Security researcher Adam Caudill writes about TLS certificates, vulnerability disclosure, leaked firmware, and cryptography.
HN commenters link his posts on EV certificates, leaked BIOS source code, and disclosure terminology, usually as supporting security references.
MSI will absolutely refuse to disclose the firmware to his laptop so that he can make it so his replacement does not also brick itself
The IBM PC, XT, and AT came with a physical copy of the complete source code for the BIOS, several hundred pages in a 3-ring binder. (You can get a digital copy of it here: https://archive.org/download/bitsavers_ibmpcat150ferenceMar84_26847525 ) IBM did this, despite the fact that they strongly recommended applications use the BIOS interfaces and not access the hardware directly. They could've saved so much paper if they just documented the API, but they didn't --- they released the whole thing.
Yet 30 years later, in an era where it's easier than ever to distribute large amounts of information, companies regard such details as confidential and proprietary, hiding them even from their customers --- the real owners of their products. It costs next to nothing to distribute a DVD with each machine containing all the source code and documentation, or just put it up for download. Unfortunately the only recourse seems to be the occasional leak[1], and what's more disappointing is the overwhelming response that this is a "bad" and "insecure" thing, when it's really liberating what users should've received with their hardware.
[1] http://adamcaudill.com/2013/04/04/security-done-wrong-leaky-ftp-server/
> The good news is that Apple and Chrome did an amazing job at responding to this issue with the urgency that it deserves
Excuse me? It is Google that assigned this as Chrome only. Over the last 7 days alone every single major Linux distribution has had to push an update (including Red Hat which assigned this a 9.6 score), and Docker images like Python which has over 1 billion pulls, not to mention Puppeteer(hello?), WordPress, Node.js, etc. and CRBug is still private to this day.
I am not being condescending but sites like BleepingComputer reported this as they saw it rather than doing any investigation. And the same goes for a lot of security companies that reported on this issue in third person. It’s really difficult to foster trust when you know that the person on the other side hasn’t bothered to do any due diligence.
Adam Caudill (1Password was one of the first to patch it) did a nice blog post, “Whose CVE is it anyway?”[0] highlighting the issue I am talking about in my comment.
Citizen Lab has refused to comment on whether both are related, but it doesn’t take a genius does it…
[0]: https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
This is completely off-topic, but I'm curious. How does one go about "reverse engineering" a protocol like what Snapchat uses? Do you just listen in on the bits that the phone sends (say, with Wireshark) and kind of guess and poke at it to see what each part does?
Edit: after some research (like reading TFRepo), I found some links mentioned that give some info in case anyone else is curious too.
http://adamcaudill.com/2012/06/16/snapchat-api-and-security/
https://github.com/tlack/snaphax#motivation-and-development-process
>If the code was old, as it’s been when products like Symantec’s were leaked, this might not be so bad - but it’s not.
>http://adamcaudill.com/files/Screenshot_4_4_13_10_04_PM.png
>References in the files indicate that the code is from sometime in February - so this is current code.
Given that that image shows dates in 2012, I think the author has made the classic mistake many of us make at the start of the new year, of still thinking it's the old one.
Scott Helme, a security researcher has an article on EV certificates and some of the issues with them in an article from December 2017 (https://scotthelme.co.uk/are-ev-certificates-worth-the-paper-theyre-written-on/). There was some discussion on this when it was originally submitted to HN at https://news.ycombinator.com/item?id=15850837.
Adam Caudill also has some insight here: https://adamcaudill.com/2017/04/09/looking-value-ev-certificates/
api.snapchat.com is currently a CNAME to feelinsonice-hrd.appspot.com .
Apparently the current API has been reverse-engineered very recently [1], with an alternate implementation publicly available [2].
Not good considering the nature of the app, perhaps there are some backwards-incompatible changes in the works?
[1] http://adamcaudill.com/2012/12/31/revisiting-snapchat-api-and-security/
[2] https://github.com/tlack/snaphax