Bluetooth Devices in Unexpected Ways" By Damien Cauquil @virtualabs@mamot.fr Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Pwning%20Bluetooth%20Devices%20in%20Unexpected%20Ways:%5B%5BPwning%20Bluetooth%20Devices%20in%20Unexpected%20Ways%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2026-06-05 "The BlueFrag Zero-Click: A System Replay" By Akshit Singh Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#The%20BlueFrag%20Zero-Click%3A%20A%20System%20Replay:%5B%5BThe%20BlueFrag%20Zero-Click%3A%20A%20System%20Replay%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2026-06-03 "Pwnd Blaster: Hacking your PC using your speaker without ever touching it" By Rasmus Moorats Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Pwnd%20Blaster%3A%20Hacking%20your%20PC%20using%20your%20speaker%20without%20ever%20touching%20it:%5B%5BPwnd%20Blaster%3A%20Hacking%20your%20PC%20using%20your%20speaker%20without%20ever%20touching%20it%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2026-04-17 "Opsec oopsie: Dutch navy frigate location outed by mailing it a Bluetooth tracker" By Just Vervaart @just@journa.host Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Opsec%20oopsie%3A%20Dutch%20navy%20frigate%20location%20outed%20by%20mailing%20it%20a%20Bluetooth%20tracker:%5B%5BOpsec%20oopsie%3A%20Dutch%20navy%20frigate%20location%20outed%20by%20mailing%20it%20a%20Bluetooth%20tracker%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2026-01-15 "WhisperPair: Hijacking Bluetooth Accessories Using Google Fast Pair" By Sayon Duttagupta et al. Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#WhisperPair%3A%20Hijacking%20Bluetooth%20Accessories%20Using%20Google%20Fast%20Pair:%5B%5BWhisperPair%3A%20Hijacking%20Bluetooth%20Accessories%20Using%20Google%20Fast%20Pair%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2026-01-06 "Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters" By Rasmus Moorats Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Reverse%20engineering%20my%20cloud-connected%20e-scooter%20and%20finding%20the%20master%20key%20to%20unlock%20all%20scooters:%5B%5BReverse%20engineering%20my%20cloud-connected%20e-scooter%20and%20finding%20the%20master%20key%20to%20unlock%20all%20scooters%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-10-10 "Paint it Blue: Attacking the Bluetooth stack" By Mehdi Talbi and Etienne Helluy-Lafont Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Paint%20it%20Blue%3A%20Attacking%20the%20Bluetooth%20stack:%5B%5BPaint%20it%20Blue%3A%20Attacking%20the%20Bluetooth%20stack%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-09-01 "Sniffing established BLE connections with HackRF One" By Clément Ballabriga Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Sniffing%20established%20BLE%20connections%20with%20HackRF%20One:%5B%5BSniffing%20established%20BLE%20connections%20with%20HackRF%20One%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-08-04 "The Perfect BLEnd: Reverse engineering a bluetooth controlled blender for better smoothies" By Edward Farrell and Ryan Mast Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#The%20Perfect%20BLEnd%3A%20Reverse%20engineering%20a%20bluetooth%20controlled%20blender%20for%20better%20smoothies:%5B%5BThe%20Perfect%20BLEnd%3A%20Reverse%20engineering%20a%20bluetooth%20controlled%20blender%20for%20better%20smoothies%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-06-17 "nRF54L15 Electromagnetic Fault Injection" By Matthias Kesenheimer @mkesenheimer@mastodon.social Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#nRF54L15%20Electromagnetic%20Fault%20Injection:%5B%5BnRF54L15%20Electromagnetic%20Fault%20Injection%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-03-28 "Is Your Bluetooth Chip Leaking Secrets via RF Signals?" By Yanning Ji et al. Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Is%20Your%20Bluetooth%20Chip%20Leaking%20Secrets%20via%20RF%20Signals%3F:%5B%5BIs%20Your%20Bluetooth%20Chip%20Leaking%20Secrets%20via%20RF%20Signals%3F%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2025-01-12 "Detecting BLE Trackers for the price of a Gas Station Hot Dog" By Bill Swearingen and Larry Pesce Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Detecting%20BLE%20Trackers%20for%20the%20price%20of%20a%20Gas%20Station%20Hot%20Dog:%5B%5BDetecting%20BLE%20Trackers%20for%20the%20price%20of%20a%20Gas%20Station%20Hot%20Dog%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2024-10-29 "Brightway security revisted: Xiaomi 4 Pro 2nd Gen" By robocoffee Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Brightway%20security%20revisted%3A%20Xiaomi%204%20Pro%202nd%20Gen:%5B%5BBrightway%20security%20revisted%3A%20Xiaomi%204%20Pro%202nd%20Gen%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2024-09-26 "LibrePods: AirPods liberated from Apple's ecosystem" By Kavish Devar Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#LibrePods%3A%20AirPods%20liberated%20from%20Apple's%20ecosystem:%5B%5BLibrePods%3A%20AirPods%20liberated%20from%20Apple's%20ecosystem%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2024-03-28 "ChatTracer: Large Language Model Powered Real-time Bluetooth Device Tracking System" By Qijun Wang et al. Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#ChatTracer%3A%20Large%20Language%20Model%20Powered%20Real-time%20Bluetooth%20Device%20Tracking%20System:%5B%5BChatTracer%3A%20Large%20Language%20Model%20Powered%20Real-time%20Bluetooth%20Device%20Tracking%20System%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2023-02-22 "Hacking Brightway scooters: A case study" By robocoffee Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Hacking%20Brightway%20scooters%3A%20A%20case%20study:%5B%5BHacking%20Brightway%20scooters%3A%20A%20case%20study%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2022-06-27 "BLAP: Bluetooth Link Key Extraction and Page Blocking Attacks" By Changseok Koh et al. Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#BLAP%3A%20Bluetooth%20Link%20Key%20Extraction%20and%20Page%20Blocking%20Attacks:%5B%5BBLAP%3A%20Bluetooth%20Link%20Key%20Extraction%20and%20Page%20Blocking%20Attacks%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager 2022-04-18 "Exploring Xiaomi's new firmware security measures" By robocoffee Added to the Bluetooth Security Timeline: https://darkmentor.com/bt.html#Exploring%20Xiaomi's%20new%20firmware%20security%20measures:%5B%5BExploring%20Xiaomi's%20new%20firmware%20security%20measures%5D%5D%20%5B%5BBluetooth%20Security%20Timeline%5D%5D%20%24%3A%2FTagManager That’s it for now. As always, LMK any I missed!

