91
NCSC, GCHQ, UK Gov't expunge advice to “use Apple encryption”
This is some really embarrassing timing on the Home Office’s (HO’s) part: a few weeks ago when news first broke of the HO’s demand for a backdoor in Apple ADP, I pointed out to MP…
92
WorstFit: Unveiling Hidden Transformers in Windows ANSI
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
93
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
94
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
95
Notes by djb on using Fil-C
I'm impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++). Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.
96
I ruined my vacation by reverse engineering WSC
describing my wsc adventure
97
An illustrated guide to OAuth
OAuth was first introduced in 2007.
98
99
Leaving Gmail for Mailbox.org
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
100
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
101
Show HN: I'm building a browser for reverse engineers
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
102
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
103
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
104
What's OAuth2, anyway?
Why the OAuth2 protocol was designed the way it is and how it works.
105
Beating Google's kernelCTF PoW using AVX512
PoW is gone 🦀🦀
106
Trick users and bypass warnings – Modern SVG Clickjacking attacks
A novel and powerful twist on an old classic.
107
A Vulnerability in Libsodium
Libsodium is now 13 years old!
108
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
109
Pwning the Ladybird Browser
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
110
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
111
Leaking Passwords and more on macOS
A security research blog.
112
X Just Accidentally Exposed a Covert Influence Network Targeting Americans
How a new X feature led to the most sweeping public exposure of covert foreign activity on a major platform since 2016.
113
Denuvo Analysis
This post is intended for educational purposes only. Denuvo is arguably the most successful digital rights management solution to have ever existed, and is therefore an interest to many. This blog contains a large amount of my personal notes and correspondence with other reverse engineers (see kudos ) which contains…
114
Anubis Works
Xe Iaso's personal website.
115
116
Hacking a Smart Home Device (2024)
How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.
117
Everyone knows your location, Part 2: try it yourself and share the results
Learn how to record and analyse your mobile device traffic, take an app from the list of "shady" apps and share the results.
118
NSA and IETF, part 3: Dodging the issues at hand
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
119
Avoid ISP Routers (2024)
Avoid ISP routers
120
I caught Google Gemini using my data and then covering it up
I asked Google Gemini a pretty basic developer question. The answer was unremarkable, apart from it mentioning in conclusion that it knows I previously used ...