Edward "Actuator" Warren | DEF CON 33

Mobile Threat Research

Actuator Security is a cybersecurity research lab dedicated to strengthening resilience across Mobile and IoT technologies that people rely on every day.

All findings are responsibly disclosed to affected vendors following a 90-day coordinated disclosure process in alignment with Google's Project Zero reporting guidelines.

Mobile Application Security
Internet of Things (IoT)
Reverse Engineering
View CVE Feed > Contact
Focus

Public Work

We research systemic weaknesses in mobile and IoT platforms.

Our work has led to the identification and disclosure of critical and high severity (CVSS) vulnerabilities and discovery of over 100 CVEs impacting billions of users-including bug bounty program acknowledgements from companies including Google, OPPO, TCL, Xfinity Home, Arlo & Netgear.

We have been fortunate to present our research at cybersecurity conferences such as DEF CON, ShmooCon, Security BSides Las Vegas & Ekoparty Miami.

Blog

Recent Blog Posts

Talks

Selected Conference Presentations

Hacking Hotspots: Pre-Auth Remote Code Execution, Arbitrary SMS & Adjacent Attacks on 5G and 4G/LTE Routers Edward "Actuator" Warren This research examines security oversights in modern 4G/5G routers used in small businesses, industrial IoT, and mobile deployments. Several routers contain weaknesses such as weak default credentials, inadequate authentication checks, and command injection pathways. Reverse-engineering and endpoint analysis enabled practical demonstrations of RCE, arbitrary SMS sending, and related exploitation on Tuoshi and KuWFi devices. Through examples including Burp Suite traffic and Ghidra disassembly, the talk highlights how these flaws can give attackers root access, enable fraudulent activity, or compromise entire networks. Recommended mitigations include hardened authentication, regular firmware updates, and proper segmentation. DEF CON 33 speaker page github.com/actuator/DEFCON-33
The Permission Slip Attack: Leveraging a Confused Deputy in Android with 'pSlip'
ShmooCon - 01/2025 - Washington, D.C.
CVE Feed

Selected Public Disclosures

CVE Target Category Impact Install Surface (Android) CVSS Year

Need an Android or IoT surface reviewed?

If you're interested in a FREE consultation on your connected device or app's security posture and its business implications, don't hesitate to reach out!

Email Us