Yellow Flag

Wladimir Palant, software developer and security researcher, browser extensions expert. / tfr

#infosec #cybersecurty #cryptography #privacy

Public Key

npub190z95jsfjmjuzvdrq2t27ucldpvvsvh46tcxl9elexhy9mp2qeps6f5wdd

NIP-05 Address

WPalant_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqszh3z6fgyedewpxx3s9940wv0kskxgxt6a9ur0juluntjzas4qvscpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qz9thwden5te0v35hgar09ec82c30wfjkcctewpny62

Publishing to

relay.mostr.pub

ditto.pub/relay

Author Public Key

npub190z95jsfjmjuzvdrq2t27ucldpvvsvh46tcxl9elexhy9mp2qeps6f5wdd

Show more details

Last Notes

2024-11-09 08:51:18

- reply

And the second instance confirms the ruling. 🙄 There will be more instances but this is disappointing.
Apparently, the matter of the publicly available password wasn’t discussed at all. It was all about illegitimate access to data, regardless of inadequate data protection. Guilty in the sense of the law.
This law was about to be adjusted, defusing it for security researchers. Unfortunately, with the German government breaking up it’s unclear whether that change can still happen. It’s pretty much a given that the next government won’t be interested in fixing this issue.
Source: https://www.heise.de/news/Modern-Solution-Berufungsgericht-bestaetigt-Schuld-des-Sicherheitsforschers-10007090.html

2024-11-06 15:42:40

And thus, my friends, the $44 billion for Twitter weren’t lost at all but rather invested into bringing United States’ wannabe-dictator back into power. Now that this goal has been accomplished, Elon can expect to be richly rewarded.
Oh, you are still on Xitter? Driving a Tesla? I hope you are happy with what you’ve helped achieve.
(A number of other US tech billionaires are guilty as well, but that’s the one who didn’t even make it a secret that he is there for fascism.)

2024-10-30 22:58:45

- reply

@npub1uj7…j2yl Don’t they all?

2024-10-30 20:53:43

Whenever companies “overinvest and underperform,” for some reason the people that have to go are never the execs who made these strategic mistakes.

2024-10-30 13:22:58

I found a bunch of malicious extensions in Chrome Web Store, with disguised functionality to commit affiliate fraud and collect browsing profiles. But that isn’t the interesting part, there is plenty of that in Chrome Web Store.
These extensions appear related to the Karma shopping assistant, with some strong indicators hinting towards them being developed by Karma Shopping Ltd. In case you are unfamiliar with the company, they employ more than 50 people and secured at least $28 million in funding.
Yes, they are presenting themselves as an innovative company of course.
https://palant.info/2024/10/30/the-karma-connection-in-chrome-web-store/

2024-10-30 11:45:44

Interesting. When I search for “Norton Password Manager” on Chrome Web Store, it first lists five completely unrelated extensions, and only the last search result is the actual Norton Password Manager. Somebody told me that website is run by a company specializing in search, so this shouldn’t be due to incompetence, right? What is it then?
#google #cws

2024-10-14 22:22:28

It’s this time of year again: we can witness thousands of people (mostly men of course) come up with ridiculous excuses to defend a powerful man who has been (once again) accused of misconduct.
And you know what, this exact behavior is part of the reason why men in power (yes, in our society it’s almost universally men) are so often ignoring the boundaries of socially acceptable behavior. It’s because everyone around them is only telling them how great they are. All their flaws are politely ignored or even actively denied, so they never bother doing anything about them.
But your heroes are mere human beings. Regardless of their great achievements, they will have flaws. And without anyone telling them to stop, they will just keep doing the same harmful things over and over again until decades later the whole thing blows up publicly. “Hey, what happened, this was always fine?” Well, maybe not quite like that in this particular case, I’m reading that many people did tell him to stop.
Either way: you can be grateful for the person’s achievements without idealizing that person and ignoring the harm it is doing. Please by default believe the people speaking out against powerful men – it’s a fight that will typically achieve little while costing them dearly, so your knee-jerk reaction “they are probably lying” is very wrong 99% of the time. No, the remaining 1% isn’t itself a valid reason to distrust testimonies.
I want to live in a world where people in the positions of power use that power responsibly. This isn’t going to happen unless their peers hold them responsible.

