Pinned Tweet
A bug that took 2 years in finding. Not because it was hard but because of pandemic.
I really hope that DMRC is going to take some action. #Delhi #Metro #security #DigitalIndia
A bug in Delhi Metro's commuter smart card lets anyone ride the metro for free, a security researcher has found.
tcrn.ch/3DXQW9h
A full reverse engineering write-up of the NCMC spec built on RuPay. I cover bypassing app security, decoding APDUs, mapping the card's memory, how balance reads and topup work, and building my own tools to read the card. nkmason.dev/posts/reversing-…
dumbomason retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Managed to read the balance out of a NCMC card. Due to the NCMC standard it works with blore's, kochi's and dmrc's NCMC card. I'll prolly write a blog about it in future. Till then, read @ nkmason.dev.
It's been a month since I pointed this out. Like any other average Indian company, they didn't reply. Welp.
.@thirdwaveindia where do I report a security vuln? I shouldn't be able to view all the users, let alone admin users. Also, accidentally made myself an admin. Remove that asw. Thanks!
.@thirdwaveindia where do I report a security vuln? I shouldn't be able to view all the users, let alone admin users. Also, accidentally made myself an admin. Remove that asw. Thanks!
dumbomason retweeted
My new C programming book is slowly taking shape. If you want to learn along, let's start with the basics of control flow:
godbolt.org/z/3GerY3zEc
1/5
.@amitgupta007 you might be interested in some of the findings :)
I must say, the obfuscation that I've seen in #Yulu's android app is top notch. Tho, obscurity is not #security :)
Mandatory tag, tho I know I'll be ghosted, @YuluBike
.@YuluBike stop ghosting. Either say that your systems are secure and I'm lying or acknowledge my findings. Ghosting is not gonna do anything.
.@YuluBike stop ghosting. Either say that your systems are secure and I'm lying or acknowledge my findings. Ghosting is not gonna do anything.
dumbomason retweeted
Invitation & Call for Participation!
md.ha.si/hack4play:CFP
░░
░░█░█▀▀█░█░█▄▄░█
▄▄█░█▄▄█░█░█░█░▄
░░
hack4play in Fort Kochi, Kerala, Feb 1st-6th
#hackbeach #hillhacks #ccc #hack4play #kochi #biennale #kochimuzirisbiennale
SPREAD & RT, tnx <3
dumbomason retweeted
And @ilugdelhi fellow features in a Tech Crunch article!
A bug in Delhi Metro's commuter smart card lets anyone ride the metro for free, a security researcher has found.
tcrn.ch/3DXQW9h
dumbomason retweeted
Shame DMRC doesn't take security seriously
A bug in Delhi Metro's commuter smart card lets anyone ride the metro for free, a security researcher has found.
tcrn.ch/3DXQW9h
dumbomason retweeted
Delhi Metro is yet to fix the bug reported by Nikhil (@dumbomason) that allows free top ups. Just shows the state of security awareness in India’s best run public utility. Shudder to think about the rest. techcrunch.com/2022/11/02/in…
dumbomason retweeted
.@intel CEO @PGelsinger examines the Horse Creek @risc_v development platform at #IntelON
Features four @SiFive P550 cores at 2.2GHz with PCIe G5 & DDR5 in a 4mm x 4mm die using Intel 4 process.
Coming soon(tm) to a next generation HiFive dev board
#vlc #websiteban
Strange how @ACTFibernet's website ban technique changed from DNS tampering to just replying as the banned website. How ACT bans @videolan...
A small 🧵...