yohanes @yohanes Twitter profile

Last Seen Profiles

@tekidanhei

@Matthew_Maddox

@MissouriGOP

@bn_241

@BPeot20

@SoullesKat

@_Aviad_

@RyderCupEurope

@guyvaron

@BetaSpain

@DohnalRadim

@DoveTortle

@roxiecharchian

@Kpthsn

@kasumi134368429

@alyas_ashaq

@wkshady

@Gkhan566491

@JimSharpe20

@castrophillia

@twinkum

@jaykeffindor

@Anya_hostoa

@ftgyhuiio

@sandra_slut2

@OLrin_00

@Valerie_Keller_

@sultantrianero

@jjongtsby

@clubsymbiosis

@Tom91422707

@AbhinavBandiAB

@aragecisformu

@gorban_jos84953

@Susturucu418

@ACSWattrelos

yohanes

@yohanes

20 days

Tanpa key sekalipun, ternyata data yang dienkrip ransomware Babuk yang menyerang PDN bisa direcover.

Recovery varian Babuk PDN tanpa key

Di pembahasan sebelumnya sudah dituliskan bahwa babuk tidak punya kelemahan, sehingga tanpa key, kita tidak bisa mendekrip data yang sudah dienkrip. Analisis tentang enkripsinya ini benar, tapi ada...

blog.compactbyte.com

108

1K

4K

yohanes

@yohanes

27 days

Penjelasan tentang bug keystream reuse yang ada di ransomware PDN.

Reverse Engineering Ransomware Brain Cipher penyerang PDN

Di tulisan ini saya ingin sharing mengenai reverse engineering (RE) ransomware yang menyerang PDN. Saya tidak akan ikut-ikutan mencela berbagai pihak, hanya sekedar membahas teknis ransomwarenya,...

blog.compactbyte.com

26

452

1K

yohanes

@yohanes

25 days

Huh, susah payah kemarin liatin LockBit/Brain Cipher, ternyata PDN diserang dengan DUA ransomware: LockBit di Windows (memakai Salsa20) dan Babuk di hypervisor ESXI (memakai Sosemanuk). Kunci yang dikasih cuma untuk yang ESXI-nya. IOC babuk ini gak pernah dipublish oleh BSSN.

23

301

1K

yohanes

@yohanes

19 days

Supaya tidak berulang menjawab pertanyaan, besok akan saya presentasikan tentang ransomware PDN plus tanya jawab.

20

318

1K

yohanes

@yohanes

25 days

Thanks to @0xf4c0 bersama melakukan RE terhadap dekriptor Babuk yang dirilis oleh group Brain Cipher

Reverse Engineering Dekriptor Babuk untuk PDN

Di berbagai press release tentang serangan ke PDN, hanya malware turunan LockBit yang dipakai oleh group Brain Cipher yang diterbitkan. Dua hari yang lalu group Brain Cipher dengan murah hati akan...

blog.compactbyte.com

15

191

568

yohanes

@yohanes

4 years

Checkrain for Linux/ARM works nicely in Pocket CHIP #checkra1n #checkrain

6

28

132

yohanes

@yohanes

25 days

Supaya jelas: kedua ransomware ini dari satu group (Brain Cipher). Windows diserang dengan LockBit, dan VM di ESXI diserang dengan Babuk. Kedua malware ini buildernya udah dibocorkan di Internet sejak beberapa tahun lalu.

2

9

84

yohanes

@yohanes

17 days

Maaf, ternyata yang daftar terlalu banyak

CSIRT-TALK #2

PDN & Ransomware masih menjadi viral di berbagai media saat ini. Hacker telah memberikan key decryptor, untuk membuka file-file yang ada di PDN. Apa dan baga...

www.youtube.com

3

25

78

yohanes

@yohanes

8 days

Dari sekian analisis yang saya baca, @taviso ini salah satu yang bisa dipercaya. Silakan Google namanya supaya yakin.

Tavis Ormandy

@taviso

8 days

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

288

4K

17K

2

13

72

yohanes

@yohanes

25 days

Sekarang lagi minta key Lockbitnya sama yg bikin ransomwarenya. Semoga dikasih.

3

5

59

yohanes

@yohanes

25 days

@0xf4c0 barusan saya update tulisan saya, ada hal yang penting yang saya tambahkan:

1

4

49

yohanes

@yohanes

3 years

Reverse Engineering a Flutter app by recompiling Flutter Engine

It is not easy to reverse engineer a release version of a flutter app because the tooling is not available and the flutter engine itself changes rapidly. As of now, if you are lucky, you can dump the...

tinyhack.com

1

18

32

yohanes

@yohanes

25 days

@senituru Mereka tau kena. Mereka *mungkin* nggak berhasil nemu enkriptornya (karena kemungkinan sudah dihapus), tapi harusnya ada note ransomnya di ESXI-nya.

1

0

30

yohanes

@yohanes

2 months

Extracting WhatsApp Database (or any app data) from Android 12/13* using CVE-2024-0044 * that has not received 2024-03-05 security patch

Extracting WhatsApp Database (or any app data) from Android 12/13 using CVE-2024-0044

I want to make a WhatsApp message backup from a non-rooted Android 12 Phone. A few years ago, I used Whatsapp-Chat-Exporter to convert the backup to HTML, but first, I had to extract the database...

tinyhack.com

1

4

28

yohanes

@yohanes

10 years

Exploiting the Futex Bug and uncovering Towelroot http://t.co/4JkIcno1rR

Exploiting the Futex Bug and uncovering Towelroot

The Futex bug (CVE-2014-3153) is a serious bug that affects most Linux kernel version and was made popular by geohot in his towelroot exploit. You can read the original comex report at hackerone....

tinyhack.com

0

27

22

yohanes

@yohanes

6 years

Finished #flareon5 , the last level was really hard.

