Sam Curry
A technical blog by Sam Curry
- Posts
- 7 from 3 Aug 2023 to 23 Jan 2025
- Posting
- now and then
- Kind
- personal blog
2025 1
2024 5
- Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin PanelJan 23, 2025·7 min readOn November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United States,
- Hacking the World Poker Tour: Inside ClubWPT Gold’s Back OfficeOct 12, 2025·7 min readIn June, 2025, Shubs Shah and I discovered a vulnerability in the online poker website ClubWPT Gold which would have allowed an attacker to fully access the core back office application that is used for all adminis
- Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle AccessNov 7, 2026·21 min readShubham Shah and Sam Curry chained a ForgeRock WAF bypass into code execution on the identity systems of two automakers, then demonstrated remote vehicle control in the US.
- Hacking Kia: Remotely Controlling Cars With Just a License PlateSep 20, 2024·8 min readOn June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipp
- Hacking Millions of Modems (and Investigating Who Hacked My Modem)Jun 3, 2024·21 min readTwo years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS