Kulkan Security

¡Visítanos en nuestro booth para participar del desafío! Además, estaremos entregando stickers (que siempre son furor en la Eko 🐉✨) y otras sorpresas… 📍 Stand 31, Ekoparty Argentina 🗓️ ¿Estarás en la conferencia? Envíanos un DM y comencemos la conversación.

Acompáñanos para conversar sobre pentesting y, además, podrás llevarte nuestros stickers 🐉 y (spoiler) un preview gratuito de iPentest, nuestra herramienta de testing con IA, entre otras sorpresas… 🗓️ ¿Estarás en Buenos Aires la semana próxima? Envíanos un DM y conversemos.

The process involved bootloader analysis, runtime memory patching, Secure Boot bypass, and custom kernel image injection. None of these steps required chip-off, JTAG, or soldering beyond the UART connection itself. 👉 Dive into the full research: blog.kulkan.com/u-boot-as-an…

From that starting point, Nahuel analyzed thousands of packages from PyPi, NPM, and Rust Crates at scale, uncovering how this attack class works and reporting several vulnerabilities along the way. 👉 Dive into the full research: blog.kulkan.com/analyzing-gi…

Our team will be in Vegas connecting with security leaders and practitioners from the US and beyond, and of course, handing out free stickers to anyone lucky enough to cross our path! 🐉✨ Are you attending? Send us a DM and let's connect. About Kulkan: kulkan.com/?utm_source=X&utm…

The article walks through the actual vulnerability, the class of bug it belongs to, and builds a reproducible PoC that recovers the contents of small files by brute force, without ever attacking the password. 👉 Dive into the full research: blog.kulkan.com/cve-2026-447…

Matias walked through capturing the signal with an RTL-SDR, decoding the protocol, and crafting arbitrary frames with a HackRF One. Want to see how you can inject arbitrary readings with just an SDR, and a bit of patience bruteforcing the Device ID? 👉 medium.com/@kulkan-security/…

Announcing our second talk at @ekoparty Miami! 🎙️🛡️ @veryhumansortof will break down how a single misplaced operator silently broke encryption in a library recommended by frontier LLMs, and why every SAST tool missed it. 🗓️ May 22, 1:40 PM 📍 Sponsor Track Let's connect! 💪

Kulkan takes the stage at @ekoparty Miami! 🎙️🛡️ Matias Fumega will be diving into hardware security and showing how smart devices in your home are more vulnerable than you think, using nothing but cheap tools and open-source software. Learn more. 👇

The challenge is officially closed. 🔒 We want to congratulate everyone who cracked it, and thank all those who had the honor of meeting Eliza! Soon we'll be announcing the winners for the conference tickets for @ekoparty Miami. 🎟️ Stay tuned!