Blog on Thomas Rinsma

Would you believe me if I told you this HTML page could show an alert('hi from WASM'), when loaded?

During a research project for Codean Labs, Edoardo and I found several vulnerabilities in OpenPGP.js.

During a research tangent at work, I found several logical vulnerabilities in LibreOffice.

Click to play Tetris Recently, just for fun, I managed to create a playable version of Tetris inside a PDF.

Through pentest work at Codean Labs, I found that Ghostscript is unexpectedly part of many attack surfaces, even server-side: applications that process user-submitted documents or images may invoke ImageMagick or LibreOffice for conversion, which in turn…

I found a way to execute Javascript inside PDF.js from within an untrusted PDF.

Recently I’ve been learning more about electronics and PCB design, something I had no experience with up until recently.

You might have seen the classic Youtube video by marcan showing a Gameboy Color being overclocked to arbitrary frequencies, using an FPGA development board.

Last year, during a tangent for a project, Kevin and I found a series of vulnerabilities in (combinations of) several Node.js packages that led to critical issues for our client, and most likely other users as well.

For the past half a year or so I have been playing around with a specific type of payment terminal, the VX820 from Verifone.

Over many years I kept coming back to this side-project: an emulator for the original Nintendo GameBoy (aka DMG).

In my previous post, I detailed a fun method of obtaining root access on the Zyxel VMG8825-T50 router, which required physical access to the device and authenticated access to the web interface.

The device.

For the last couple of months I’ve been working on and off on my C++/OpenGL “game engine”, mostly for the purpose of learning OpenGL.

You might know the Facebook game called “Tetris Friends”.