Malformed Bluetooth packets
Written in Rust, packets must match an exact size and format, and the parser is tested against 200,000 random packets.
Day job
What I do
I secure commercial aircraft systems as a Product Security Engineer II and Backup Team Lead at Boeing, helping them meet FAA and EASA airworthiness and cybersecurity requirements. That work stays private, so this page shows how I think through the things I can share.
Security assessments
Leading assessments of aircraft systems against FAA and EASA requirements.
Vulnerability management
Scanning with Nessus and Nmap, triaging findings, and driving critical exposures to remediation.
Continued airworthiness
Log analysis and archive reviews that resolve airline Service Requests.
PKI and TLS
Certificate Signing Requests and SSL/TLS configuration for web applications.
Threat model
🎧 EarDeck
EarDeck is my free, open source AirPods tray app for Windows, built in Rust. Any Bluetooth device in range can broadcast anything and pick any name, so the main threat is someone nearby. Pick a side of the attack surface to see what could go wrong there and what stops it.
10threats modeled
200,000random packets thrown at the parser
0admin rights, drivers, or data sent anywhere
A fake device that tries to pair
Pairing only happens when you pick a device. Only AirPods and Beats names are accepted, and EarDeck refuses any device that asks for a PIN.
Fake broadcasts that change the display or pause your media
Broadcasts must match your model and be close by. Auto-pause only runs while your AirPods are connected and are the current output.
A device name built to run code in the popup
Names are escaped, and the content security policy blocks inline and remote scripts.
The popup being sent to a website
Navigation is blocked, and the popup can only load the pages built into the app.
A compromised popup reaching more of the app
It gets only the permissions it needs, and the backend checks inputs itself.
A planted program at startup
The Open at Login path is quoted, which stops unquoted path attacks.
Remote debugging through an environment variable
Cleared when the app starts.
A hand-edited settings file
Values are range checked when loaded.
A vulnerable dependency
cargo audit runs on every change and weekly, and Dependabot proposes updates.
Known limits
A threat model that claims to stop everything isn't telling the truth, so these are written down too.
- Fake broadcasts can't be fully stopped, because AirPods broadcasts are not authenticated. Someone nearby could show false battery levels or trigger a pause, but they can't reach your files or your audio.
- Pairing relies on the device's name, so only pick a device you just put in pairing mode.
- Releases aren't code signed yet, so the releases page lists a SHA-256 value to check your download against.
- Malware already running as your user is out of scope, since it could already change anything EarDeck can.
Standards
📜 Standards and tooling
In aviation, security has to be shown to a regulator, not just claimed. These are the public standards and tools behind my work.
DO-326B
The airworthiness security process: how aircraft security gets planned and shown during certification.
DO-356B
The methods and considerations that put the airworthiness security process into practice.
DO-178
Software considerations for airborne systems and equipment certification.
FAA and EASA
Airworthiness and cybersecurity requirements, including continued airworthiness once aircraft are in service.
Disciplines
- Vulnerability Assessment
- Penetration Testing
- Threat Analysis
- Log Analysis
- Digital Forensics
- Reverse Engineering
- PKI and TLS
Toolbox
- Nessus
- Nmap
- Wireshark
- Kali Linux
- Docker
- Python
- C
- C++
Live test
🔒 This site defends itself
A security engineer's website should practice what it preaches. GitHub Pages doesn't let me set response headers, so every defense here has to work from the page itself. For example, the Content Security Policy lives in a meta tag at the top of each page.
🧱 Content Security Policy
Every page starts from default-src 'none' and only allows what it needs.
🚫 No inline code
All scripts and styles ship as files, so the policy never needs 'unsafe-inline'.
📦 No third-party scripts
Even the font and icons are self-hosted, so no outside stylesheet or script can change under me.
🔐 HTTPS everywhere
GitHub enforces HTTPS, and every .dev domain is on the browser HSTS preload list.
🤖 UltroBot status, safely
The status badge asks a separate signed-heartbeat service, never my home server, so this site opens no path into my network.
📬 security.txt
A standard RFC 9116 file tells researchers how to reach me.
🔬 Static analysis
CodeQL checks the site's JavaScript on every change and weekly.
🕷️ Dynamic analysis
A ZAP baseline scan runs against a local copy of the site on every change and weekly.
📌 Pinned actions
GitHub Actions are pinned to exact commits, and Dependabot proposes updates.
⚠️ Known gap
Clickjacking protection, a few hardening headers, and violation reports need real response headers, which GitHub Pages can't send.
🧪 Live test
Press the button and this page will attack itself four ways. The results come from your own browser as it runs them, so nothing here is canned.
See the policy on this page
🧪 Security at home
I practice the same habits in my homelab: IoT devices kept on their own segmented network, WireGuard for remote access, a Pi-hole DNS sinkhole, and services behind a reverse proxy with TLS.
Read the homelab case study📬 Found something?
If you find a security problem on this site, please email admin@diegoarivada.dev with the steps to reproduce it. This is a personal site, so there's no bug bounty, but I read every report.
For EarDeck, please use GitHub's private vulnerability reporting.