xubuntu.org crypto clipper analysis
Analysing the malware that was served to users after the xubuntu.org compromise.
lets.re
let's reverse!
Latest posts
Minor issues in Banking4
The multi-platform banking app Banking4 by Subsembly had minor PBKDF, password-strength, and PRNG seeding issues; Subsembly fixed them swiftly.
VS Code Remote SSH: server-to-client remote code execution by design
A brief look at why VS Code Remote Development and Dev Containers do not provide a security boundary and how to achieve better isolation instead
Exporting iCloud passwords on Windows
Unlike the iCloud passwords app on macOS, the Windows app does not have export functionality. So I extended the Chrome extension with the help of Cursor and Claude.
Obvious vulnerabilities in self-proclaimed "most secure messenger"
Ginlo claims to be the "most secure messenger" for healthcare and personal use, but lacks basic protections in its apps, with many issues remaining unpatched after a 90-day disclosure window.
Pitfalls of rolling your own E2EE protocol
An analysis of an e2ee chat app that used a non-cryptographically secure RNG and offered no way to verify keys.