A rather geeky/technical weblog, est. 2001, by Bramus
While looking at a package.json from a public project from PayPal, Alex Birsan noticed that it held some references to private NPM packages used internally by PayPal. Birsan noticed some of the manifest file packages were not present on the public npm repository but were instead PayPal’s privately created npm packages, used and stored internally …
Amazing rundown by Ryan Pickren on how he gained unauthorized Camera access on iOS and macOS. We started on a normal HTTP website and ended up on a bastardized blob URI in a Secure Context. Here is a quick summary of how we did it: Open evil HTTP website HTTP website becomes a data: URI …
Google Maps Hack by Simon Weckert: 99 second hand smartphones are transported in a handcart to generate virtual traffic jam in Google Maps. Through this activity, it is possible to turn a green street red which has an impact in the physical world by navigating cars on another route to avoid being stuck in traffic. …
Continue reading “Google Maps Hacks: Creating a Virtual Traffic Jam”
Cool interactive site showing your how to perform a Server Side Request Forgery hack, based on a true incident: The following interactive tutorial is a reconstruction of Capital One’s data breach incident that exposed the records of almost 106 million customers. Paige Thompson is accused of breaking into a Capital One server and gaining access …
Continue reading “Learn about security by hacking a fake bank using a real hacking method”
Sean Coone got hacked last week. Even with 2FA enabled, hackers got in … because his phone number got transferred to a rogue device: My personal identity was hacked last week. The attacker was able to steal $100k+ in a sweep of my Coinbase account. I’m equal parts embarrassed, hurt, and deeply remorseful. In an …
Continue reading “The Most Expensive Lesson Of My Life: Details of SIM port hack”
It looks like an ordinary Lightning to USB Cable from Apple, yet it’s not: it’s got built-in Wifi and can receive payloads which get executed on the machine it’s plugged in 😱 However, let this be a reminder to never trust external cables (or USB outlets for that matter!), found USB sticks, etc. O.MG Cable …
A lesson in webdev history by Jason Hoffman: The clearfix, for those unaware, is a CSS hack that solves a persistent bug that occurs when two floated elements are stacked next to each other. When elements are aligned this way, the parent container ends up with a height of 0, and it can easily wreak …
Continue reading “Clearfix: A Lesson in Web Development Evolution”
Jake Archibald discovered a really nice browser bug (which is fixed by now) by which he was able to steal data from remote sites by loading it in as a (fake) wav file. The exploit works as follows: Make a request to evil-script, using a Content-Range header to suggest there’s more data to be loaded …
Continue reading “Wavethrough – Stealing data from remote sites through (fake) wav files”
Ruslan Habalov and Dario Weißer found a way to read contents from an iframe, using CSS3: Accessing the DOM of an iframe that includes a cross-origin resource is forbidden by default. However, the content of the iframe was displayed in the same context as the rest of the site so we wanted to verify if …
Continue reading “Side-channel attacking browsers through CSS3 features”
Recently James Fisher received an email from Netflix asking him to update his credit card information. “Odd,” I thought, “but OK, I’ll check.” The email is genuinely from netflix.com, so I clicked the link. It logged me in and took me to an “Update your credit or debit card” page, which is genuinely hosted on …
Continue reading “The dots do matter: how to scam a Gmail user”