121
The patent troll that won a $308M jury trial against Apple
*If you’re the owner of this website and have questions, reach out to Bluehost. We’re happy to help.
122
What3Words – The Algorithm
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
123
Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
124
Indian Government Breached, Massive Amount of Critical Vulnerabilities
A writeup detailing the vulnerability reporting process that took place after Sakura Samurai had breached the Indian Government
125
SAML Is Insecure by Design
What is SAML? Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. Source: Wikipedia SAML is often used for single-sign on (“Sign in with Google”, “Sign in with Twitter” etc.). It means when you want to log in to example.com, example.com…
126
127
128
How to boost your popularity on OkCupid using CSRF and a JSON type confusion
This is a quick blog post about a security vulnerability (now fixed) that allowed me to make anyone like or message a profile on okcupid.com simply by getting them to click a link on my website. In doing so, I used one of the most boring web application security issues (CSRF) combined with a somewhat interesting JSON…
129
EBCDIC is incompatible with GDPR
Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little…
130
Malwarebytes' privacy VPN is Mullvad in a shady trenchcoat
Personal blog of Julien (jvoisin) Voisin
131
Writing a firmware-only keylogger
In the previous blog post, I looked at the EC firmware in my laptop. This time I will look into the WiFi firmware of the same laptop.
132
CVE Stuffing
I monitor the @CVENew Twitter feed to keep up with any interesting new vulnerabilities that are released. On December 11th CVE-2020-29589 was published claiming that “the kapacitor Docker ima…
133
Did Schnorr destroy RSA? Show me the factors
Schnorr has claimed new factoring methods that “destroy RSA”. This should be easy to demonstrate with well known challenges.
134
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
135
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
136
An unwanted update to your Google Account
Google sent me an email informing me that they will change the country associated with my account in 30 days. I wanted to know why.
137
The ‘Zelle fraud’ scam: how it works, how to fight back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that…
138
Getting Started with Signal
How to take advantage of Signal for secure messages and calls
139
Hacking YouTube with a MP4
Keyboard Warrior, Breaking software is just finding unintended features, right?
140
Apple Silicon Hardware: SPRR and Guarded Exception Levels (GXF)
Over a year ago siguza published a write-up about Apple’s APRR - a custom ARM extension that redefines pagetable permissions and protects certain parts of the kernel from itself. Since then Apple has released their M1 chip which not only features an updated version of APRR but also easily allows to run bare-metal code…
141
Clever uses of pass, the Unix password manager
Pass ( main site , Arch wiki ) is a command-line Unix password manager that utilizes GPG for all underlying encryption. However, beyond passwords, we can utilize it in a number of clever ways.
142
Tracking One Year of Malicious Tor Exit Relay Activities (Part II)
>25% of the Tor network’s exit capacity has been attacking Tor users
143
The Most Backdoor-Looking Bug I’ve Ever Seen
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
144
Chrome may start restricting requests to private networks
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
145
146
The embedded YouTube player told me what you were watching
David Schütz's bug bounty writeups
147
Bitsquatting Windows.com
Earlier this month, I came back around to seriously considering an attempt at bitsquatting. While the prior link goes into great depth on the topic, I will attempt to give a very high level overview here: If this sort of thing interests you: I tend to do stuff like this weekly. Give me a follow @_mattata
148
Using fake reviews to find dangerous extensions
Fake, positive reviews have infiltrated nearly every corner of life online these days, confusing consumers while offering an unwelcome advantage to fraudsters and sub-par products everywhere. Happily, identifying and tracking these fake reviewer accounts is often the easiest way to spot scams. Here’s the story of how…
149
150
How does Google Authenticator work?
This post is the first in a three-part series. The remaining two: How does Google Authenticator work? (Part 2) How does Google Authenticator work? (Part 3) When you’re accessing services over the WEB – let’s pick GMail as an example – a couple of things have to happen upfront: The server you’re connecting to (GMail in…