dumbomason

[dumbomason @dumbomason]

A bug that took 2 years in finding. Not because it was hard but because of pandemic.

I really hope that DMRC is going to take some action. #Delhi #Metro #security #DigitalIndia

[TechCrunch @TechCrunch]

A bug in Delhi Metro's commuter smart card lets anyone ride the metro for free, a security researcher has found.

https://t.co/x9Izzet2uG

[dumbomason @dumbomason]

@idlyupma isnt that the norm with TUIs? have screen col & row and render accordingly in render loop?

[dumbomason @dumbomason]

It's been a month since I pointed this out. Like any other average Indian company, they didn't reply. Welp.

[dumbomason @dumbomason]

.@thirdwaveindia where do I report a security vuln? I shouldn't be able to view all the users, let alone admin users. Also, accidentally made myself an admin. Remove that asw. Thanks!

[dumbomason @dumbomason]

.@thirdwaveindia where do I report a security vuln? I shouldn't be able to view all the users, let alone admin users. Also, accidentally made myself an admin. Remove that asw. Thanks!

[lcamtuf @lcamtuf]

My new C programming book is slowly taking shape. If you want to learn along, let's start with the basics of control flow:

https://t.co/KqwaRAdsct

1/5

[dumbomason @dumbomason]

@pjparties Late reply: I never thought people would gatekeep my findings haha. The document was written in public domain to educate others. Gatekeeping goes against it. :P

https://t.co/rUzLuhq9Sq

This is the updated blog.

[dumbomason @dumbomason]

.@Swiggy 13.77 centuries for some chicken? 😅

[dumbomason @dumbomason]

.@amitgupta007 you might be interested in some of the findings :)
I must say, the obfuscation that I've seen in #Yulu's android app is top notch. Tho, obscurity is not #security :)

Mandatory tag, tho I know I'll be ghosted, @YuluBike

[dumbomason @dumbomason]

.@YuluBike stop ghosting. Either say that your systems are secure and I'm lying or acknowledge my findings. Ghosting is not gonna do anything.

[dumbomason @dumbomason]

.@YuluBike stop ghosting. Either say that your systems are secure and I'm lying or acknowledge my findings. Ghosting is not gonna do anything.

[Yulu @YuluBike]

@dumbomason Hey, please share your contact details via DM, and our team will get in touch with you to discuss the same.

[dumbomason @dumbomason]

@YuluBike Been 3 working days. Guess you need more time to drop a "Hi" in my email inbox?

[dumbomason @dumbomason]

hey @YuluBike, how do one file a bug report for one of your services?

[dumbomason @dumbomason]

@YuluBike You wanna take this to DMs? I found a way to start Miracle bikes without opening the Yulu app. I can elaborate more here or DMs, you decide :).

[cvam @cvam0000]

Dear @HSBC how can you close an account without any notification. And now your officials are saying ‘you will get a demand draft worth of balance in the account’ .Is your mailing system is not working or you became so lazy to notify your customers. #fraud

[hack4play @hack4play]

Invitation & Call for Participation!
https://t.co/77mL8eSF0H
░░
░░█░█▀▀█░█░█▄▄░█
▄▄█░█▄▄█░█░█░█░▄
░░
hack4play in Fort Kochi, Kerala, Feb 1st-6th

#hackbeach #hillhacks #ccc #hack4play #kochi #biennale #kochimuzirisbiennale

SPREAD & RT, tnx <3

[dumbomason @dumbomason]

@Root3d

[Anuvrat Parashar @bhanuvrat]

And @ilugdelhi fellow features in a Tech Crunch article!

[Animesh Ghosh @theOnlyMaDDogx]

Shame DMRC doesn't take security seriously

[Rushabh Mehta @rushabh_mehta]

Delhi Metro is yet to fix the bug reported by Nikhil (@dumbomason) that allows free top ups. Just shows the state of security awareness in India’s best run public utility. Shudder to think about the rest. https://t.co/Fgz36kBB3R

[RISC-V Instructions @ItsABitRISCV]

.@intel CEO @PGelsinger examines the Horse Creek @risc_v development platform at #IntelON
Features four @SiFive P550 cores at 2.2GHz with PCIe G5 & DDR5 in a 4mm x 4mm die using Intel 4 process.
Coming soon(tm) to a next generation HiFive dev board

[dumbomason @dumbomason]

This is how @videolan is being blocked on @ACTFibernet.

@SFLCin

[dumbomason @dumbomason]

#vlc #websiteban
Strange how @ACTFibernet's website ban technique changed from DNS tampering to just replying as the banned website. How ACT bans @videolan...

A small 🧵...

[dumbomason @dumbomason]

You can change the dpid param in the URL to get other block texts.