Cybersecurity research, writeups, and threat analysis by buchodi
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build ( com.facebook.stella ), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned
I broke the cipher AppLovin wraps around its ad-mediation traffic and decrypted several thousand real requests captured. The conclusion is straightforward: The encrypted bid request carries enough device data to deterministically re-identify the same iPhone across apps from different publishers, even when user denies ATT. That payload reaches
OpenAI's ad platform has two halves. On the ChatGPT side, the backend injects structured single_advertiser_ad_unit objects into the conversation SSE stream while the model is responding. On the merchant side, a tracking SDK called OAIQ runs in the visitor's browser and reports product
When piracy streaming sites inject third-party JavaScript into your browser, the domains hosting that JavaScript are designed to be invisible. They rotate every three hours, use algorithmically generated names on cheap TLDs, and vanish before anyone notices them. I cracked the algorithm that generates them. Using application-layer traffic
How Apple's Spotlight API exposes undocumented interaction data for every search result it serves to over a billion devices When an iPhone user types a query into Spotlight, Apple's servers return ranked results spanning web pages, apps, maps, news, knowledge graph entities, and stock data. Alongside
Edit April 2, 2026: I've been getting inbound interest from researchers wanting to run their own queries. The MCP integration I use for my own research lets you analyze live mobile telemetry continuously collected from real devices in the wild, directly from Claude. To access it reach out
The BIGO Ads SDK ships with an encrypted configuration file that maps out a global network of ad-serving domains, backup hosts, and failover infrastructure. The file is AES-encrypted with a hardcoded key, served from Alibaba Cloud, and designed to make the ad network resilient to domain blocking. The
This is Part 2 of my Pangle SDK research. Part 1 covered how I broke the encryption . This post covers what I found when I started comparing the decrypted data across apps. In Part 1, I decrypted 694 Pangle SDK payloads and documented what ByteDance collects: battery level, storage capacity,
When you open Duolingo to practice Spanish, BeReal to share a photo, or Character.AI to chat with a bot, you probably don't expect your battery level, storage capacity, and internal IP address to be sent to ByteDance, the company behind TikTok. But that's exactly what&
How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weather Company's API ( api.weather.com ) at fixed intervals. Each request includes a placeid parameter - a 64-character