outoflegend

Loading…

[outoflegend @outoflegend]

@mesouug @comma_ai It's C238

[outoflegend @outoflegend]

https://t.co/OyKe6A72ik driving a Mercedes with lateral control in heavy rain.

[outoflegend @outoflegend]

@JesusHormigo @comma_ai https://t.co/P4gzAhMaMq it's my low cost implementation, using a raspberrypi pico 2.

[outoflegend @outoflegend]

@JesusHormigo @comma_ai Yes, it's FlexRay based.

[outoflegend @outoflegend]

What if Huaqiangbei tech just feeds image data directly over MIPI?

[Succinct @SuccinctLabs]

Today, we're launching ZCAM, an iPhone camera app to Prove What’s Real.

ZCAM cryptographically signs photos and videos at the moment of capture. Anyone can independently verify the content came from a real device and hasn't been altered or AI-generated.

[outoflegend @outoflegend]

@Rustallintsla 追觅

[outoflegend @outoflegend]

@___Harald___ @comma_ai OpenPilot x Mercedes on the way.

[p0n1 🦇🔊 @ErrNil]

Fixed in 2018, but many user wallets got hacked in 2023. @teawaterwire and I are one of them. The Lubian hack is not related with Trust Wallet. This is the FUD part. However, Trust Wallet team lied about many things in their statement.

Trust Wallet admitted their product had a vulnerability in 2018 but vehemently denies that it affected their users in the mass wallet theft incident of 2023. They claim to have notified all affected users back in 2018 to migrate their assets, which is clearly a lie fabricated for PR purposes.

We previously disclosed the vulnerability in Trust Wallet for iOS from 2018. Any security issue related to Binance easily turns into FUD, which in turn triggers a knee-jerk reaction from Trust Wallet. It's actually normal for any software to have security vulnerabilities; what matters most is how they are handled properly.

Here is our previous disclosure post about the Trust Wallet iOS vulnerability: https://t.co/n1zdW1BYee

And here is Trust Wallet's announcement after the issue gained traction: https://t.co/xyFgDsUif8

After the last incident, I was quite disappointed with Trust Wallet's response and lost interest in following up on the case. However, whenever I see PR statements that I find obviously incorrect and illogical, I always feel uncomfortable and have to speak my mind. So I'm taking this opportunity to discuss some of these points, just to leave a record.

Trust Wallet mentioned that the number of affected users at the time was about 10,000 early adopters, and that they had notified each one and provided an asset migration plan. They claim no users suffered losses and all affected wallets have been deprecated.

In fact, this is highly counterintuitive. Trust Wallet was extremely popular in 2018, which led to its acquisition by Binance. In such a situation, notifying 10,000 users about a security issue with their wallets and getting them to migrate would have been a tricky affair. If they had really done it, it would have almost certainly made the news. My own first Trust Wallet address was also generated in 2018 and was drained in the July 2023 incident. I have no memory of ever receiving any notification. This user's situation is the same as mine: https://t.co/51EOg5XR7J

Trust Wallet mentioned that since July 2018, all new wallets created by Trust Wallet users are no longer affected by this vulnerability.

This is also patently false. How can you guarantee that every single one of those 10,000 users updated their software to the latest version? If someone downloaded the problematic version at the time and never updated the app, then all addresses created with that version of the wallet would be permanently insecure and vulnerable to theft.

Trust Wallet mentioned that the comprehensive evidence suggests the 2023 attacks did not originate from a Trust Wallet vulnerability, but were more likely caused by a combination of multiple sources. They state they have full confidence that the 2018 vulnerability was not the root cause of this incident.

This is a very clever, but highly inaccurate, turn of phrase. In reality, while the 2018 Trust Wallet vulnerability was not the *sole* root cause of all the wallets drained in July 2023, it was a major contributor. The reasons are as follows: real Trust Wallet users were affected; the affected addresses could be reproduced using Trust Wallet's code from that time; and the activity timeline of the affected wallets highly correlates with Trust Wallet's code commit history. We discussed this in more detail in our original disclosure article, so I won't repeat it here.

Trust Wallet mentioned that in addition to fixing the vulnerability, the founder of Trust Wallet proactively contacted affected users to provide them with a secure migration path, ensuring no users remained at risk. They also state that the relevant affected addresses have all been confirmed to no longer hold any balance.

