appsec & stuff
A few weeks ago, I lost access to my email account. That experience opened my eyes to just how much I depended on it and how expensive a “free” service can become when things go wrong. This is a post-mortem of what happened and what I learned. This post is NOT sponsored This post is not sponsored or paid by Proton. I am just writing about what happen to me and the steps I took. I decided to switch…
TL;DR I found a RCE in the AION client starting from 3.0 (not confirmed the latest version vulnerable) using the built-in housing system. Private servers are still vulnerable. Important Note In the initial version of this post I wrote that the housing system was removed in 5.0 but some players made me notice that this is wrong indeed the housing system is still there in the retail version of AION…
I recently received my ZimaCube : a NAS from IceWhale , the same company behind the ZimaBlade , ZimaBoard and most notably CasaOS , a UI to manage docker applications. The ZimaCube ships with the default OS called ZimaOS . Note This part is a bit tricky but stay with me because I need to clarify this point, otherwise the rest of the article could be hard to understand: IceWhale decided to put the…
I was looking for an eink tablet to r ead books and take notes while I’m away from home. After adventuring in the eInk rabbit hole I decided to go for the Onyx Boox Go 10.3 : a Black and White eInk Android Tablet with 300ppi that’s also good for taking notes, weighting only 365g! I was a bit concerned about this report from Mozilla so I decided to take a look at the device. Danger Boox…
As you probably already heard, the xz package got compromised. The package was used as entrypoint to inject malicious code in sshd, altering the authentication flow. This forged vulnerability is now known as CVE-2024-3094 . Looks like the injected code takes the payload from a specific key and execute it . Info The situation is still ongoing, more details will emerge in the near future and I will…
I have seen many companies invest significant time and resources into security measures that have little to no actual effect on security. This is commonly referred to as “security theater”. 1 What is the Security Theatre Security theater refers to the practice of implementing security measures for the sake of appearances, without any significant impact on actual security. These…
Long time no see, uh? Lot of stuff happen since the last post in 2018 on the old blog . Unfortunately I wasn’t able to write much, both for the lack of time and the impossibility to share what I learned. This post contains an introduction to this new website and how it will work from now on. First of all, I’m still in Security but moved to Product Security (more on this on a later post…
1 Introduction During my journey contributing to open source I was working with my friend Matteo De Carlo on an AUR Package of a really interesting project called Mycroft AI . It’s an AI-powered vocal assistant started with a crowdfunding campaign in 2015 and a more recent one that allowed Mycroft to produce their Mark-I and Mark-II devices. It’s also running on Linux Desktop/Server,…