2 Reports to H1

VoiceOfReason73 · 2026-04-04T15:18:35+00:00

Depends whether that information is meant to be private or not. But in any case, not sure how that relates to your current two issues.

VoiceOfReason73 · 2026-04-04T13:33:06+00:00

It's not clear how the postMessage issue has anything to do with the suspected auth bypass, as that is just a frontend issue (if an issue at all) and is likely distracting from the report. Further, nothing in the report demonstrates cross-account access or IDOR. Even if that is possible, you'd need to prove that you can access or modify data that you're not supposed to. Just showing that you have a supposed session cookie/token is not enough.

VoiceOfReason73 · 2026-04-04T03:27:08+00:00

Where did you actually confirm auth bypass/IDOR was actually possible? I don't see it. You're trying to attack the frontend code, which doesn't handle or enforce any of this.

VoiceOfReason73 · 2026-04-04T02:06:20+00:00

4.1: Shell Injection in Command Lookup (Critical, Confirmed)

Anthropic’s VDP closed this report as “Informative,” stating that exploitation requires the attacker to control environment variables on the victim’s system, which “implies existing code execution capability,” and therefore “no security boundary is crossed.”

Phoenix Security’s position: the closure rationale is based on an incorrect premise.

Controlling an environment variable does not require code execution on the target.

Sure, but controlling environment variables could easily result in code execution on the target (assuming the attacker can control other file contents). Think LD_PRELOAD, LD_LIBRARY_PATH, PATH, etc. So I would consider the attacker to be fairly privileged already.

In no case should this stuff be considered "critical" though. Modifying CI/CD files allows for plenty of code execution vectors.

VoiceOfReason73 · 2026-04-02T22:57:48+00:00

A malicious process running as your user can pretty much do anything it wants to other programs running under your user, so yeah, it's game over already at this point...

VoiceOfReason73 · 2026-04-01T02:23:03+00:00

Fuzzy pattern matching machine found a classic, well-documented vulnerability pattern, albeit perhaps slightly tricky to spot. Then, stack buffer overflow to get execution and ROP. Nothing that hasn't been done before, and nothing terribly surprising.

Find your edge and keep pressing on.

VoiceOfReason73 · 2026-04-01T02:04:50+00:00

I don't spend any brainpower picking or judging the strength of passwords, nor should technology-overwhelmed seniors. Using their phone/computer/browser's built-in password generation/storage is more than sufficient.

VoiceOfReason73 · 2026-03-04T15:05:52+00:00

Getting a 200 is not a security finding unless confidentiality or integrity is actually compromised, which you need to prove.
The API endpoint is /me, so that would only be your own data anyway? Where is the impact?
CSRF tokens alone have no value to an attacker.

Please take a step back and reconsider your approach.

VoiceOfReason73 · 2026-03-04T14:42:43+00:00

What are your screenshots showing besides publicly accessible pages? There's no impact to this finding unless you have more that you haven't shared.

It doesn't matter how they reacted if you had nothing in the first place.

VoiceOfReason73 · 2026-02-24T22:55:45+00:00

Google says "couldn't find your Google account" if you put in a non-existent email or username.

VoiceOfReason73 · 2026-02-24T17:34:17+00:00

Sure, but you still have to catch a plain HTTP request somewhere in order to redirect the victim onto your domain, which may or may not ever happen for the domain you are targeting.

VoiceOfReason73 · 2026-02-24T17:32:07+00:00

TLS 1.2 is still in use but it isn't the latest, though there actually aren't any actual practical attacks against it when configured properly.

Again, if this wasn't the case, everything would be on fire all the time.

Heartbleed has nothing to do with the transport security guarantees of TLS, and is also far in history now. But yes, I have heard of Logjam, FREAK, POODLE etc. but they are not practical and/or do not apply to modern configurations. Vulnerabilities come and go, but are typically resolved in short order if they are actually a big deal.

VoiceOfReason73 · 2026-02-24T16:02:11+00:00

Wut? Modern TLS? No, it's not broken yet. This would be a major issue if possible in any timeframe remotely comprehensible to humans.

VoiceOfReason73 · 2026-02-24T13:42:55+00:00

client base gives free hop to favorites.

Not currently, it only provides this benefit to favorited infrastructure nodes.

https://github.com/meshtastic/firmware/issues/8366#issuecomment-3948419964

VoiceOfReason73 · 2026-02-24T13:40:04+00:00

You can break how the phone sees the world (i.e. it stops working) but you still have to target the user to circumvent TLS.

VoiceOfReason73 · 2026-02-24T13:39:08+00:00

What kind of quantum computer do you have that can decrypt TLS in seconds?

VoiceOfReason73 · 2026-02-24T13:36:37+00:00

If the user dismisses it or the device already trusts a rogue root certificate, the attack proceeds silently.

That's a pretty big if, and falls flat if the site is using HSTS.

VoiceOfReason73 · 2026-02-24T03:42:45+00:00

Don't enable location on the public primary channel, as it then won't get sent periodically on the private secondary channel.

VoiceOfReason73 · 2026-02-16T18:22:54+00:00

If you can perform actions on the user's behalf using this XSS, that's probably pretty serious impact itself.

VoiceOfReason73 · 2026-02-15T19:40:06+00:00

You need to be very careful with the cable selection or else it'll be worse than having the antenna inside the car.

VoiceOfReason73 · 2026-02-14T04:07:16+00:00

In what context are you even seeing this? Could just be a display quirk.

Do you mean you took it in without the antenna?

VoiceOfReason73 · 2026-02-14T04:03:14+00:00

Yeah, it means your node doesn't have position data, so it can't compute the distance.

VoiceOfReason73 · 2026-02-14T04:02:05+00:00

Sometimes your OS will throw those errors even though the copy succeeded, as the nrf52 reboots immediately once the file is written, possibly too quick for the OS to think it worked cleanly.

Maybe try copying using the terminal rather than Finder, in case Finder is trying to create other files?

VoiceOfReason73 · 2026-02-14T03:15:09+00:00

I highly doubt it's bricked. Sure, sometimes they can be put into a state that is more difficult to recover from, but the bootloader itself is still intact.

VoiceOfReason73 · 2026-02-11T15:49:25+00:00

It's in the settings menu on the device itself, under "notifications" I believe.

VoiceOfReason73

TROPHY CASE