Advanced Security Research [email protected]
DEFION Research Labs
Original vulnerability research, responsible disclosure, and competition results.
34
Articles
9
Pwn2Own
NMR
No More Ransom
Latest Research 
Most recent
Network
13 October 2025
Ruckus Unleashed: Multiple vulnerabilities exploited
Read → Pwn2Own
5 September 2024
Pwn2Own Automotive 2024: Hacking the Autel MaxiCharger
Read → Pwn2Own
29 August 2024
Pwn2Own Automotive 2024: Hacking the JuiceBox 40
Read → Pwn2Own
8 August 2024
Pwn2Own Automotive 2024: Hacking the ChargePoint Home Flex (and their cloud...)
Read →All research
Malware
25 July 2024
DoNex/DarkRace Ransomware Decryptor
Read →
Windows
14 June 2024
CVE-2024-20693: Windows cached code signature manipulation
Read →
iOS & macOS
5 April 2024
Bringing process injection into view(s): exploiting all macOS apps using nib fil...
Read → iOS & macOS
13 October 2023
Don’t Talk All at Once! Elevating Privileges on macOS by Audit Token Spoofing
Read → Windows
28 September 2023
Getting SYSTEM on Windows in style
Read → Malware
5 April 2023
Technical analysis of the Genesis Market
Read → iOS & macOS
13 January 2023
Bad things come in large packages: .pkg signature verification bypass on macOS
Read →
Pwn2Own
17 October 2022
Pwn2Own Miami 2022: ICONICS GENESIS64 Arbitrary Code Execution
Read → Pwn2Own
14 September 2022
Pwn2Own Miami 2022: Unified Automation C++ Demo Server DoS
Read → Pwn2Own
8 September 2022
Pwn2Own Miami 2022: AVEVA Edge Arbitrary Code Execution
Read → iOS & macOS
12 August 2022
Process injection: breaking all macOS security layers with a single vulnerabilit...
Read → Pwn2Own
22 July 2022
Pwn2Own Miami 2022: Inductive Automation Ignition Remote Code Execution
Read → Pwn2Own
19 July 2022
Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass
Read → Cryptography
3 February 2022
CoronaCheck App TLS certificate vulnerabilities
Read → iOS & macOS
21 December 2021
Sandbox escape + privilege escalation in StorePrivilegedTaskService
Read → App Security
14 December 2021
Proctorio Chrome extension Universal Cross-Site Scripting
Read →
Pwn2Own
23 August 2021
Zoom RCE from Pwn2Own 2021
Read → iOS & macOS
7 October 2020
iOS VPN support: 3 different bugs
Read → iOS & macOS
1 July 2020
Sign in with Apple - authentication bypass
Read → DevOps
30 January 2020
Jenkins - authentication bypass
Read → Cryptography
25 November 2019
DNS rebinding for HTTPS
Read → DevOps
4 July 2019
Spring Security - insufficient cryptographic randomness
Read → Network
14 August 2018
XenServer - path traversal leading to authentication bypass
Read → App Security
19 July 2018
Volkswagen Auto Group MIB infotainment system - unauthenticated remote code exec...
Read → DevOps
12 July 2017
NAPALM - command execution on NAPLM controller from host
Read → DevOps
25 April 2017
MySQL Connector/J - Unexpected deserialisation of Java objects
Read → DevOps
9 January 2017
Ansible - command execution on Ansible controller from host
Read → Network
10 November 2016
Observium - unauthenticated remote code execution
Read → Cryptography
18 August 2016
cSRP/srpforjava - obtaining of hashed passwords
Read → Cryptography
30 June 2016