Hacker News Reader

MrBruhon 1.4 Billion user records exposed by insecure Firebase instances in Android apps

Out of the top 1.5 Million Android apps on the Play Store, 11,126 were insecure and exposed users’ PII. In total these 11 thousand apps exposed 1.43 Billion user records. This includes 5 apps with 100 Million downloads and 10 apps with 50 Million downloads.

MrBruhon One-Click RCE in Asus's Preinstalled Driver Software

On the black market such an exploit would be worth 200-500k USD

MrBruhon One-Click RCE in Asus's Preinstalled Driver Software

Nice idea, just checked it now and can confirm there was nothing suspicious in the wildcard records.

MrBruhon [dead]

ignore the post thx <3

MrBruhon [dead]

Feedback on my blog posts are always appreciated! :)

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

When manually reviewing a lot of these sites it was not identifying PII that were in non-english since the automated scanner checks the variable name for known data types (e.g phone) but that would only work for English sites.

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

Correct, that's why we couldn't post a list of affected sites or malicious actors would immediately abuse it :/

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

Bro woke up on the wrong side of the bed

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

Can't blame a company for trying to make their AI charismatic :D

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

Glad to hear you enjoyed it, it was a messenger called "Line"

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

That's because I wrote both of those articles, and this is the sequel to that blog post. :P

MrBruhon 900 Sites, 125M accounts, 1 Vulnerability

No worries, support like this really helps to make it feel worthwhile. :)

MrBruhon DEF CON 32 Was Canceled. We Un-Canceled it

I had my blog be on the front page for ~6-8 hours racking up 100k+ unique loads. It also managed to survive just fine on a $5 VPS so I would hope that other sites could survive.

MrBruhon ARM's "Blackhawk" CPU Is a Plan to Have the Best Smartphone CPU Core

Ah my bad, misinterpreted it

MrBruhon ARM's "Blackhawk" CPU Is a Plan to Have the Best Smartphone CPU Core

I don't think comparing a 2017 phone to a 2023 one is a fair comparison by any stretch.

If you want something more similar I would suggest the standard "Samsung galaxy S23" which has 8Gb compared to the IPhones 6Gb

MrBruhon I pwned half of America's fast food chains simultaneously

Sure but it's FOSS, so audits are pretty easy.

Plus as part of the pentesting I watch the network stack in Firefox sometimes so I would tell if it was trying to exfiltrate date

MrBruhon I pwned half of America's fast food chains simultaneously

To clarify the dates, the vulnerability was discovered on a Saturday (Friday evening) their time. It was reported on Tuesday (Monday their time)

The only email listed on their site was for the sales team which would not be checked on a weekend.

MrBruhon I pwned half of America's fast food chains simultaneously

Don't worry, it was only a couple passwords for their admin accounts.

MrBruhon I pwned half of America's fast food chains simultaneously

Thank you, the kindness goes a long way!

MrBruhon I pwned half of America's fast food chains simultaneously

Shouldn't anymore, was a "pushing to production" moment. I wanted analytics since my site was getting flooded \w traffic.

MrBruhon I pwned half of America's fast food chains simultaneously

It is using the Avif format (for images) for a 2x compression bonus over PNG while still maintaining a higher quality over JPG.

If you can't view the images then it means you are likely using an outdated browser, all current versions of browsers support it (afaik) except Internet Explorer.[0]

...And if you are using Internet Explorer, then god help you.

[0] https://caniuse.com/avif

MrBruhon I pwned half of America's fast food chains simultaneously

New Zealand GMT+13 Moment

MrBruhon I pwned half of America's fast food chains simultaneously

I feel I should clarify, the writeup was not the blog but rather than vulnerability disclosure report (PDF) I sent to them directly.

MrBruhon I pwned half of America's fast food chains simultaneously

> any account on any one of their existing customers had full access to every row in the database.

Correct. :/

MrBruhon I pwned half of America's fast food chains simultaneously

> Good Samaritan

The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)

MrBruhon I pwned half of America's fast food chains simultaneously

loud buzzer

Sorry, but supabase has a similar issue.

Another blog going over that has or will be made by Eva (referenced on the site)

MrBruhon I pwned half of America's fast food chains simultaneously

That's my lovely cat, Jingles. She is getting a bit old so I thought I would immortalize her on the homepage of my site.

MrBruhon I pwned half of America's fast food chains simultaneously

It was posted earlier today (NZ Time). If they do end up reaching out though, I will amend that part with a revised statement :)