ITSEC Newsletter 2025-04-27

The other day, I was on an interesting penetration test engagement and visualized and executed an interesting path to escalating my privileges to domain admin. So, I thought I would build out the scenario in my own setup to share this interesting path for any fellow pen-testers who may come up with a similar path. It’s a pretty easy and straightforward once you lay it out.

As the number of connected devices increases, so do risks associated with unauthorized access, data manipulation, and network vulnerabilities. This study addresses one of the key challenges in IoT networks - encrypted Zigbee payloads - by presenting decrypted Zigbee network traffic data for advanced security and performance assessments.

I automate things around my apartment with Home Assistant, and I wanted to be able to do the same here. There are a lot of off-the-shelf solutions for this, obviously, but to get back to the knocking-down-walls comparison, they would require my landlord's cooperation and likely a visit from an electrician. I don't want that! Instead, here's how I figured out how to control my apartment's heating in a way that leaves no trace using the existing thermostat already fitted by my landlord, and maybe learn a bit about radios along the way.