Recent content on Donncha Ó Cearbhaill
I carry out security research in my free-time, and sometime I find bugs. Here is a list of some the more significant security issues that I have found and reported: 
 
 CVE-2015-2929 – Remote denial of service in Tor client < 0.2.6.7 (ref) 
 RCE in the Hola Unblocker addon (affecting all platforms, Windows, Mac and Android; Hola claims 80 million users) (ref) 
 CVE-2016-9949 – RCE…
In this post I’ll describe how I found a remote code execution bug in Ubuntu Desktop which affects all default installations >= 12.10 (Quantal). The bug allows for reliable code injection when a user simply opens a malicious file. The following video demonstrates the exploit opening the Gnome calculator. The executed payload also replaces the exploit file with a decoy zip file to cover its tracks.…
I have been using an OpenPGP smartcard for encryption, signing and authentication for over a year now and I’ve found it to be really useful as a root of trust. I have all my systems locked down to only allow public key authentication as a 2 factor security mechanism. While the Free Software Foundation Europe have a good guide about setting up a OpenPGP smartcard using subkeys and offline backups…
I have finally gotten around to posting the video of the panel I took part in at the Dublin Web Summit last October. I’d like to take the time to thank Paddy Cosgrove for the invitation, and Michael Clear for also taking part in the panel with me. It was a really enjoyable experience. 

			 
				 
				 
			
When I first started analyzing the Coinbase website I had a quick look over the site layout and the functionality/attack surface available for potential exploitation. I quickly determined it was running Ruby on Rails based on the encoding of the “_coinbase_session” cookie. This was supported by the fact Coinbase’s founder Brian Armstrong had a lot of Ruby snippets on his Github Gist and some more…
Update 2013-08-15: I have been really enthused by reactions I received to this blog post. It has been referenced from Forbes , Gawker and the Daily Mail and a number of people have been in contact about tracking the DHT for themselves. I would recommend the IEEE S&P paper, “Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization” which presents the same issues allowing the DHT to…
Welcome to my new website! This is the mandatory, ambitious first post which proceeds the later sporadic activity as the enthusiasm gradually dies away. I don’t have a big picture for this site as of yet. 
 I registered the domain donncha.is primarily to host my email as I transition away from using third-party email providers. Hosted email is fine, but if your receiving a “free” service, your…
Short Bio 
 Donncha (“Done-a-ka”) Ó Cearbhaill (IE/DE) is a hacker and cybersecurity expert. His security research was foundational to the award-winning Pegasus Project, which exposed one of the largest surveillance scandals in recent history. He leads the Security Lab at Amnesty International which continues to play a critical role in exposing the global spyware crisis with the Predator Files…
I’m based in Berlin and enjoy connecting with activists, researchers, and journalists on topics related to surveillance, computer security and privacy. 
 If you would like to contact me about my work at Amnesty International please email donncha.ocearbhaill@amnesty.org . 
 
 Email: donncha@donncha.is (PGP: 0x3B0D706A7FBFED86 ) 
 Twitter: @DonnchaC 
 Keybase: @DonnchaC 
…
Below are a selection of research reports and publications which I have authored or contributed to. 
 Research 
 2026 
 Pegasus Project: Inside Morocco’s spying machine - Technical partner to a new Forbidden Stories investigation into Morocco’s surveillance apparatus, building on the 2021 Pegasus Project; accompanied by an Amnesty technical analysis of the evolution of the Pegasus…
I share my research and investigations to help build understanding of the significant digital threats faced by civil society around the world. Below is a selection of recent talks and media I have contributed too. 
 Speaking 
 2024 
 


 
 O Cearbhaill: Serbian authorities used extremely invasive spyware 
 
 News interview with Al Jazeera Balkans on the findings…
I have also developed and contributed to a number of open-source projects. 
 MVT: Mobile Verification Toolkit : Mobile Verification Toolkit (MVT) is a ground-breaking forensic tool which helps to identify potential spyware and targeted attacks against Android and iOS devices. 
 It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the…