iiinova — where your digital self keeps evolving

Marta Rybczynska

@mrybczyn.bsky.social

Talking about open source security & tech. Founder of Ygreky ygreky.com

Marta Rybczynska @mrybczyn.bsky.social · 20/08/2026

Firmware for most IoT devices is a black box and the security model based on the assumption that nobody would take the time to disassemble the binary. And well... this assumption is going away with AI. Paper link: arxiv.org/pdf/2608.06960

Statistical Analysis of Executability and Program Equivalence in Decompilation for IoT Vulnerbility Detection - paper extracts (authors: Yoda, Li, Tahara, Sei)

000

Marta Rybczynska @mrybczyn.bsky.social · 06/08/2026

The new issue of the Embedded Security Timeline is out. In the latest episode: - a number of CRA-releated updates including the Single Reporting Platform news and the Guidelines - secure boot issues with outdated shims - poll results of the month Read it online: ygreky.com/2026/08/july...

010

Marta Rybczynska @mrybczyn.bsky.social · 15/02/2026

Under the #CRA (Cyber Resilience Act), manufacturers must report actively exploited vulnerabilities and serious security incidents. How? Through the Single Reporting Platform. Starting when? September 11, 2026. Yes, this year. Link to the FAQ: www.enisa.europa.eu/topics/produ...

ENISA Single Reporting Platform FAQ - https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp

043

Marta Rybczynska @mrybczyn.bsky.social · 30/12/2025

What does your factory reset actually wipe? Have you ever checked? A device leaves your factory. Years later, it is resold, returned, or thrown away. And yet, on many products, sensitive data is still there. All of our challenges: ygreky.com/challenge/

000

Marta Rybczynska @mrybczyn.bsky.social · 11/12/2025

Today is Thursday, the day of the Embedded Security Challenge. Your task for this week: review the "private" networks your devices rely on. Are they truly private? And even if they are, how do you protect the device when someone plugs a modem into the network?

Embedded security challenge: private network

110

Marta Rybczynska @mrybczyn.bsky.social · 10/12/2025

The Yocto Project Virtual Summit 2025.12 wrapped up last week with three days of great content. The new security track worked especially well (in my opinion), with strong interest in CVE-related tooling, secure boot, and vulnerability reporting. ygreky.com/2025/12/yoct...

Yocto Project Summit 2025.11 - My impressions: the "security day" and way more

010

Marta Rybczynska @mrybczyn.bsky.social · 08/12/2025

Solid embedded teams keep track of everything they deliver: hardware, software, and configuration. Every time they deliver. 👉 The Embedded Security Challenge for this week: create or review your release storage. Make sure every single component you ship is recorded and stored.

110

Marta Rybczynska @mrybczyn.bsky.social · 14/03/2025

VulnCon is a quite unique conference focus on software (and not only) vulnerability management. It is happening at the beginning of April and I will be speaking twice.

141

Marta Rybczynska @mrybczyn.bsky.social · 10/01/2025

The second week of our embedded security challenge has started. How do attackers get into a router or an industrial device? Not by the primary function but by the web application you can use to monitor and administer the device. Check the challenge at ygreky.com/challenge/

000

Marta Rybczynska @mrybczyn.bsky.social · 08/01/2025

Embedded Security Challenge week 1 (until Jan 9, 2025): What are your product's services (applications, daemons) communicating, or potentially communicating with the Internet? Check all network interfaces. Also, check for both applications sending data and those listening. ygreky.com/challenge/

110