Liam Cottle

💻 Software Engineer
🕵️‍♂️ Security Researcher
🛠 Created & Developed software used by 10+ million people

[MeshCore @mesh_core]

🚀 MeshCore Firmware v1.15.0 🚀

See the full change log on our blog: https://t.co/zEHoVShJbm

- Companion Firmware: https://t.co/6BSZUZv9p3

- Repeater Firmware: https://t.co/tcappDkVAR

- Room Server Firmware: https://t.co/cSr81RVb8z

#meshcore

[Scott Powell @ripple_biz]

The new MeshCore site has dropped: https://t.co/Uyk2iD6AMx
This will be the go-to site for trusted info, especially for developers. Technical docs are here: https://t.co/s8PM8OGqLz

[Juraj Bednar🏴💛🌘 @jurbed]

🌐 Bridging Bitchat + MeshCore: Resilient communication when infrastructure fails

Bitchat = Bluetooth mesh on phones you already have (~100m range)
MeshCore = LoRa long-range mesh (km+ with cheap hardware)

The bridge connects them. Your phone talks to the city-wide mesh network.
Perfect for disasters, protests, internet shutdowns.

Code: https://t.co/YbP7eVXWiW

Releases: https://t.co/vUVkAY2vjf

Read more: https://t.co/sgRvezRGeC

[Liam Cottle @LiamCottle]

@fullspectrumdev Hey mate! Thanks for the tag. For reference, my repo is a fork of attermann's repo on GitHub. https://t.co/wtZs7oAhh8 this evolved into https://t.co/DsHghKJndN and https://t.co/LSVJ2ry0hx (transport_node branch) these are semi functional but I haven't seen any updates in a while.

[Liam Cottle @LiamCottle]

If you haven’t heard of Reticulum, today is a great day to check it out!

Build your own fully encrypted mesh networks, with automatic route discovery.

Sideband + MeshChat now have audio messages, even over LoRa radio!

https://t.co/PtnkHDPyfB
https://t.co/K0OjZHZY1L

[Liam Cottle @LiamCottle]

@adamwathan Hey mate! Just letting you know https://t.co/9G702Lyybk is returning infinite redirects. Also seems to be affecting https://t.co/RvMAPFVBMD

[Liam Cottle @LiamCottle]

I'm now a licensed amateur radio operator! Maybe I'll start reverse engineering those satellites flying around the sky 🛰 https://t.co/sWLfFmbxjA

[Liam Cottle @LiamCottle]

@SDDZ1994 The app was discontinued 5+ years ago.

[Liam Cottle @LiamCottle]

@leitom @lito_ordes @gonedark Oh man, I’ll never work on a Laravel project again without writing tests… it’s so satisfying doing a composer update, or upgrading to new major versions and seeing exactly what broke and where, if anything broke at all. Have a few projects that have around 2.5k tests each 😂

[Liam Cottle @LiamCottle]

@0xSmit You’ll have a hard time finding any public projects these days. Feel free to DM.

[Liam Cottle @LiamCottle]

@sky9267 StorySave was discontinued several years ago due to legal reasons. Check my discord for more info. https://t.co/Q9dpbo9SXl

[Liam Cottle @LiamCottle]

Just put up a blog post on how to smuggle your IPv4 packets through a DNS tunnel when a network allows you to perform arbitrary DNS queries. Useful on mobile networks when you have no data allowance or WiFi hotspots that require you to purchase a voucher. https://t.co/i7lwNNssAQ

[Liam Cottle @LiamCottle]

@NSExceptional Are you telling me I’ve been doing it the hard way for years 😭😭 “Apple > System Preferences > Security & Privacy > General > Open Anyway”…

[Liam Cottle @LiamCottle]

@fideloper 🐍

[Liam Cottle @LiamCottle]

@topjohnwu @Google I've submitted a vulnerability report for this through Google VRP. If they decide to make my report public after it's been patched. Here's a link to the report. https://t.co/hjeTzvB2Nd

[Liam Cottle @LiamCottle]

I haven't done a CTF for years, but I feel like obtaining the HARDWARE_BACKED flag in Google's SafetyNet Attestations with arbitrary data is pretty cool. What's the next challenge? @google @topjohnwu #safetynet #attestation #android #ctf #tee #security https://t.co/pAOP0m7hYH

[Liam Cottle @LiamCottle]

@topjohnwu @Google Which app signature are you referring to? I can provide arbitrary results for apkDigestSha256 as well as apkCertificateDigestSha256 while still getting hardware_backed. I can't see an app signature in the ASN.1, only the application id.

[Liam Cottle @LiamCottle]

@topjohnwu @Google Thanks! I wasn't really sure how to respond to your tweets at first. As far as I can tell it really depends on the use case though. For general "anti-abuse" checking through https://t.co/RxSc2BS5nG the hardware_backed flag can't be relied upon anymore.

[Liam Cottle @LiamCottle]

@topjohnwu I do understand how attestation works, and it is possible to generate arbitrary attestations. Checkout my gist. You can see it’s signed by Google if you validate the X5C. https://t.co/Kh8cVYBSkO