← Feed

Posts

• Post #4311259

  A RIPE Atlas probe could have been enough to hijack a RIPE NCC user's next login, giving full access to the member portal, including the RPKI dashboard and the RIPE Database. I discovered a session fixation vulnerability in RIPE NCC's single sign-on: the session token was not rotated on login. Two ways to exploit it: a new XSS in RIPEstat through DNS NS records, or a free Atlas probe. Anyone with a free RIPE NCC account can host a probe, approved automatically. Installing a web...

• Post #3071566

  I found that crafted MeshCore node names could compromise Home Assistant instances running meshcore-card, with an XSS leading to remote root access on the HA host. An attacker could then access anything controlled or visible through Home Assistant. The attacker doesn't need to be near the target, as MeshCore advertisements are repeated over the mesh, which is dense in NL. This also affects around 20 public MeshCore analyzer websites. Some of those run CoreScope, where it looks like a vibeco...

• Post #2101964

  RIPE NCC made session tokens for the entire member portal available to over 1000 third parties, by design. Full access to the RPKI dashboard, the RIPE Database, and everything else. RIPE NCC had placed strangers under the same domain as their most critical systems. The RIPE NCC SSO cookie is scoped to `*.ripe.net`, so browsers send it to any HTTPS server under that domain. Atlas anchor hosts and RIPE meeting attendees all had assigned hostnames under that domain, and nothing stopped them from r...

• Post #1777561

  I found a chain of vulnerabilities in systems at RIPE NCC, operator of one of five global RPKI trust anchors. A single click on an ordinary-looking link was enough to disconnect a network from the internet. My entry points were debugging fields in DNS and crafted TLS certificates. From there, I escalated to the RPKI Dashboard, which controls which networks are authorised to announce your IP addresses to the internet, and the RIPE Database, which stores routing policy. All vulnerabilities have b...

• Post #1651888

  Just over 4 years after publishing the first draft, NRTMv4 has been approved by the IESG! This was my first ever IETF draft. This new protocol dramatically improves Internet Routing Registry security and reliability. All that remains now is the RFC Editor process. Four authors went through 11 versions, 25 reviewers/implementers, dozens of comments, and 5 interoperable implementations. Catch my talk at the #RIPE92 database working group to learn more. https://datatracker.ietf.org/doc/draft-ietf...

• Post #1164921

  I have been working on a set of vulnerabilities for 14(!) months, but the end is in sight! Just sent the draft blogs to the vendor for review, got € 3200 in bug bounties, and in two weeks I should be able to publish my attack chain on critical internet infrastructure 🕵️‍♀️

• Post #1134314

  RE: https://hachyderm.io/@sash/116335729974133606 Thank you, people of mastodon and reddit ✨I was already aware this is not actually 7-factor auth technically ✨ Also it's a bad idea mainly for other reasons: one glitch in this usb hub could fry all my keys at the same time 🔥

• Post #1134313

  RE: https://hachyderm.io/@koire/116343090946400221 FIDO2 tokens (like yubikey) are great, but you either want more than one or a good process around recovery codes. Making logins more complicated will lower the risk of account compromise, but increase the risk of locking yourself out. Always have a plan for what happens if a token, phone or other hardware breaks, is lost, or stolen.

• Post #1134312

  Tracking 30 vulnerability findings right now, all variations on the same mistake. Responsible disclosure is getting pretty draining. Vendors range from pretty great to deeply exhausting. Some of this is account takeover, some of it is worse. I do this in my free time, so irresponsible disclosure is starting to sound appealing :)

• Post #915724

  Are you still only using two factor authentication? I'm way ahead of you with my 7 factor authentication 🔐

• Post #762831

  Rooting OpenWRT from the parking lot: I discovered an XSS in the OpenWRT SSID scan page, that can be chained to remote root access 👾 Write-up and demo: https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/ CVE-2026-32721, fixed in 24.10.6 / 25.12.1