Recent content on Evan Connelly
I started bug bounty in 2019, but in many ways, I didn’t fully jump in until mid-2023. I began hacking exclusively on Tesla’s program and had some good success. My first report was a hardware vulnerability in their infotainment system. Over time, I expanded into both hardware and web vulnerabilities, eventually working my way into the top 10 all-time on their program - where I still…
Imagine if anyone could punch in a phone number from the largest U.S. cell carrier and instantly retrieve a list of its recent incoming calls—complete with timestamps—without compromising the device, guessing a password, or alerting the user. Now imagine that number belongs to a journalist, a police officer, a politician, or someone fleeing an abuser. This capability wasn’t a hypothetical. I…
As a part-time bug bounty hunter, I’ve found reducing friction in my testing to be especially important. Being able to quickly look at the behavior of an application to take advantage of downtime is very important to me. With that I’ve come up with a bit of an uncommon workflow where I not only proxy traffic from iOS devices, but will also look through the request history and even modify and…
Summary We (Julien Ahrens @MrTuxracer and myself @Evan_Connelly ) identified nearly 30 popular apps, as well as a feature within iOS itself, vulnerable to an attack in which any installed iOS app from the Apple App Store could perform an account takeover of victim users. This vulnerability exploits the nuances of the OAuth protocol and iOS’s handling of Custom URL Schemes and Safari browser…
If an OAuth Authorization Server (AS) supports self-registration of client applications, and also supports silent authentication, it likely is possible to utilize the AS as an open redirector. Self-Registered OAuth Client Applications A significant factor in OAuth’s wide adaptation is the ability for developers to register their own client applications on various platforms. This is often…
In testing various Tesla web applications as part of the Tesla Bug Bounty Program , I’ve created many Tesla user accounts. At some point, while creating a new account, I became curious if I could register an account using a Tesla email address. For background, Tesla has many web apps. When it comes to SSO for all of these apps, Tesla has two main Identity Providers (IdPs), auth.tesla.com for…