xnyhps

32 ms·

1.
by xnyhps 3y ago
Will modern clients warn loudly if a server suddenly stops offering channel binding? Otherwise it is trivial to downgrade.
2.
by xnyhps 3y ago
I don't mind XML personally, but I understand why people dislike it. For XMPP specifically you have to use a streaming XML parser, which is quite a bit more complicated than the more common case of parsing XML into a tree and then tr
3.
Bad things come in large packages: .pkg signature verification bypass on macOS(sector7.computest.nl)
2 points by xnyhps 4y ago|0 comments
4.
Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass(sector7.computest.nl)
2 points by xnyhps 4y ago|0 comments
5.
by xnyhps 4y ago
I think Apple doesn’t want third-party developers to compose their own sandboxing rules, because it’s pretty hard to do that in a way that can’t be escaped and that doesn’t break Apple’s frameworks. They provide the Mac Application Sandbox
6.
by xnyhps 5y ago
If I remember correctly, the last thing I was working on was actually trying to see if GraphHopper performs better! I think I was either still trying to compile it or load a local map, I’m not sure. It has been a while since I’ve worked on
7.
by xnyhps 5y ago
I’ve been playing around with a similar project and it surprised me how hard map matching actually is. I’ve also been using OSRM, but no matter how I tweak the settings, it never gets it 100% right. Some examples: the GPS error is often mor
8.
by xnyhps 5y ago
The colored and animated logging parts are from pwntools ( https://docs.pwntools.com/en/stable/ ).
9.
by xnyhps 5y ago
The HTTP and XMPP traffic is encrypted using TLS. The proxies were used to decrypt, log and re-encrypt this traffic in real-time.
10.
Zoom RCE from Pwn2Own 2021(sector7.computest.nl)
262 points by xnyhps 5y ago|122 comments
11.
Zoom RCE from Pwn2Own 2021(sector7.computest.nl)
8 points by xnyhps 5y ago|0 comments
12.
by xnyhps 6y ago
To add to this: there are two different types of Data Vaults. For locations such as ~/Pictures, ~/Documents, Calendars, Contacts, etc. a permission prompt is triggered if an app tries to access it. Other locations, such as where M
13.
by xnyhps 6y ago
The macOS version installs itself before you give it permission to install: https://twitter.com/xnyhps/status/1149630190877696001?s=21 . It is basically malware.
14.
by xnyhps 7y ago
In The Netherlands there are Veiligheidsregio's ("Safety regions", areas where the emergency services work together) which make changes to OSM to improve the routing for emergency services. For example, Veiligheidsregio Twe
15.
by xnyhps 7y ago
Last time I looked at it, none of the routers for OSM were good at routing over areas in OSM. For example, when planning a route on foot over a large square, the route often follows the outside edge. This becomes even harder when the area c
16.
by xnyhps 8y ago
Similarly, MySQL Connector/J also used to attempt to deserialize binary data that looked like a serialized Java object (CVE-2017-3523). Doing this with untrusted data can often be used to obtain arbitrary code execution. Connecting t
17.
by xnyhps 8y ago
> Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices. It's not receiving an ICMP packet that causes the crash, it's when sending an ICMP error response packet. ICMP error pac
18.
by xnyhps 9y ago
That depends on the country. You lose Dutch citizenship if you have dual citizenship and don't live in The Netherlands or renew your passport in 10 years.
19.
by xnyhps 9y ago
I'm still wondering how to deal with password changes in that scheme. If you change the salt, you reveal the existence of that account and the fact that the password changed. But keeping the salt the same seems unsafe as well...
20.
by xnyhps 9y ago
> Legacy protocols such as FTP and IMAP don't have that luxury, though. There's no way to run a password stretching function on the client. IMAP uses SASL, which can do client-side stretching by using SCRAM-SHA-1. I don't
21.
by xnyhps 9y ago
SHA-2017 had a really cool badge: https://wiki.sha2017.org/w/Projects:Badge . 2.9" e-paper display, ESP32, 1000mAh LiPo battery and firmware with an online "app store" supporting apps written in micropyth
22.
by xnyhps 9y ago
The affected certificate as confirmed by Comodo: https://crt.sh/?q=278968925 . Note that it wasn't logged until about 2 hours ago. CT logging will become mandatory at some point, but not yet.
23.
by xnyhps 9y ago
I highly doubt anyone will be able to answer this, but I'm curious if this law would also apply to iOS apps. Of course, copyright on an app can't have expired, but it could be developed or sponsored by the Portuguese government. I
24.
by xnyhps 9y ago
That one is even more malicious, it uploads contents of your ~/.bash_history and system profile. But at least it notifies you afterwards...
25.
by xnyhps 9y ago
I think github.io is a good example of where this can be very useful. Users have a lot of control over the content of their pages, but it is undesirable to allow them to get a cert for username.github.io. Previously the only defense would b
26.
by xnyhps 9y ago
And there is a pretty cool open data set for current and historic traffic information (speeds, travel times, etc): http://www.ndw.nu/pagina/nl/103/datalevering/120/open_data/ (page only in Dutc
27.
by xnyhps 10y ago
Suppose I include 'ü': LATIN SMALL LETTER U WITH DIAERESIS in my password. I switch to a different browser/OS/language and now when I enter "ü" I get 'u': LATIN SMALL LETTER U + ' ̈': COMBIN
28.
by xnyhps 10y ago
That's the point, it's about bypassing Content-Security-Policy, so you musy already have something like xss. It's more like "well, assume you have code execution inside a sandbox, then you can break out using THIS".
29.
by xnyhps 10y ago
Re-encoding is not enough to prevent attackers from constructing polyglots, see https://www.idontplaydarts.com/2012/06/encoding-web-shells-i... > Placing shells in IDAT chunks has some big advantages and should
30.
by xnyhps 10y ago
FYI, the first part isn't new. Safari already uses mDNS to find webservers on your LAN. For me, this is also supported by my printer, so I can just go to the Bonjour bookmarks to find the admin interface without having to remember its

More ›