zenosec

active

// zenosec

Hardware, mobile, web, on-chain.

Zenosec is the security contracting and research practice of Zenofex LLC. Hardware, mobile, web, and on-chain — adversarial assessments by people who publish their work.

view scope open project

session_info
operator
Zenofex LLC
surfaces
Hardware · Mobile · Web · Crypto
base_of_ops
Austin, TX — US
contact
[email protected]

// scope

01 hardware

hw / iot / embedded

  • Firmware extraction
  • Fault injection & glitching
  • Secure-boot review
  • Bus interception
  • Radio surface review
  • OTA pipeline audits
02 mobile

android / ios

  • Application reversing
  • Runtime instrumentation
  • Native code (JNI / Obj-C / Swift)
  • IPC, deep-link, entitlement audit
  • Keychain / Keystore review
  • OAuth / SSO chains
03 web / api

app & api pentest

  • Multi-tenant boundary testing
  • Business-logic abuse
  • SSO / OAuth / OIDC / JWT chains
  • GraphQL & gRPC surfaces
  • Server-side parser audits
  • Webhook & integration trust
04 crypto

solidity / ethereum

  • Solidity contract review
  • Reentrancy & oracle attack surface
  • Tokenomic / economic flaws
  • MEV & front-running exposure
  • Upgrade proxy & access control
  • Bridge & cross-chain verification

full scope & engagement model

field_log

Selected research log

2018-10 FireTV Cube — FireFU chain to secure-boot bypass HDMI I²C → Amlogic S905Z DFU → U-Boot heap overflow patched
2017-12 WD MyCloud — ~85 vulnerabilities disclosed CVE-2017-17560 unauth file upload → root RCE patched
2017-07 Hacking Hardware with a $10 SD Card Reader Black Hat USA 2017 · w/ CJ Heres, Khoa Hoang talk
2017-07 All Your Things Are Belong To Us DEF CON 25 · 20+ IoT devices broken talk
2014-08 Hack All The Things — 20 devices in 45 minutes DEF CON 22 · w/ CJ Heres, Hans Nielsen, Mike Baker talk
2013-12 Breaking secure boot on the Roku per-device bootloader keys + dev-settings flaw patched

Full archive at /research.html.

engage

Brief us on what you ship.

Two paragraphs is enough. We’ll come back with scope, price, and a start window.

open a project