Research, demonstrations, and popcorn
I gave a separate Android app an intent that Glassdoor should have treated as external. It opened Glassdoor’s internal Apply screen, loaded JavaScript I controlled, and ended on Glassdoor’s real “Your application was sent” screen. I had not…
I found a route bypass in Linktree’s Android app. A crafted deep link could open an arbitrary website inside Linktree, give the page a trusted-looking title, and hide the separate domain label. I reproduced the behavior on version…
I tore apart an LG a few weeks back and told you what was living inside it. A few of you asked whether Sony was any cleaner. Short answer… no. Same racket, different logo. This was my own…
I pulled apart the firmware for a current LG webOS TV. Owner-authorized, static analysis only, on my own set. I decrypted the SECURED update package, extracted all 17 partitions, unpacked the 1.58 GB root filesystem, and decompressed the…
What happened to the site Everything from 2014 through 2019 is restored, images and all… the Alienware and Buffalo Wild Wings disclosures, the MongoDB ransom research, the Arris and NetGear write-ups, the password manager rant, and the political…
If you are like 90% of people in IT or hackers in general, you probably prefer the dark mode on applications simply because it is easier on the eyes. Good news… you can enable dark mode in Microsoft’s…
It doesn’t take an IT person to know that access to information and security are fighting in the opposite direction. User experience, usability, and friendly intuitive design are products of easy integration and access to data. Information Security…
Several stories from top news organizations are running stories making it look like systems are not working because of the federal budget not being approved and the “shutdown.” This is not true. The computers that run all of…
2019 is upon us. We survived that mess of a year we called 2018. I think of it like a test. We managed to pass and are still here. There were a lot of security breaches in 2018…
Recently a “researcher” has gone on a marketing blitz trying to convince the world he found a vulnerability that doesn’t exist. This vulnerability has been dubbed ‘RID Exploitation.’ According to this researcher, the RID is the relative identifier…
