Thijs Alkemade
Thijs Alkemade works at the security research division of Computest Security in The Netherlands. This division is responsible for advanced security research on commonly used systems and environments.
Thijs has participated in the the famous Pwn2Own competition four times, first by demonstrating a zero-day attack against Zoom at Pwn2Own Vancouver 2021, then by demonstrating multiple exploits in ICS systems at Pwn2Own Miami 2022, next by hacking 3 different EV-chargers at Pwn2Own Tokyo 2024 and finally by performing a "SOHO-smashup" at Pwn2Own Ireland 2024.
In previous research he demonstrated several attacks against the macOS and iOS operating systems. He has a background in both mathematics and computer science, which gives him a lot of experience with cryptography and programming language theory.
Sessions
The SOHO Smashup is a famous category in the IoT focused edition of Pwn2Own. Contestants are challenged to exploit a router from the WAN side and then use that device to exploit a second device on the internal LAN. Last year, we took them up on this challenge and successfully demonstrated a 0day exploit chain against a QNAP router and pivoting to a TrueNAS system. In this presentation, we'll describe how we performed our research and the vulnerabilities we found.
During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth.
Pwn2Own Ireland added a new target in the smarthome category: the Aeotec Smart Hub. We assumed this target would be an easy win. However, getting the firmware of this device turned out te be a lot harder than anticipated. First, we had to modify the board to dump the encrypted flash. Then, we abused a secure boot flaw to get the decryption key. This process took so long, we had no time left to look for vulnerabilities, but our approach may be interesting for others looking at similar targets.