2

0

21

yohanes

@yohanes

7 years

Read this if you are a merchant or intermediate payment gateway connecting to MasterCard Internet Gateway Service:

Mastercard Internet Gateway Service: Hashing Design Flaw

Last year I found a design error in the MD5 version of the hashing method used by Mastercard Internet Gateway Service. The flaw allows modification of transaction amount. They have awarded me with a...

tinyhack.com

1

13

19

yohanes

@yohanes

8 years

Short write-up for #FlareOn3

Short write-up for Flare-On 2016

Fireeye has published the full write-up from the authors of the challenges, and at the time I wrote this, there is already one complete write-up (this) and I think many more will come. So instead of...

tinyhack.com

0

6

14

yohanes

@yohanes

6 years

Reverse Engineering Pokémon GO Plus

TL;DR; You can clone a Pokemon GO Plus device that you own. I have managed to get the certification algorithm. However, there is a per device blob used (specific to a Bluetooth Mac Address) for key...

tinyhack.com

0

6

12

yohanes

@yohanes

7 years

#flareon4 thank you @FireEye

0

1

11

yohanes

@yohanes

5 years

Reverse Engineering Pokémon GO Plus Part 2: OTA Signature Bypass

It has been almost 6 months since I published my Pokemon Go Plus finding and so far no one has published their Pokemon Go Plus Key. One of the reason is the difficulty in extracting the key from OTP...

tinyhack.com

1

5

10

yohanes

@yohanes

6 years

thank you @SecuriTeam_SSD for the great challenge

0

2

10

yohanes

@yohanes

3 years

Just an explanation of how a MediaTek BootROM exploit works and how to port it to your MTK based phone

Dissecting a MediaTek BootROM exploit

A bricked Xiaomi phone led me to discover a project in Github that uses a MediaTek BootROM exploit that was undocumented. The exploit was found by Xyz, and implemented by Chaosmaster. The initial...

tinyhack.com

1

5

9

yohanes

@yohanes

7 years

My RHME2 write-up thanks for the great ctf @Riscure #rhme2

0

3

9

yohanes

@yohanes

8 years

Finished #flareon3 rank 14th

1

0

7

yohanes

@yohanes

7 years

Ready for #RHME3

1

0

6

yohanes

@yohanes

12 years

@dr_piprim @BaheeraShop Tanya jawab kehalalan & keamanan vaksin http://t.co/bJBNCfRu (Satgas Imunisasi pengurus pers dokter anak indonesia)

0

2

6

yohanes

@yohanes

7 months

A random post, just to keep this account (and my blog alive): Reverse Engineering RG35XX Stock Firmware

Reverse Engineering RG35XX Stock Firmware

A friend gave me an Anbernic RG35XX to hack. This is a retro gaming device (it just means that it is designed to emulate old consoles). It comes with two OS: Stock OS and Garlic OS. Stock OS is...

tinyhack.com

0

1

3

yohanes

@yohanes

9 years

Reporting from Thailand: the #FlareOn prize has arrived. Thank you @nickharbour and @FireEye . http://t.co/Dh5gFZ8Wpd

1

2

4

yohanes

@yohanes

9 years

Bug Isi ulang Mandiri e-Money

Bug Mandiri e-Money Isi Ulang (November 2015)

Jika Anda belum membaca, sebaiknya baca dulu pengantar seri ini: Mencari dan melaporkan bug security. Perlu dicatat: bug ini sudah dilaporkan (akhir November 2015), sudah (sebagian besar) diperbaiki....

blog.compactbyte.com

0

3

4

yohanes

@yohanes

24 days

@CNNIndonesia Silakan

0

3

yohanes

@yohanes

4 months

Bad experience with @flyscoot , everything was paid successfully, got charged, got email confirmation. When I tried to checkin: failed. Contacted support: they said my flight was canceled because paypent problem. Bank said: no problem.

5

0

1

yohanes

@yohanes

12 years

C is the programming language for American patriots. They even ask in their national anthem: "Jose, can you C?"

0

10

2

yohanes

@yohanes

9 years

@afwanpurwanto @gojekindonesia Masih bisa lihat account user lain, history user lain, data2 driver.

3

2

yohanes

@yohanes

12 years

@hennyzainal @YM0T @dr_piprim @bundapoetri data difteri dinkes Jatim: http://t.co/PUdDkdQu Sebagian besar yg kena adalah yg tidak vaksin.

2

3

2

yohanes

@yohanes

8 years

Kickstarter going on right now that leverages my Teensy U2F implementation

0

2

yohanes

@yohanes

4 months

I have contacted my bank (took 20 minutes to get through). My payment is confirmed, It has been on the credit card statement. There were no refund initiated from @flyscoot since i made the payment in March 5th.

3

0

1

yohanes

@yohanes

16 years

Hacking my agestar NAS

0

1

yohanes

@yohanes

12 years