Research, demonstrations, and popcorn
I gave a separate Android app an intent that Glassdoor should have treated as external. It opened Glassdoor’s internal Apply screen, loaded JavaScript I controlled, and ended on Glassdoor’s real “Your application was sent” screen. I had not…
I found a route bypass in Linktree’s Android app. A crafted deep link could open an arbitrary website inside Linktree, give the page a trusted-looking title, and hide the separate domain label. I reproduced the behavior on version…
I tore apart an LG a few weeks back and told you what was living inside it. A few of you asked whether Sony was any cleaner. Short answer… no. Same racket, different logo. This was my own…
I pulled apart the firmware for a current LG webOS TV. Owner-authorized, static analysis only, on my own set. I decrypted the SECURED update package, extracted all 17 partitions, unpacked the 1.58 GB root filesystem, and decompressed the…
Recently a “researcher” has gone on a marketing blitz trying to convince the world he found a vulnerability that doesn’t exist. This vulnerability has been dubbed ‘RID Exploitation.’ According to this researcher, the RID is the relative identifier…
Stephen Hawking passed away today at the age of 76. Many thought it would come much earlier in his life. Many thought it would never happen because he was a super genius from another dimension (sarcasm). Regardless, the…
I have spent a great deal of time researching the best way to avoid security exposure via source control. This has become a hot-button issue right now due to the Deloitte hack. As it turns out, one of…
First, let me say that I am a self-contradicting person. I am a collector of knowledge. I seek information that is hard to find or I shouldn’t know. The reason is simple, with knowledge comes power… the power…
Anyone that is even semi-competent online knows how difficult it can be to manage passwords. Most people have 15 accounts at a bare minimum online. Managing passwords for many accounts becomes difficult. Generally, people take one of three…
On Tuesday March 7th, 2016, WikiLeaks posted a trove of stolen files and data sourced from inside the Central Intelligence Agency. This information was posted to the WikiLeaks website with a press release claiming the need for transparency…
