Writing by Sasha Romijn: internet infrastructure, security, and adjacent curiosities.
A crafted MeshCore node name could compromise any Home Assistant instance running meshcore-card as soon as someone viewed a dashboard with that card. MeshCore relays through repeaters, so the attacker did not need to be in radio range of the target itself, only of any node that could forward to it.
RIPE NCC’s single sign-on did not rotate session tokens on login, leaving 12000 Atlas probe hosts in a position to compromise other RIPE NCC users’ logins. A single link click planted a session token in a target’s browser. When that target next logged in to a RIPE NCC service, possibly much later, the attacker could access their account. An XSS variant did the same regardless of…
The RIPE NCC made its all-powerful single sign-on tokens available to over 1000 third parties. From a single link click, any logged-in RIPE NCC user would leak their session token. That token grants full access to the RPKI Dashboard, the RIPE Database, and the member portal. RPKI and the Database govern internet routing for Europe, the Middle East, and Central Asia. This access could be made…
This post covers the disclosure process for the vulnerabilities described in my RPKI exploit chain , through RIPE NCC’s Responsible Disclosure Policy . Update 2026-06-10 : RIPE NCC published their own retrospective on this disclosure: What We Learned from a Multi-Service Vulnerability Disclosure , by their CISO Eleonora Petridou. What went well RIPE NCC engaged in good faith throughout. All…
One click on a malicious, but not suspicious, link. That is all it could take for a network operator to get disconnected from the internet, through a chain of vulnerabilities I discovered. From that single click, I could fully control their routing authorisations in a RIPE NCC portal, telling the rest of the internet not to accept their routes. I could also hijack all their RIPE Database objects,…
Lately, I’ve been experimenting with unusual XSS vectors. XSS (cross-site scripting) allows an attacker to execute arbitrary javascript in another user’s browser session. Sometimes the result is merely entertaining, sometimes the result is: Dear Sasha, excellent (and terrible) find! A crafted wifi SSID could lead to an XSS in the OpenWrt admin interface, if an admin opened the nearby…
Originally published October 2014. Lightly edited for style, but not for content or hindsight. I resurrected it as it relates to my more recent security explorations. Apple designs might have changed significantly. Any iOS developer could create an app that read the secrets stored by Dropbox, PayPal, or Google Authenticator. The malicious app would pass App Store validation. While these secrets…