Peter Mikeska

Security research48.6690° N, 19.6990° E

Peter
Mikeska

Security researcher in Slovakia. I hunt for vulnerabilities in sandboxes, kernels, hypervisors and the hardware underneath them, and get them fixed before anyone else finds them.

Sandbox escapes
Kernel and hypervisor
Hardware and firmware
Available now

About

Slovakia
Available for audits and research

I was ten, a hopeless tech nerd, when I first wondered what it would take to get inside a system that wasn't meant to let me in. That question never let go of me. It just got more disciplined.

Today I find the weak spots before someone with worse intentions does, and help the people who built them close the gap. Along the way I've worked with Apple, Microsoft, Škoda Auto and Intigriti, among others.

  • Sandbox escapesBrowser and OS sandboxes, IPC
  • APIsAuthorization and logic flaws
  • Kernel and hypervisorPrivilege escalation, guest-to-host
  • Hardware and firmwareIntel ME, platform firmware

Disclosures

Coordinated with vendors
IDs go public once fixes ship
Selected research

Intel Management Engine

On a 2017-era platform, I took control of the whole machine through the ME, the separate processor built into the chipset. Access held even while the PC was switched off.

IPTV set-top box

Defeated the cryptographic check that verifies the box's firmware before it runs. That meant full control of the device and the ability to flash any firmware, including images the vendor never signed.

  • CVE-████-█████Remote code executionRedacted targetDisclosure pending
  • CVE-████-█████Authentication bypassRedacted targetDisclosure pending
  • CVE-████-█████Sandbox escapeRedacted platformUnder embargo
  • CVE-████-█████Kernel privilege escalationRedacted OSUnder embargo
  • CVE-████-█████Hypervisor guest-to-hostRedacted hypervisorUnder embargo
  • CVE-████-█████API authorization bypassRedacted serviceUnder embargo

Details are withheld until the affected vendors have patched. This list fills in as embargoes lift.

Say hello

Found something?
Encrypt anything sensitive.
Peter_mikeska@icloud.com
PGP
7C68 8AAA DFF2 18F5 64AA 9B11 D90D 7E4A 8A01 F721
Show public key 
-----BEGIN PGP PUBLIC KEY BLOCK-----

xjMEarRAShYJKwYBBAHaRw8BAQdAR1yKBaETjVG5lfNyZm0D4DgxWV/wSwbR
4hRQqeoY4SDNKFBldGVyIE1pa2Vza2EgPFBldGVyX21pa2Vza2FAaWNsb3Vk
LmNvbT7CwBkEExYKAIsFgmq0QEoFiQ8JnAADCwkHCRDZDX5KigH3IUUUAAAA
AAAcACBzYWx0QG5vdGF0aW9ucy5vcGVucGdwanMub3Jn9Y69zBhPHtbozw/i
hrn9WfmI33ihespS/ECroer85m0FFQoIDgwEFgACAQIZAQKbAwIeARYhBHxo
iqrf8hj1ZKqbEdkNfkqKAfchAACNrgEAhVPQ35tyy6UARXvthxF1EgUlVz1A
8GCbPE+7xgBF/AYBAKz3RQg8dPXVft6ibEXVMZ+KXNpQl8UDaV/PgYJO7EUM
zjgEarRAShIKKwYBBAGXVQEFAQEHQMbOyXQfcnBxcKki7ZcbHMXPVZgz0IZB
Btk845GwwfBiAwEIB8LABAQYFgoAdgWCarRASgWJDwmcAAkQ2Q1+SooB9yFF
FAAAAAAAHAAgc2FsdEBub3RhdGlvbnMub3BlbnBncGpzLm9yZ0u9wImFkAnq
1w/qjQy0CtOyR9c5pbC0yaKq6ZeudN/oApsMFiEEfGiKqt/yGPVkqpsR2Q1+
SooB9yEAAK6PAP9T1X2aL58gzHkDEfLxTasvnsbPVRNd9jyfTmKIFcWwhwEA
i3ls64JqV1HAuWB0rEiEHVXf4p5qSU+q4FQDShtc7go=
=xMG7
-----END PGP PUBLIC KEY BLOCK-----
Elsewhere
GitHubMastodon

Keep scrolling, it loops