Deschide articolul original într-un tab nou Schimbarea acestei opțiuni se aplică imediat și reîncarcă pagina.
LECTURA
← Înapoi la Urmăritori

Alex Manson

neurowinter.com/feed
Vizitează site-ul

Cel mai recent articol

Ultima verificare

Urmăritori 0 urmăritori
Articole: 10

  1. Sixteen strangers and a shared obfuscator: mapping the wool scene

    (Alex Manson)

    TLDR: What looked like 16 independent authors is one shared tool stack.

  2. The Trade Desk is on your health portal, your bank, and the lottery

    (Alex Manson)

    TLDR: Two buy-side ad brokers, The Trade Desk and Xandr, each receive a persistent cross-site identifier from six of the ten sensitive New Zealand sites I checked: a patient portal, a bank, the national lottery, a city council and two universities.

  3. Forging the government’s lottery: China’s civic apps run on a shared reward backend with no real secret

    (Alex Manson)

    TLDR: The civic apps in this scene are not bespoke.

  4. Farming the farmers: smallfawn’s JD login tool routes harvested credentials to their own server

    (Alex Manson)

    TLDR: smallfawn is one of the more advanced actors in this whole scene: 152 repos, a 3,176-star script collection, and decode_action, the JS deobfuscator most of the ecosystem relies on.

  5. The wool DRM, part 1: the Cython loader I cracked

    (Alex Manson)

    TLDR: wyourname/wool is a zero-star GitHub repo that does one job: script DRM.

  6. The wool DRM, part 2: the Rust wall I didn’t crack

    (Alex Manson)

    TLDR: Recap: wyourname/wool is the script-DRM repo a big slice of the Chinese reward-farming (薅羊毛) scene rents to seal their fraud scripts.

  7. A weekend in the wool: mapping a Chinese reward-farming underground from one GitHub repo

    (Alex Manson)

    TLDR: A friend’s grep.app link and a hunt for leaked password prefixes turned one 292-star GitHub repo (985Ming/qlk) into a map of a Chinese reward-farming (薅羊毛) underground: 16 actors, 26 repos, 60+ targeted platforms.

  8. DragonflyDB Lua sandbox escape via getmetatable(_G) metatable override

    (Alex Manson)

    TLDR: A full Lua sandbox escape in DragonflyDB, a protection-mechanism failure (CWE-693).

  9. RCE and arbitrary file write in Vitess vtbackup via untrusted MANIFEST fields

    (Alex Manson)

    TLDR: Two CVEs in Vitess.

  10. HashiCorp Nomad FIFO symlink attack (CVE-2026-6959, CVE-2026-8052)

    (Alex Manson)

    TLDR: HashiCorp Nomad and Nomad Enterprise from 0.9 through 2.0.0 are vulnerable to arbitrary file read and write on the client host as the Nomad process user.