WHY2025

Daan Keuper

Daan Keuper is the head of security research at Computest Security. This division is responsible for advanced security research on commonly used systems and environments.

Daan participated five times in the internationally known Pwn2Own competition by demonstrating zero-day attacks against the iPhone, Zoom and multiple ICS applications. In addition Daan did research on internet connected cars, in which several vulnerabilities were found in cars from the Volkswagen Group.


Sessions

08-09
14:00
50min
From WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
Daan Keuper, Thijs Alkemade

The SOHO Smashup is a famous category in the IoT focused edition of Pwn2Own. Contestants are challenged to exploit a router from the WAN side and then use that device to exploit a second device on the internal LAN. Last year, we took them up on this challenge and successfully demonstrated a 0day exploit chain against a QNAP router and pivoting to a TrueNAS system. In this presentation, we'll describe how we performed our research and the vulnerabilities we found.

Hacking
Andromeda
08-10
20:00
50min
Low Energy to High Energy: Hacking nearby EV-chargers over Bluetooth
Daan Keuper, Thijs Alkemade

During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth.

Hacking
Andromeda
08-11
14:00
50min
Hacking the Aeotec Smart Hub: The little hub that could
Daan Keuper, Thijs Alkemade

Pwn2Own Ireland added a new target in the smarthome category: the Aeotec Smart Hub. We assumed this target would be an easy win. However, getting the firmware of this device turned out te be a lot harder than anticipated. First, we had to modify the board to dump the encrypted flash. Then, we abused a secure boot flaw to get the decryption key. This process took so long, we had no time left to look for vulnerabilities, but our approach may be interesting for others looking at similar targets.

Hacking
Delphinus