DIY Wi-Fi YouTube subscriber display: ESP8266 + LED Matrix
How to make a live YouTube sub counter with MicroPython. Beginner-friendly, no soldering needed.
blog.roysolberg.com
Latest posts
Case #23: Another postal service leak
The web page for shipment information contained personal data - and it was possible to iterate through the data.
CTF write-up for NPST 2020 🎅
Here's a write-up of the challenges of the Norwegian Police Security Service's capture the flag advent calendar for 2020.
Capture the flag with the Norwegian Police Security Service - Easter edition
Here's a write-up showing how to solve the challenges of the Norwegian Police Security Service's Easter CTF.
Capture the flag with the Norwegian Police Security Service
Here's a write-up showing how to solve the challenges of the Norwegian Police Security Service's CTF advent calendar.
Another job opportunity at the Police Security Service
Here's a walk-through of the Norwegian Police Security Service's latest job ad riddle. Were you able to crack the code?
Smart meter part 3: Hey Google, how much electricity am I using?
I can ask Google about my power consumption and what my next electricity bill will be.
Smart meter part 2: Data storage and price info
To present the electricity usage in a nice way we first need store the data somewhere and get hold of the price information.
Smart meter part 1: Getting the meter data
Tag along while I show you how I got access to my realtime electricity usage connecting to my smart meter's HAN port.
Case #22: Another booking leak
Personal info like Social Security numbers and personal documents were available. While I mostly hail the City of Bergen's handling of this issue, here are also the details they didn't tell you.
Case #21: Leaving backup in the public
A web shop left their backup of all shopping data and their site in a publicly available directory - indexed by Google.
Game *inside* browser developer tools
This one is for you developers out there: Play a game inside local storage!
Case #20: It's getting hot in here
It was possible to control Internet connected Mill heaters worldwide.
How to get a job interview with the Norwegian Police Security Service
The Norwegian Police Security Service had a job posting with a "digital riddle" to find the right candidates for a job. Here's (hopefully) the solution.
Advent calendars debugged
A Christmas story on how to cheat in advent calendars and of course some personal information leaks.
885,086 customer records exposed in search engine
Guest blog post by Hallvard Nygård (@hallny)
Behind the news: Authentication gone wrong
Personal - and in some cases sensitive - information about 63,000 students could be accessed. Here are the details that the newspaper article did not give.
Case #19: Leak affecting half a million Norwegians
Looking for an easy way to find out when the garbage was being picked up ended up in discovering a data leak affecting half a million people.
Behind the news: Unresponsible disclosure
A newspaper published details about a newly discovered serious security vulnerability. Here are the details that the newspaper article did not give.
Case #18: I know what you did last summer - and also what you will be doing this one
Thomas Cook Airlines was leaking passenger information about future og past flights. Information about tens of thousands - or maybe hundreds of thousands - of travels could be systematically downloaded.
Case #17: Tracking dog owners
The tool for the owner to track its pet became a tool for tracking all the pet owners themselves. The hunters became the hunted.
Case #16: Free parking and personal data
It was possible to do systematic account takeover for one of Norway's biggest parking companies.
Linkifying robots.txt
Here's a simple bookmarklet to linkify robots.txt .
Millions of customer records exposed through unused API fields
Guest blog post by Hallvard Nygård
Case #15: Leaked hotel reservations
Information about as many as maybe 1.5 million past, current and future hotel stays were openly accessible on the Internet.
Case #14: Power company leaking personal info and usage data
Information about thousands - theoretically maybe hundreds of thousands - of customers could be stolen.
Gator Watch revisited
Gator Watch had a complete lack of security which made it possible to track kids all over the world and listen to private voice messages. This is supposedly fixed, at least in Norway. But is it really?
Guide: How to crack Android apps
Learn how to reverse engineer Android apps, alter them, and put them back together. No root needed.
Hack my hackable website [no longer available]
I created a "hackable" web app for a presentation I gave about web app security. Now you can try it out yourself.
From the archive #1: Kindergarten leaking data
This one my of my regrets. This is one of those cases I should have told the world about. But now it's such a long time ago that naming anyone won't do any good.
Summarizing 13 security vulnerabilities
Let me spell out why you should care that I recently so easily found 13 security vulnerabilities.
Case #13: Leaking shopping data
No one can see what you are shopping online, right?
Add security.txt to your site
Sometimes it's really difficult and time consuming to find a way to report a security vulnerability. But there is a very simple solution for that.
Case #12: Insurance company leaking personal data
One of the biggest insurance companies in Norway leaked personal data and used 4.5 months to fix the issue.
Case #11: Tracking tens of thousands of kids worldwide
Tens of thousands - possibly several hundred thousands - of kids can be tracked via their Gator and Caref watches.
Case #10: Your memories aren't safe
A digital memory book and social platform for people with special needs was found to be open for anyone to read, change and delete its users' content.
Case #9: IKEA is telling your name to everyone on the Internet
Ever been logged in at ikea.com? Then there's a chance you don't surf very anonymously.
DOM II: JavaScript Hell
Have some fun destroying websites using my bookmarklet.
Case #8: SQL injection vulnerable for 10 years
A company offering an online project and customer relationship management system had a very easy-to-spot SQL injection vulnerability for 10 years or more.
Case #7: Fitness center chain was leaking personal info
Is your gym telling on you? It sure was telling on me and my fellow members. Everything from contact info to pictures to bank account numbers to the time people enter the gym was leaking for a long, long time.
Case #6: Who's looking at your pictures?
A campaign where you can upload your pictures is making a small version of them publicly available at a "impossible to guess" URL. It was possible to systematically retrieve all the images.
1995: When you could get a demo of the Internet on a floppy disk
This one is for you who actually know what that save icon in Word is.
Case #5: Tell me your bank account no. and I'll tell you how rich you are
I'm sure you expect your bank accounts to be safe from prying eyes. For a while other customers knowing my bank account number could check my account balance.
Building an almost real SPA blog
I thought I could have this blog as a real single-page application with no server code. That sort of worked. If it only hadn't been for the previews.
Case #4: Blast from the past
In 2017 you don't see that many sites running PHP, but recently I stumbled on this site of classical PHP vulnerabilities.
My dumb smart home
My smart home isn't all smart. When it comes to security it's pretty dumb.
Case #3: Who's got your IP address today?
One of the "digital mailbox" services used by more than 400 central and local Norwegian government agencies to send mail, was leaking IP addresses and full names.
Case #2: Good authentication, but lacking authorization
That a service is heavily gated doesn't mean that your information is safe. I'm taking it down a notch this week; this is not a severe case, but an OK reminder for us developers on how we protect our resources and to never trust the client.
Case #1: Get your Social Security numbers here!
Using only the plate number of a Norwegian car you can find the name, address, Social Security number, etc. of the owners.
Security vulnerability disclosures
I'm preparing a series of posts where I'm disclosing several security vulnerabilities that I discovered the spring and summer of 2017.