/Security Research & Write-ups 2026-04-22T12:36:16+00:00 0xHSbF6 / Jekyll © 2026 0xHSbF6 /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-04-03T00:00:00+00:00 2026-04-22T12:34:58+00:00 /posts/Dont_Leave_Your_Keys_Lying_Around/ 0xHSbF6

Don’t Leave Your Keys Lying Around Context Your colleague Toto has installed a cheap connected lock at his place, bought online. Your mission is to get inside. The lock can be opened in 5 ways: PIN code Fingerprint Badge Key From the TTLock mobile app We are going to focus on the NFC badge. The goal is to open Toto’s lock by cloning his badge. Legal Reminder The law is clear...

2026-04-03T00:00:00+00:00 2026-04-22T12:34:58+00:00 /posts/Disable-Wi-Fi-Camera/ 0xHSbF6

How to disable a surveillance camera? Context You bought a Wi-Fi surveillance camera to secure your home. With it, you can check on your cat. If someone breaks in, they’ll be recorded, and thanks to AI, you can even get a notification on your phone telling you a person was spotted in your hallway. You feel safe. But is it possible to disable this camera without accessing your Wi-Fi network? ...

2026-04-02T00:00:00+00:00 2026-04-22T12:34:58+00:00 /posts/reverse-RF433-keys/ 0xHSbF6

Reverse Engineering RF433 Remotes Introduction Many remotes used to open garage gates or to arm/disarm entry-level intrusion alarms use a 433.92 MHz carrier frequency. The goal of this article is to analyze in detail the messages sent by these remotes, decode them, and then generate our own signals to test the security of our home automation devices. We’ll see that the signals are often une...

2026-04-02T00:00:00+00:00 2026-04-22T12:34:58+00:00 /posts/Disable-an-intrusion-alarm/ 0xHSbF6

How to disable an intrusion alarm? Introduction This article targets entry-level to mid-range wireless home intrusion alarms that communicate on the ISM 433 MHz band. The two attacks presented (replay and jamming) work on most of these systems. High-end alarms include countermeasures (rolling code, frequency hopping, jamming detection) that make these attacks harder, but not impossible. Leg...

2026-03-01T00:00:00+00:00 2026-04-22T12:34:58+00:00 /posts/lovespouse-ble-reverse/ 0xHSbF6

LoveSpouse BLE Reverse Context Most entry-level and mid-range sex toys are vulnerable to unauthenticated Bluetooth packet injection attacks. This article focuses on reverse engineering the Bluetooth communication between the LoveSpouse mobile app and a vibrator. The device tested is the “Vibrating Egg Vibrator” from the brand “Kaiagame”. The different vibration modes can be controlled from...