About
Thomas Sermpinis (a.k.a. Cr0wTom) is a distinguished security engineer and researcher currently serving as Device Security Engineer and Lead for TFH. In this capacity, he engineers innovative solutions that shape the future of security for next-generation hardware ecosystems. Concurrently, he guides the strategic direction of Auxilium Pentest Labs as a member of the Supervisory Board.
Previously, as CTO of Auxilium, Thomas directed over 300 security assessments for top-tier automotive OEMs, ensuring the safety of global vehicle fleets. Under his leadership, his team achieved industry-leading research results, including a 1st place victory at the DEF CON Car Hacking Village CTF 2025. A recognized expert in embedded and low-level security, Thomas holds OSCP and OSCE certifications and has a proven track record of finding critical zero-day vulnerabilities in products from Google, Qualcomm, and Nissan.
Beyond his corporate roles, Thomas is an active angel investor, advisor, and the founder of Cr0w’s Place. He is a frequent speaker at top-tier conferences (DEF CON, Zer0Con, TROOPERS) and remains deeply involved in the community through educational content creation, open-source contributions and his role as CFP review board in several security conferences, including Secure Our Streets.
Academic
- Master’s Degree on Informatics and Management - Aristotle University of Thessaloniki (AUTH)
- Bachelor’s Degree on Administration and Economics - University of Applied Sciences of Central Macedonia
Experience
- Senior Staff Device Security Engineer / Lead - Tools For Humanity
- Supervisory Board - Auxilium Pentest Labs
- Chief Technology Officer / Technical Director - Auxilium Pentest Labs
- Automotive Penetration Testing Lead - Auxilium Cyber Security
- Senior Cyber Security Consultant - Auxilium Cyber Security
- Cyber Security Consultant - Auxilium Cyber Security
- Security Researcher / Founder - Cr0w’s Place
- Cyber Security Analyst - Auxilium Cyber Security
- Blockchain Engineer - Aristotle University of Thessaloniki (AUTH)
- Security Workshop Instructor - HAKIN9 MEDIA SP
- IT Assistant - Thessaloniki International Film Festival - TIFF
- Magazine Editor - Parabing Creations
Talks
- The Matrix Unloaded: Escaping the JTAG Reality - Off By One 2025
- The hack, the crash and two smoking barrels. (And all the times I (almost) killed an engineer.) - DEFCON32 | EKOPARTY 2024
- V2GEvil: Ghost in the wires - DEFCON32 CHV | TROOPERS24 | ScapyCon 2024 | DeepSec 2024
- Need For Speed: The Fight for Ownership - TyphoonCon 2024
- Back to the Future: Old Vulnerabilities Becoming New Again - Zer0Con 2024
- Horror Stories from the Automotive Industry - Chaos Computer Camp 2023 | TROOPERS23 | DeepSec 2023 | EKOPARTY 2024 - CHV
- UDS Fuzzing and the Path to Game Over - TROOPERS23
- Integration of Near Field Communication technology into Warehouse Management Systems - 12th Student Conference on Management Science and Technology
- Integration of Augmented Reality technology into Warehouse Management Systems - 12th Student Conference on Management Science and Technology
- Traceability Decentralization in Supply Chain Management Using Blockchain Technologies - 4th Olympus International Conference on Supply Chains
- Penetration Testing with Android Devices - Google DevFest 2014 Season of Thessaloniki
Publications
- DeTRACT: a decentralized, transparent, immutable and open PKI certificate framework - International Journal of Information Security (Springer)
- Traceability Decentralization in Supply Chain Management Using Blockchain Technologies - 4th Olympus International Conference on Supply Chains
- Vehicle On-Board Charging Security Scanner
CVEs
- [CVE-2024-6348] Predictable seed generation after ECU reset
- [CVE-2024-6347] Unauthorized access to ECU functionality
- [CVE-2021-29507] Improper Input Validation leads to buffer overflow in dlt-daemon
- [CVE-2020-26800] Stack based buffer overflow while parsing JSON file in Aleth C++ Ethereum client
- [CVE-2020-24807] File Type Restriction Bypass in Socket.io-file NPM module
- [CVE-2020-15779] Path Traversal in Socket.io-file NPM module
Awards
- 1st place in Car Hacking Village CTF - DEFCON33, DEF CON Car Hacking Village
- 3rd place in Car Hacking Village CTF - DEFCON32, DEF CON Car Hacking Village
- Scholarship, TROOPERS 18
- Scholarship, BlackHat Europe 2017
- Scholarship, BlackHat Asia 2017
- Scholarship, TROOPERS 17
- Scholarship, BlackHat Europe 2016
- Honorary Selection for Reduced Military Service, Hellenic Air Force
- 2nd Greek Champion Under 22 4x400m Relay, Track and Field
- Greek Army Champion 4x100m Relay 2014
- Greek Champion 4x400m Relay, Track and Field
- Greek Champion Under 22 4x400m Relay, Track and Field
Skills
- OSCE - Offensive Security Certified Expert
- OSCP - Offensive Security Certified Professional
- CfP Review Board
- Penetration Testing
- Security Analysis and Research
- Automotive Security
- Blockchain Security
- Programming and Scripting (Python, C, Solidity, Go, Bash)
- Blockchain Technologies (Ethereum, Hyperledger Fabric)
- Supply Chain Management