181
How we rooted Copilot
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
182
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
183
TinyKVM: Fast sandbox that runs on top of Varnish
TinyKVM can be used to sandbox regular Linux programs or programs with specialized APIs embedded into your servers.
184
185
Show HN: I'm building a browser for reverse engineers
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
186
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
187
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
188
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
189
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
190
O2 VoLTE: locating any customer with a phone call
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
191
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
192
What's OAuth2, anyway?
Why the OAuth2 protocol was designed the way it is and how it works.
193
Beating Google's kernelCTF PoW using AVX512
PoW is gone 🦀🦀
194
Trick users and bypass warnings – Modern SVG Clickjacking attacks
A novel and powerful twist on an old classic.
195
Tell the EU: Don't Break Encryption with "Chat Control"
The EU’s Chat Control law would scan private messages and weaken encryption. Sign Mozilla Foundation’s petition to defend privacy and protect our digital future.
196
A Vulnerability in Libsodium
Libsodium is now 13 years old!
197
My bank keeps on undermining anti-phishing education
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
198
Pwning the Ladybird Browser
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
199
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
200
Introducing a terms of use and updated privacy notice for Firefox
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t
201
NL Judge: Meta must respect user's choice of recommendation system
Bits of Freedom komt op voor internetvrijheid door de online grondrechten op communicatievrijheid en privacy te beschermen.
202
Leaking Passwords and more on macOS
A security research blog.
203
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
204
Firefox expands fingerprint protections
With Firefox 145, we’re rolling out major privacy upgrades that take on browser fingerprinting — a pervasive and hidden tracking technique that lets we
205
X Just Accidentally Exposed a Covert Influence Network Targeting Americans
How a new X feature led to the most sweeping public exposure of covert foreign activity on a major platform since 2016.
206
Denuvo Analysis
This post is intended for educational purposes only. Denuvo is arguably the most successful digital rights management solution to have ever existed, and is therefore an interest to many. This blog contains a large amount of my personal notes and correspondence with other reverse engineers (see kudos ) which contains…
207
Anubis Works
Xe Iaso's personal website.
208
209
Hacking a Smart Home Device (2024)
How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.
210
Everyone knows your location, Part 2: try it yourself and share the results
Learn how to record and analyse your mobile device traffic, take an app from the list of "shady" apps and share the results.