Security research

Hobby with teeth

Security is a hobby with production consequences. I research how storage and infrastructure products actually authenticate, authorize, and fail — then disclose responsibly.

The day job is keeping Lustre healthy at scale. The side quest is making sure the systems we trust deserve that trust.

HammerSpace GDE / GFS Authentication Bypass

Medium2023-05

Default installations of HammerSpace Global Data Environment / Global File System (v4.6.6-324 and below) used a predictable TOTP-style passcode for the service admin account. Given a system serial from SSH, the daily support password could be regenerated — yielding root via the service admin path. Vendor was notified; fix shipped in a subsequent release.

auth-bypassstoragetotpresponsible-disclosure

Code / writeup ↗

SolarWinds N-central Configuration Exposure

High2019-10

nCentralDumpsterDiver demonstrated that self-registration could be abused to create a rogue agent and dump ApplianceConfiguration — potentially including plaintext credentials. Reported to SolarWinds PSIRT with limited vendor feedback at the time.

mspcredentialsagentdisclosure

Code ↗

ARRIS DG860A — NVRAM Backup Password Disclosure

Medium2013-10

The ARRIS DG860A exposed a world-readable NVRAM backup (`router.data`) without authentication. The archive contains password material (including sysAdminPassword) recoverable after a simple XOR-based “compression” scheme reverse-engineered from firmware (`sc_mix`). Tooling included compressor/decompressor utilities to inspect backup contents.

routerarrisinfo-disclosurecredentials

Code ↗Exploit-DB 29131 ↗

ARRIS DG860A — WPS PIN Generator

Medium2013-10

Ruby tool that generates the default WPS PIN for an ARRIS DG860A when the HFC MAC address is known — static PIN derivation rather than random, enabling offline WPS attacks against affected gateways.

routerarriswpswifi

Code ↗