ManpaoSam

Manpao

[ManpaoSam @ManpaoSam]

@zandyor New microphone

[ManpaoSam @ManpaoSam]

@Bitcoinprof0637 Imma try it why not, BTC

[ManpaoSam @ManpaoSam]

@DromasGamerHD I can't imagine winning it

[ManpaoSam @ManpaoSam]

@schiz04renic Coconut

[ManpaoSam @ManpaoSam]

@zandyor Ce2hUywe5feHWyiKodqjJpyAfNXzNwWw6nVkt8Z8MncG

[ManpaoSam @ManpaoSam]

@OpenledgerHQ No way

[ManpaoSam @ManpaoSam]

@cryptocupra @grok done

[Cup @cryptocupra]

Giving away 0.007 $BTC to a random person!

As promised, I’m sending 0.007 #Bitcoin (~$530) to one lucky follower.

Like, retweet 🔔 & comment 'done'.

Will pick a winner via @grok
in ~48 hours, must follow & open DMs.

[ManpaoSam @ManpaoSam]

@AndrewBolis YouTube

[ManpaoSam @ManpaoSam]

@LegacySiu Sporting

[ManpaoSam @ManpaoSam]

@lunarfq Uhh hello

[ManpaoSam @ManpaoSam]

This is devastating

[International Cyber Digest @IntCyberDigest]

‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.

When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.

It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[ManpaoSam @ManpaoSam]

@tye1337 guide

[Tye @tye1337]

i'm gonna regret this but...

it's time to leak my entire faceless youtube shorts system

you got 72 hours to get it.

like, RT + reply w/ "guide" and send it to you (must be following)

[ManpaoSam @ManpaoSam]

@DromasGamerHD 30k for world tour

[ManpaoSam @ManpaoSam]

@AndrewBolis Yt

[ManpaoSam @ManpaoSam]

Do you remember when you joined X? I do! #MyXAnniversary

[ManpaoSam @ManpaoSam]

@DromasGamerHD Sheesh cap

[ManpaoSam @ManpaoSam]

@Mrwhosetheboss @Sidemen Nice!!