Focus Talks CVE Feed Blog Whitepapers Compliance Disclosure Policy Contact
Edward "Actuator" Warren | DEF CON 33

Independent Mobile & IoT Vulnerability Research

Actuator Security is a cybersecurity research lab dedicated to strengthening resilience across Mobile and IoT technologies that people rely on every day.

All findings are responsibly disclosed to affected vendors-following a 90-day coordinated disclosure process in alignment with Google's Project Zero’s reporting guidelines.

Mobile Application Security
Internet of Things (IoT)
Reverse Engineering
View CVE Feed > Contact
Focus

Research and Public Work

We conduct security research focused on systemic weaknesses in mobile and IoT platforms.

Our research has led to the discovery of numerous critical (CVSS) vulnerabilities and over 100 CVE attributions, with recognition from bug bounty programs including the Google Play Security Reward Program (GPSRP) , TCL, and OPPO.

Actuator Security has presented vulnerability findings at major security conferences including DEF CON , ShmooCon, and Security BSides Las Vegas .

Blog

Recent Blog Posts

Talks

Recent Conference Presentations

Hacking Hotspots: Pre-Auth Remote Code Execution, Arbitrary SMS & Adjacent Attacks on 5G and 4G/LTE Routers Edward "Actuator" Warren This research examines security oversights in modern 4G/5G routers used in small businesses, industrial IoT, and mobile deployments. Several routers contain weaknesses such as weak default credentials, inadequate authentication checks, and command injection pathways. Reverse-engineering and endpoint analysis enabled practical demonstrations of RCE, arbitrary SMS sending, and related exploitation on Tuoshi and KuWFi devices. Through examples including Burp Suite traffic and Ghidra disassembly, the talk highlights how these flaws can give attackers root access, enable fraudulent activity, or compromise entire networks. Recommended mitigations include hardened authentication, regular firmware updates, and proper segmentation. Link: https://defcon.org/html/defcon-33/dc-33-speakers.html#content_60370 https://github.com/actuator/DEFCON-33
The Permission Slip Attack: Leveraging a Confused Deputy in Android with ‘pSlip’
ShmooCon - 01/2025 - Washington, D.C.
CVE Feed

Selected Public Disclosures

CVE Target Category Impact Install Surface (Android) CVSS Year

Need an Android or IoT surface reviewed?

If you're interested in a FREE consultation on your connected device or app’s security posture and its business implications, don’t hesitate to reach out!

Email Us