Long story short, through a bizarre chain of events starting from trying to hire a contractor online I have uncovered and have access to thousands of user credentials (email + CLEARTEXT password), associated addresses, company information, as well as associated … Read more
Some time ago I worked on software engineering at a bank, not on InfoSec but I knew some stuff as that was one of my areas of interest. A company that wasn’t any kind of direct competitor announced they’d start … Read more
Following research done by James Kettle on web cache poisoning, I decided to deepen my knowledge in this field and explore these vulnerabilities in the open source domain. I focused my research on the most popular web frameworks, such as … Read more
After 15 years as a freelance developer I’ve started a rural wireless ISP. It hasn’t entirely displaced my freelance work, but allows me to help people in a way that being a developer didn’t (tangibly, at least). Now I install … Read more
Restrict LDAP access via JNDI by rgoers · Pull Request #608 · apache/logging-log4j2 · GitHub {{ message }} Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were … Read more
A few hours ago, a 0-day exploit in the popular Java logging library, log4j, was tweeted along with a POC posted on GitHub that results in Remote Code Execution (RCE) if log4j logs an attacker-controlled string value. Given how ubiquitous … Read more
Instructors of “Introduction to programming” courses know that students are willing to blame the failures of their programs on anything. Sorting routine discards half of the data? “That might be a Windows virus!” Binary search always fails? “The Java compiler … Read more
Tardigrade walking (Credit: Lisset Duran) This is a cool video that someone recently took of a tardigrade walking. These little guys, sometimes called “Water Bears” are microscopic creatures known for their heartiness and ability to survive in extreme climates. The … Read more
I n August, 32 faculty and 117 research scientists, postdocs, and students at Stanford University, long one of the biggest players in AI, declared that there has been a “sweeping paradigm shift in AI”. They coined a new term, “Foundation … Read more
This article is about how I found a vulnerability on Apple forgot password endpoint that allowed me to takeover an iCloud account. The vulnerability is completely patched by Apple security team and it no longer works. Apple Security Team rewarded … Read more