2024-10-01 12:13:47

I’ve published my article on the Impact Hero SDK (as used by at least 16 browser extensions) and the refoorest extension. The company behind these is the France-based Colibri Hero, also known as allcolibri: https://palant.info/2024/10/01/lies-damned-lies-and-impact-hero-refoorest-allcolibri/
Trust me, the article title is justified. I couldn’t believe it when I saw how everything they claim turns out to be a lie. Their line of business is commonly called “affiliate fraud,” so they carefully avoid this topic and instead make the impression of being supported by altruistic companies that genuinely care for our planet.
They promise to plant trees if people use their extensions but their numbers are all fake. The numbers displayed by the extension don’t add up to the numbers shown on their web page. Maybe they should have implemented access control if they didn’t want anybody to figure that out. And the numbers on the web page – well, these have been increasing at a constant rate of 20 trees per hour for the past four years, completely ignoring what their extension users did or didn’t.
Do they actually donate any money? Probably, I don’t know. They don’t disclose their finances, and if they did these would probably turn out fake as well. Should anyone trust them? No, not from what I saw. Should these extensions be nuked from orbit (or at least from the add-on stores)? Yes, absolutely.
There is more “fun” stuff going on here, so feel free to read the article.

2024-09-26 10:05:31

Ok, I found the hotel on booking.com but I restarted my browser and now it shows up with a much higher price… I see, coming from the search as opposed to opening the hotel page directly gives you a discount… And pretending to be a mobile browser (via Firefox’ Responsive Mode) gives you another discount… Ah, screw booking.com and their attempts to overcharge me, I can just book directly on the hotel website which is still cheaper.

2024-07-18 14:01:31

This… checks out.
“Do not work as a Hacker - A Warning to you all” by @npub1wqm…pk54 (who sadly posts images without alt text)
https://rootcat.de/blog/do_not_work_hacker24/

2024-06-06 11:09:48

- reply

@npub1x2v…ar98 It absolutely is possible, you merely have to remove some information. Typical approach is removing the last byte from it – you can still do geolocation without it, but you can no longer trace it back to an individual.

2024-06-06 08:32:22

I’m downloading logs from a Strato webspace. Their management interface produces the following note:
“For data protection reasons, the host name or IP address of the client accessing the website is anonymized in the log files.”
Ok, good to know. Looking into the downloaded logs:
anon-66-249-71-47.googlebot.com
Yes, the famous “prepend anon to IP address/host name” anonymization. Definitely GDPR compliant. /s
#privacy #gdpr #strato

2024-05-09 20:56:53

For once I’m happy that my participation on #StackOverflow was close to zero in the past ten years.

2024-05-09 20:56:53

For once I’m happy that my participation on #StackOverflow was close to zero in the past ten years.

2024-04-30 10:37:50

Old and busted: You rent a slice of a server somewhere and pay a fixed price each month.
New and enlightened: You use our cloud and save massively thanks to our variable pricing! Except when you are hit by an unexpected burst of traffic, then your bill could suddenly grow into four digits or more. No, of course we won’t warn you if that happens and we won’t restrict the traffic either, why would we? By the way, we expect to be paid on time.

2024-04-30 08:40:11

Interesting article, the Dangling DNS equivalent with Amazon S3 buckets and added financial benefits for Amazon. via @npub1lkk…5ldm
https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1

2024-04-26 05:51:02

This is a damning conclusion for passkeys here (by @npub1rg2…hzyu):
“We missed our golden chance to eliminate passwords through a desire to capture markets and promote hype.”
https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

2024-04-23 18:08:27

Nice writeup on Deno sandbox issues. Funny how most of it boils down to a very basic issue: they did security checks on the normalized file path, only to perform the actual operations with the original messy path (which was then interpreted differently). via @npub1axy…lves
https://secfault-security.com/blog/deno.html

2023-08-25 17:28:58

- reply

@npub1az9…swru But did the concept of “cross-origin” even exist in 1993? IFAIK the same-origin security boundary was introduced considerably later, only after frames were introduced and became capable of messing with each other.

2023-08-17 06:57:22

- reply

@npub1h4u…cnpk Wie bei jeder einfachen Lösung für ein komplexes Problem: eher nicht.
Es hat eher damit zu tun, dass die Angreifer sich immer die am schlechtesten gesicherten Systeme herauspicken können. Und davon gibt es in Deutschland genug, weil es keine Mindeststandards für IT-Sicherheit gibt, und bei den meisten Unternehmen das Thema entsprechend an letzter Stelle kommt.

2023-05-09 10:33:29

I wonder whether it’s worth writing a blog post about yet another “security” browser extension that will send all URLs to a server for scanning. Yes, it’s mostly covered by their privacy policy. No, they don’t even claim not to keep this data or to decouple it from the user ID. Yes, this could have been implemented in a privacy-sensitive way. Yes, the browsers themselves actually already do this in a (more) privacy-sensitive way. None of this matters, there are millions of people using this extension.
#privacy