x1sec

7 ms·

1.
by x1sec 3y ago
Could you describe the smell?
2.
by x1sec 3y ago
By "extensibility" does this mean the ability to write your own extensions? Being able to develop and contribute plugins back to the community (similar to Burp's BApp store) could really accelerate the competitiveness of Caid
3.
by x1sec 3y ago
Caido[1] a interception proxy written in Rust, is positioning itself as a "lightweight" alternative to Burp. It can't compete yet with Burp in terms of functionality, although the product is certainly looking promising. Perha
4.
by x1sec 3y ago
This is not a new plugin; it (and similar extensions) have been available for Burp and a staple for testers for a few years now. Automating authorisation checks has less to do with novelty seeking and more to do with the practicalities of e
5.
by x1sec 3y ago
In the Q&A section, the speaker remarks: "There is a part of the talk where I am trying to perform a little bit.. the thing that I'm also talking about. My background is in art .. and we always try to think about form and cont
6.
by x1sec 3y ago
Perhaps a physical switch that connects or disconnects the electrical signal from the microphone to the handset could be a more convenient approach. There is a photo of Mark Zuckerberg with a cut off 3.5mm jack plugged into his laptop - lik
7.
by x1sec 3y ago
How frequent?
8.
by x1sec 3y ago
In a week, a lot of data can be exfiltrated. Then after you have rebooted, the threat actor reinfects your device. Frequently rebooting the device can’t hurt but it likely isn’t going to prevent a threat actor from achieving their objective
9.
by x1sec 3y ago
A port of the tutorial's Pascal code to C which emits x86 assembly: https://github.com/lotabout/Let-s-build-a-compiler
10.
by x1sec 3y ago
> Of course it is quite common to need to read it This is a notable differentiation - Writing assembly is a different skill to reading it from a disassembly. Reverse engineering, malware analysis etc. does not inherently require you to b
11.
by x1sec 3y ago
SSID / BSSID is often enough to pinpoint the location. Recently someone debated this with me, so I asked him what his wifi AP name was, then proceeded to provide their home address. How? By searching it in https://wigle.net
12.
by x1sec 3y ago
Recently having stumbled across the VSCode shellcheck plugin[1] - it's been particularly educational as it provides not only corrections but improvement tips. For example the common practice of: if [ $? -ne 0 ]; then Will get flagged a
13.
by x1sec 3y ago
Cal Newport, the author of 'Deep Work'[1] releases frequent content on Youtube [2] that attempts to address the kind of challenges expressed by the author. [1] https://www.goodreads.com/en/book/show/
14.
by x1sec 3y ago
Pikuma has a 25 hour “NES Programming with 6502 Assembly” that is both accessible to beginners with little to no prior knowledge and being packed with content. [1] He also has other interesting courses which touch upon “retro” programming i
15.
A friend asked me to find out why his lightbulb app was asking for his location(twitter.com)
3 points by x1sec 3y ago|0 comments
16.
by x1sec 3y ago
I'm not sure if either of you will read this message - I kept my word and looked into the app https://twitter.com/haxrob/status/1673874637632196608
17.
by x1sec 3y ago
I'm confused by what you mean here, could you elaborate? For clarification - you purchase the hardware then you are required to download the phone application. You find this app by scanning the QR code printed on the physical device&#x
18.
by x1sec 3y ago
> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. If this is the take away, then I need t
19.
by x1sec 3y ago
Hey thanks, Daneel - A bit of accountability always helps!
20.
by x1sec 3y ago
Google do offer Android app developers guidance in this regard: https://developer.android.com/guide/topics/connectivity/blue...
21.
by x1sec 3y ago
> They will kick you out the store if they detect you're lying about the permission You have to wonder how long this app never got taken down. Permissions declared in the manifest do not always equate to them being used. Google coul
22.
by x1sec 3y ago
Thanks for this: I've updated the post with a note on 'if your app uses Bluetooth scan results to derive physical location'. I highly doubt this is why they use ACCESS_FINE_LOCATION for this purpose. Rather it's an oppor
23.
by x1sec 3y ago
Here I am specifically referring to the behavior of the app in question. As pointed out elsewhere, Android 12+ offers flexibility here. That said, it could be argued that there is too much trust for developers doing the right thing when Blu
24.
by x1sec 3y ago
Update here is that the developers of this app have now updated the Apple and Google store pages disclosing that they do collect location data. So now it's up to the retailers/resellers to comply with local privacy laws and regula
25.
by x1sec 3y ago
If you haven't used it before, Timesketch [1] is excellent indexing and searching timeline data for forensics analysis. MVT takes a (MACB) timeline of your phone backup file changes and other events - including your text message histor
26.
by x1sec 3y ago
I do note that BLUETOOTH_SCAN could be used for versions 12+. The link you provided is good, I'll also reference that as it also has details on strong assertion (android:usesPermissionFlags - neverForLocation). > I suspect what&#x2
27.
by x1sec 3y ago
Thank you for the keen eye, fixed.
28.
by x1sec 3y ago
I've written a basic Python script [1] to read the battery voltage from this device. More details here [2]. Could easily integrate with Home Assistant. Might give it a go actually. It reads the real time voltages, not voltages stored i
29.
by x1sec 3y ago
Great, will take a look and will post on Twitter if there is anything notable found. Twitter handle in my HN profile.
30.
by x1sec 3y ago
This is exactly what what they did here. That said, the attention of the blog post seems to have triggered them to disclose now on the Apple [1] and Google Play [2] store that they are indeed collecting your location data. They got away wit

More ›