Login

Recent searches

No recent searches

Search options

Only available when logged in.
schleuss.online is one of the many independent Mastodon servers you can use to participate in the fediverse.
This instance has a focus on IT security, general computing, retro video games and game collector discussion. Please, no #NSFW and other 18+ discussion on this instance. See rules for more details

Administered by:

Server stats:

11
active users

schleuss.online: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#vulnerability

3 posts3 participants0 posts today
Public *
Yellow Flag

My new article is out, this time it’s about internet-connected cameras, mostly being marketed as spy cameras. While the cameras themselves are very different, the common factor is the LookCam app used to manage them.

There is already a considerable body of research on these and similar P2P cameras, so it shouldn’t be a surprise that their security is nothing short of horrible. Still, how the developers managed to make all the wrong choices here on every level (firmware, communication protocol, cloud functionality) is quite something.

palant.info/2025/09/08/a-look-

Almost Secure · A look at a P2P camera (LookCam app)
More from Yellow Flag
#infosec#iot#lookcam
Public
BobDaHacker 🏳️‍⚧️ | NB

🍔 Just collabed with @BobTheShoplifter on a MASSIVE SECURITY BREACH: We exposed how Restaurant Brands International (Burger King, Tim Hortons, Popeyes) left their drive-thru systems etc completely vulnerable.

🎯 What we found:
• Unauthenticated API access to ALL drive-thru locations globally
• Drive-thru voice recordings of customers accessible
• Employee PII exposed.
• Bathroom feedback systems with zero auth
• Hardcoded passwords in client-side code

The scope was insane - we could access any drive-thru system globally. Even listen to your actual drive-thru orders 👂

Credit to RBI for lightning-fast response once disclosed, but the privacy implications were staggering.

Full technical breakdown: bobdahacker.com/blog/rbi-hacke

bobdahacker.com · We Hacked Burger King: How Authentication Bypass Led to Drive-Thru Audio SurveillanceCritical authentication bypass vulnerabilities in Restaurant Brands International's assistant platform allowed complete control over 30,000+ Burger King, Tim Hortons, and Popeyes locations worldwide - including access to customer drive-thru audio recordings.
#InfoSec#CyberSecurity#ResponsibleDisclosure
Public
Marco Ivaldi

Interesting #vulnerability research writeup (that was published a few months ago)

Compromising #OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

flatt.tech/research/posts/comp

GMO Flatt Security Research · Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command InjectionIntroduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After accessing the LuCI, which is the web interface of OpenWrt, I noticed that there is a section called Attended Sysupgrade, so I tried to upgrade the firmware using it. After reading the description, I found that it states it builds new firmware using an online service.
Public
BobDaHacker 🏳️‍⚧️ | NB

🤖 Hacked China's Biggest Robotics Company (Pudu Robotics)

Pudu makes those cat-faced BellaBot robot waiters you see in restaurants, plus cleaning robots, disinfection bots, and even FlashBots with mechanical arms for offices.

Found critical vulnerabilities in their app controlling their entire global fleet:

  • Zero authentication on APIs
  • Could control any robot worldwide
  • Accept 20k store IDs in single request, no rate limiting
  • Could steal food, documents, redirect hospital medicine delivery
  • FlashBot with arms could grab files & use elevators

Reported Aug 12. Sent emails to sales, support, tech teams - all ignored.

Had to email Skylark Holdings (7000+ restaurants) and Zensho directly about their compromised robots.

Pudu responded in 48hrs with obvious ChatGPT template - forgot to replace "[Your Email Address]" placeholder. Fixed 2 days later.

Thousands of robots (BellaBots, KettyBots, FlashBots, etc) in hospitals, restaurants, offices worldwide were vulnerable for a long time.

Full Technical Writeup: bobdahacker.com/blog/hacked-bi

bobdahacker.com · I Hacked BellaBot and Every Robot from China's Biggest Robotics Company (Pudu Only Fixed It When I Told Their Clients)Critical vulnerabilities in Pudu Robotics allowed unauthorized control of every Pudu Robotics Robot worldwide. They ignored emails until I contacted Skylark Holdings and Zensho about their compromised robot fleets.
#infosec#robotics#BellaBot
ExploreLive feeds
About