The part about confirming the relevant addresses no longer hold a balance is the most ridiculous part, because these addresses were cleaned out in July 2023.

I am also a heavy Trust Wallet user. The theft from my first Trust Wallet address in July 2023 prompted me and my colleague @outoflegend to conduct an in-depth investigation.

However, what truly made me lose my "Trust" in it was Trust Wallet's subsequent response and handling of this vulnerability. I can partly understand, as every wallet provider wants to have a perfect security record. I sincerely hope Trust Wallet can do better, provide more evidence, and dispel the community's doubts.

I have deliberately not deleted my first Trust Wallet address; I just added "Rekt" to its name.

@cz_binance @heyibinance I have great respect for you. Were you also deceived by your team, or were you in on it too?

I hope they/you can provide any valid evidence that they notified 10,000 users to migrate.

[outoflegend @outoflegend]

@thekitze @comma_ai Haha, I turned it on.

[outoflegend @outoflegend]

Lateral control completed.
BMW accepts steering angle control, I think OpenPilot can handle a U turn😄 @comma_ai

[outoflegend @outoflegend]

@Jonesderbozz @pauliusdotpro @comma_ai Ah, these are codes defined by manufacturers, they let us refer to specific models and years.

[outoflegend @outoflegend]

@PravinKayCee @comma_ai Yes

[outoflegend @outoflegend]

@pauliusdotpro @comma_ai BMW SP2018 with 5AU (currently the MITM module requires the SAS module, though this may change in the future).
The video shows a 2020 G38(same as G30) LCI.

[outoflegend @outoflegend]

Many thanks to the author of this blog post @PD0WM , it was very inspiring: https://t.co/S6m5BLcqhd

[outoflegend @outoflegend]

Hello @comma_ai , BMW porting is on the way.
Use 2 cheap FlexRay transceivers and 1 Raspberry Pico2 to perform the MITM, it’s super low cost.

https://t.co/3NKrpY1XaU

[outoflegend @outoflegend]

@siddzzz @comma_ai @Raspberry_Pi @PD0WM Yes.
But for now, it relies on the stock ADAS module to obtain the frame template and replace specific values so OpenPilot can take over.

[outoflegend @outoflegend]

Hello @comma_ai , BMW porting is on the way.
Use 2 cheap FlexRay transceivers and 1 Raspberry Pico2 to perform the MITM, it’s super low cost.

https://t.co/3NKrpY1XaU

[outoflegend @outoflegend]

@EliBenSasson But how about latency?

[outoflegend @outoflegend]

grok field? p=808888888888888888888888888888
888888888888888888888888888888
888888888888811118888888118888
888888888111111111118811188888
888888811111188888881111888888
888888111188888888111111188888
888888111888888811188111188888
888888111888881118888811188888
888888111188888888888111888888
888888811188888888111111888888
888888111811111111111188888888
888811888881111111188888888888
888888888888888888888888888888
888888888888888888888888888881

[outoflegend @outoflegend]

Many MEV bots monitor addresses with compromised private keys, instantly draining ETH mistakenly sent to them. For example, Hardhat’s default mnemonic, "test test test test test test test test test test test junk", derives the address 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266.

With EIP-7702, anyone can set code for these addresses, effectively installing a hook. If ETH is sent to such an address, a fallback function can automatically redirect the funds to another address. For instance, this transaction (https://t.co/oezaTJRc27) demonstrates this behavior.

Check https://t.co/KAqZAGXmuC: the latest delegated address is 0x930FcC37d6042c79211EE18A02857Cb1Fd7F0D0b, which implements the fallback function.

The alarming part? Setting code for an address only requires a signature, included in the authorization_list of a type 0x04 transaction. This transaction’s to field can be any address, meaning there’s no direct on-chain interaction with the target address. You can’t easily detect if an address has been set with code by checking its transaction history.

Imagine this scenario: you create a new wallet, but its keys are accidentally leaked. Someone sets malicious code on your address. Later, when you receive ETH, the funds are automatically drained without your knowledge.

I urge wallet developers to implement a check using eth_getCode to alert users if their EOA has unexpected code, enhancing security against such risks.
@officer_secret @blockaid_ @elyx0

[outoflegend @outoflegend]

@DefiIgnas It's so simple to increase the gas limit, why wasn't it done before L2 was born?