Thread: (1/8)
@Belastingdienst
gave me the go-ahead to share the story of how the Lamest Hacker You Know® received this epic
#ResponsibleDisclosure
award from them.
Looking back on it I don't think I can tell it any better than this chat log interaction, so here it is raw:
Hacking Fujitsu is so easy you don't even need malware because they just give you the keys
Also they don't give AF about good faith researchers, dont have bugbounty program, vdp, security.txt, nothing. Just a psirt address that doesn't even have the courtesy to respond.
Thread (8/8)
And that, my friends, is why you should not hardcode passwords. Over the last couple of years I've seen the inside of more big name companies than I ever imagined by just finding passwords. This is a massive problem and I would love to give
@github
some tips.
@Foone
I once encountered a virus infection that deleted all the fonts on the system (among other things) but Marlett could not be deleted because it gets an "in use" flag really early when loading the gui. This meant that Marlett was also the *only* fallback Font for text rendering!
Thread: (1/8)
@Belastingdienst
gave me the go-ahead to share the story of how the Lamest Hacker You Know® received this epic
#ResponsibleDisclosure
award from them.
Looking back on it I don't think I can tell it any better than this chat log interaction, so here it is raw:
@r0wdy_
Hello from The Netherlands, Where there are provisions in place in our law system to allow exactly this for researchers that adhere to a strict set of ethical guidelines.
Somebody's gotta do it. So then we'll do it.
Thank us later. Or not at all, we'll still do it.
What a lovely day. We told *nobody* we were getting married, so it was me, wife, kiddo and our 2 witnesses.
Had lunch with the lady I can finally call my wife and kiddo in the afternoon, even a little nap inbetween and dinner with the witnesses in the afternoon
10/10 recommend🥰
@jobbes86
@Belastingdienst
Yes sir I confess. And yet here we are and I got this trophy. I reported this before anyone else found it and could take exploit it while staying silent. If this means I'm breaking the law I'll take that risk because someone obviously has to.
This is a diagram to try and show why orgs don't tend to shine when scoping their "pentesting" projects/activities.
The issues is that "most" orgs don't have a strategy beyond can you pentest us or can you test "this website"
HOLY freaking shit the
@bunjavascript
debugging experience is 🔥🔥🔥🔥
Start your process with `bun --inspect=4000` and it'll throw you a url in cli to which runs a modified webkit inspector that just works out of the freaking box 💯
- Overheid: vangt in een paar weken ineens 40 cent netto meer voor elke liter benzine
- Overheid: "Ja nee we kunnen écht niet zomaar iets doen aan de
#benzineprijs
want dan gaat het hele land kapotstuk"
GA GVD WAT DOEN AAN DIE BENZINEPRIJS IDIOTEN
I want to give a special shout-out to
@AstridOosenbrug
for being one of the reasons I can do what I do here in The
#Netherlands
She kickstarted the political climate where security researchers are applauded instead of prosecuted and now leads
@DIVDAcademy
. Legend. ❤️
@Gi7w0rm
I'll ask the obvious question:
Why does a secured meeting on a custom client with additional security features allow downgrading the integrity of all of the connected clients by foregoing the 'secured' part?
@SwiftOnSecurity
A parking garage ticket machine with like 6 different forms of payment accepted, three card slots, a ticket printer, flashing buttons, and arrows and text everywhere.
Stuff of nightmares.
@ashu_barot
@RomSteady
@securitytxt
Done that multiple times. I like to pick the most senior security dude from their own address book and just whatsapp or call them. Pro tip: lawyers get spooked if you do that to them
Achievement unlocked 😎
As of today I'm allowed to call myself researcher at
@DIVDnl
, the Dutch Institute for Vulnerability Disclosure.
So proud to be a part of this, thanks for having me!
Niet geheel hoe ik gedacht had wakker te worden vanochtend, sirenes. P2000 check, om de hoek. F. Aankleden. Wordt er ineens een geredde kat die naar rook ruikt m'n slaapkamer ingesmeten want m'n lief was al bezig en heeft 2 katten in veiligheid gebracht.
@gdisselkoen
Toen ze zeiden dat het internet en toegang tot alle informatie op de hele wereld mensen slimmer zou maken hadden ze het fout.
Zo. Ontzettend. Fout...
😭
Dear Twitter fam, something serious: my little nephew is dying from leukemia. This 13 yr old kid is making his bucket list because even the most brilliant doctors in The Netherlands are basically calling their defeat. I know it's a long shot but do I know anyone that works magic?
Mad respect to the
#BadgeTeam
here. DIVD members identified and reported a Buffer overflow vulnerability in the
#Badge
of
#HackerHotel
( CVE-2024-21875 ) and this morning it was fixed already on the stable channel! Update your badge!
@digitaaldenken
@Belastingdienst
Oh it is definitely true.
And to scare you even more: I'm almost getting used to it. I could do this all day and stay busy, but the day job actually pays.
I've been pulling this same trick for almost 3 years now and I'm nearing 500 responsible disclosures via just email
Hot take:
Als je admin password Welkom01 was moet je eigenlijk gewoon echt gewoon je bakkes houden en de L nemen en blij zijn dat je niet geransomed bent door iemand met een bot die dit automatisch doet.
I disclosed to Disney years ago, was on their intranet, as an employee and pulled an excel sheet with 130k servers/specs/ips.
Their response: "come have a beer if you're in florida some time"
I feel nothing.
Disney has been hacked.
Around 1TiB of Data is stolen including Unreleased projects, raw images and code, some logins, links to internal api/web pages, and more.
We need to STOP running DOOM on new things
and START putting new things into DOOM.
For example, today I added micro-transactions to the original game. Any time you pick up an item, the game freezes until you make a payment.
@johnjhacking
I still wanna make an nginx module that pretends it's vulnerable to a blind SQL injection and then outputs a custom virtual schema when's they start downloading, which obviously contains the full lyrics to never gonna give you up as tables and fields
Aan alle
#nieuws
zenders die weer openen met "russische hackers" die "sites platgelegd hebben"
DDOSSEN IS GEEN HACKEN
DDOSSERS ZIJN GEEN HACKERS
MIJN DOCHTER VAN 8 KAN DIT.
DDOSSen is nog minder dan jezelf vastplakken op een start/landingsbaan.
Bank: Secured.
But only because I was able to convince their Twitter support chat of the urgency of providing me an e-mail address to send my responsible disclose to. Not everyone will do that.
Support engineer made the right call, vuln was nixed within 24 hours
#HackThePlanet
@thembeddevguy
@citcsmobile
@lozaning
@MarcusBrodie6
That's how I tried to win a constest to grab a free FPV drone if you could pull it out of the air by hacking... Until i found out the Dutch Telecom Authority was on-site with their tricked out scan van 🤣 i never once dared to hit the button