Recent content in Blog on Thomas Rinsma
Would you believe me if I told you this HTML page could show an alert('hi from WASM') , when loaded? < script > WebAssembly . instantiateStreaming ( fetch ( "plugin.wasm" ), {}); </ script > More generally, if plugin.wasm is attacker-controlled, this could execute arbitrary JavaScript, despite the empty object as imports! Doesn’t this feel counter-intuitive, given the isolation properties of…
During a research project for Codean Labs, Edoardo and I found several vulnerabilities in OpenPGP.js. The worst of which was a subtle logical flaw which allowed an attacker to craft a “valid” PGP signature without access to the respective private key. Read the write-up on Codean Labs’ blog: https://codeanlabs.com/2025/06/cve-2025-47934-spoofing-openpgp-js-signatures/ Media…
During a research tangent at work, I found several logical vulnerabilities in LibreOffice. The write-up includes a proof-of-concept showing how one of the bugs can be used to steal a secret from an incoming email (assuming a desktop Linux usecase with LibreOffice and Thunderbird), which was particularly fun to put together. Read the write-up on Codean Labs’ blog:…
Click to play Tetris Recently, just for fun, I managed to create a playable version of Tetris inside a PDF. I posted about this a couple days ago on Hacker News and Twitter . You can play it by opening this file in a compatible desktop browser (Firefox and anything Chromium-based). The “source code” can be found here . As there was quite some feedback, I’ll share a bit more…
Through pentest work at Codean Labs, I found that Ghostscript is unexpectedly part of many attack surfaces, even server-side: applications that process user-submitted documents or images may invoke ImageMagick or LibreOffice for conversion, which in turn may call into Ghostscript for (embedded) EPS images. Hence, I went digging and found a bunch of memory corruption bugs, several logic bugs and a…
I found a way to execute Javascript inside PDF.js from within an untrusted PDF. Real Javascript, not the sandboxed PDF version :) This had heavy consequences for many platforms rendering user-uploaded PDFs, lots of which use PDF.js, directly or indirectly (e.g. through react-pdf). Firefox itself was also vulnerable . Read the write-up on Codean Labs’ blog:…
Recently I’ve been learning more about electronics and PCB design, something I had no experience with up until recently. I wanted to challenge myself so I picked a relatively hard goal. This keyboard is the result of that. I call it kb1 . Specs In short, it is mechanically built using two PCBs with standoffs in between; has a proper “tenkeyless” layout, compatible with Cherry…
You might have seen the classic Youtube video by marcan showing a Gameboy Color being overclocked to arbitrary frequencies, using an FPGA development board. Recently, I got hold of a GBC again and wanted to try this myself. I don’t have such an FGPA or a even a VCO, but I realized that the RP2040 on the Raspberry Pi Pico supports PWM at varying frequencies. Turns out, it indeed has a pretty…
Last year, during a tangent for a project, Kevin and I found a series of vulnerabilities in (combinations of) several Node.js packages that led to critical issues for our client, and most likely other users as well. It was a lot of fun learning about all the ways that logic in Javascript code like this can break, mostly by abusing its dynamic typing and oddities like __proto__ . All in all, this…
For the past half a year or so I have been playing around with a specific type of payment terminal, the VX820 from Verifone. I randomly bought a couple of second-hand devices, and found out that they are wonderful pieces of hardware with lots of potential for alternative uses. I figured that a fun goal for myself would be to port Doom to it, which would nicely showcase the device’s…
Over many years I kept coming back to this side-project: an emulator for the original Nintendo GameBoy (aka DMG). I believe I started by just parsing ROM files in C, then ended up following Imran Nazar’s wonderful tutorial , and came back to it a couple more times in later years with ideas for GUI elements ( dear imgui is amazing) and debugging features. It’s quite buggy, but I’m…
In my previous post , I detailed a fun method of obtaining root access on the Zyxel VMG8825-T50 router, which required physical access to the device and authenticated access to the web interface. In this post, I will detail the exploitation of a vulnerability that could potentially result in unauthenticated RCE as root, given LAN access only. This vulnerability was also found on the VMG8825-T50…
The device. Update (December 2020): Several of the vulnerabilities mentioned in the post below have since been patched by Zyxel. In a later post I detail a different vulnerability, which has also been fixed. My ISP recently provided me with a new router, the Zyxel VMG8825-T50. It seems to be a relatively new gigabit router with all kinds of capabilities. Sadly, some of them are locked down behind…
For the last couple of months I’ve been working on and off on my C++/OpenGL “game engine” , mostly for the purpose of learning OpenGL. The feature I was the most excited about trying to implement in this engine was portal rendering. Actually understanding and implementing that correctly has taken me a little while but I feel like I know enough now to explain some of the concepts…
You might know the Facebook game called “Tetris Friends”. It’s basically just a flash version of tetris but with some added features like the ability to “hold” a block and to see multiple pieces in advance. About a year ago I started to wonder if I could make an AI for it, just like I did for my own implementation of Tetris. It would have to look at the rendered…
A list of publications external to this site (hence, excluding articles original to this blog). Most entries link to a meta-post containing the external link(s) with some context. Conference talks Escaping a misleading “sandbox”: breaking the WebAssembly-JavaScript barrier (WHY2025) Payment terminals as general purpose (game-)computers (MCH2022) Articles and papers (in addition to…