Topic
10 posts
I went looking for something clever in the ASUS Router Android app and instead found a service sitting wide open with a sign on it. Here is the whole story: the manifest, the Parcelable, the six payloads, and the wait for a fix.
A cyber incident stopped Stryker's order processing, manufacturing, and shipping, and delayed some surgeries, without ever touching a medical device. Most organizations still plan for commodity ransomware. This is the other threat model.
Two malicious versions of Axios reached npm through a compromised maintainer account, each carrying a dependency whose only job was to drop a remote access trojan at install time. The target was never your users. It was your build machine.
A facial recognition match put a Tennessee grandmother in jail for months over a crime in a state she had never visited. She lost her home, her car, and her dog. The bank records that cleared her were available the entire time.
Flock's cameras can zoom in close enough to read your phone screen, and the researcher who found more than 50 vulnerabilities in the network behind them lost his job for saying so. This is what surveillance at national scale looks like without oversight.
Someone I know was groomed for six months before the fake trading platform ever came up. Modern job and investment scams run on patience, your digital footprint, and AI, and some of them are staffed by people who answered a fake job ad themselves.
Two penetration tests, two APIs that never checked. One handed HIPAA-protected medical records to the open internet. The other let anyone pull live card data from an app the bank swore was still in development. Same bug, two costumes.
I typed a single quote into a log search box on an internal pentest and DeliverNow told me everything. Here is the whole story: the confession in the error message, the xp_dirtree callback, the sa account, and the CVE that came out of it.
SonicWall's SSO Agent runs as Domain Admin and authenticates to any workstation it is told about, without ever checking who that is. One curl command through the firewall, one Domain Admin hash. Here is the whole story.
An internet-facing page where parents look up their child's school bus turned out to take SQL. Here is how one unauthenticated form field became a foothold, a service account, and eventually an entire Active Directory forest.