. @VeronicaKovah@infosec.exchange & my DEFCON abstract now published here: https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66647 Waypoint-driven LLM BT RE FTW!

As a DEFCON speaker I get some extra human badges to give away. I’d like to give them to HS/College students who are also #OST2 students. Email me at Xeno at ost2.fyi with a pointer to your OST2 username and proof you’re a student. Most completed OST2 classes wins

The value of the abstracts in particular is that it will increase the number of hits you’ll get when you search for keywords.

Weekend chore which I had an AI do because I was never going to get to it... The "Low Level PC/Server Attack & Defense Timeline" at https://darkmentor.com/timeline.html has been updated to

• fix 30 broken links with archive.org copies
• add archive.org copies for most all other links
• add social media links for 286 authors across 343 talks
• add 230 abstracts from whitepapers / conferences

If you're on the timeline but don't see your preferred social media handle, LMK!

Actual update of the timeline will be next week, so LMK for recent missing talks and I'll check if I've already got them in my queue or not.

And of course a reminder that archive.org is an invaluable resource and you should donate to them at some point!

Lol, Claude is over here reading Apple’s crashlogs to diagnose why Numbers is dying on the xlsx file it’s creating, to work around Numbers’ failings… (“The crash is an uncaught NSInvalidArgumentException deep in Numbers' chart importer”)

Anyone have any pointers to how LLMs are or aren’t affecting forensics software? I don’t have that many forensics people in my network nor is it keyed in to my algorithmic timeline, but it feels like another area where the sort of fuzzy-searching of LLMs would save a lot of work

After taking this class and understanding more about how QEMU works, I'm looking forward to throwing LLMs at the often painstaking work necessary for re-hosting firmware to run in an emulator like QEMU. From: @OpenSecurityTraining2@infosec.exchange https://infosec.exchange/@OpenSecurityTraining2/116872601575755432

If you’re interested in boot security, you’ll be interested in the Boot Security Mastery Conference! From: @3mdeb@fosstodon.org https://fosstodon.org/@3mdeb/116879867133422436

I just learned about “attention dilution” the hard way as I was trying to optimize the skills we’ll release for this. For a particular prompt it finds 144/144 functions if run on a single binary, and 20/144 when there are 4 parallel pyghidra-mcp servers at once ¯\_(ツ)_/¯ From: @xenokovah@infosec.exchange https://infosec.exchange/@xenokovah/116776430593251508

Another example of how this will enable better research: I’ve been running a fork of scapy in Blue2thprinting with more BT packet definitions since I didn’t want to figure out how their unit tests work since they treat that as a requirement for PRs. Now I can upstream them.

RE: @OpenSecurityTraining2@infosec.exchange

We've got a decent number of instructors in the queue to create new classes in 2026 too, but we can always use more! Classes are a significant investment of time, but they also pay off in a significant way for the number of people you will help over many years!

It’s funny, because that’s exactly the reason I turn off WiFi so I can get more BT collection. Coexistence is a killer!

Final bump for our upcoming @hardwear_io@bird.makeup BLE class, now with a 10% discount code! HWUSA_25_BLE http://www.eventbrite.com/e/1100865290719/?discount=HWUSA_25_BLE
From: @VeronicaKovah@infosec.exchange
@VeronicaKovah@infosec.exchange