Abdul Mhanni
Offensive Security Consultant
Gridware Cybersecurity Ltd
Abdul is a Microsoft MVP, offensive security consultant, and Electrical Engineering student at the University of Sydney, specializing in IoT, internal, and AI/LLM security testing. He works across the full enterprise stack, software, infrastructure, and the hardware running it all, combining hands-on pentesting with academic research. Abdul has 46 CVEs spanning critical infrastructure targets including backup power generators and satellite receivers, and publishes original security research and tooling at abdulmhsblog.com. He holds industry-standard certifications including OSCP/OSCP+, OSEP, GCFE, CRTP, OSIR, and OSTH.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Copy-Paste Vulnerabilities: A Repeatable Methodology for Finding OT and IoT CVEs at Scale
In my experience performing penetration tests on satellite receivers used by the US Department of War, backup power generators running in hospitals worldwide, and radio modulator units relied on by the United Nations and the BBC, alongside many other IoT and OT devices I've torn apart at home over the past year; I've noticed a large basket of copy-paste vulnerabilities. In many cases a single command, or at most three, is enough to surface the same flaw across devices and embedded firmware's from completely different manufacturers and industries.This proliferation of near identical vulnerabilities is the focus of this talk. These systems are built by different vendors, for different sectors, with no shared production node, yet they fail in the same handful of ways: hardcoded credentials in much the same way and locations, unauthenticated command interfaces vulnerable to the same types of command injections, undocumented backdoor-like accounts with trivial passwords, and insecure filesystems. By learning one pattern and you start seeing it everywhere in more or less the same ways.I'll walk through the methodology behind 40+ CVEs I've disclosed: how I approach an unfamiliar target, where these recurring bug classes tend to hide, how to find these vulnerabilities in other targets and how to confirm a finding without bricking hardware you might only have one of. Whether you're chasing your first CVE or you're the person tasked with securing this kit in the field, you'll leave with techniques you can put to work on your next engagement.
- 13:20
- Tue
- 01 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote