Balazs Bucsay [EQ]

Never trade liberty for security. One is a right, the other is a myth.
My tweets are my own.

[Balazs Bucsay [EQ] @xoreipeip]

@mdisec I can! ;) feel free to tag me and @mantrainfosec

[Balazs Bucsay [EQ] @xoreipeip]

@irsdl 60%

[Balazs Bucsay [EQ] @xoreipeip]

@Tesco Tesco Extra @ New Malden is a disgrace. They don't care about families nor infants. Manager seems to be on holiday, staff is rude and non-caring. Thanks but no thanks. Just lost a customer, well four.

[Balazs Bucsay [EQ] @xoreipeip]

RT @irsdl: The https://t.co/OpFfwtJCLm post by @xorxoreip shows how prepared statements can be exploited in NodeJS using mysql and mysql2 p…

[Balazs Bucsay [EQ] @xoreipeip]

New blogpost: Prepared Statements? Prepared to Be Vulnerable.
An interesting take on how vulnerable configurations can be exploited.
https://t.co/uZPpXOUeF8

[OWASP London @OWASPLondon]

Many thanks to @xoreipeip for presenting his talk "Server-Side Cross-Site Scripting" #XSS at the #OWASPLondon Chapter meetup last week!

The video recording of the talk is now available to watch on our YouTube channel 📺 [PLEASE SUBSCRIBE!]:
👇
https://t.co/kJSZXsOjdG

[Balazs Bucsay [EQ] @xoreipeip]

I hope the presentation was more attractive than this picture of me!

[OWASP London @OWASPLondon]

Our July meetup has started! We have @xoreipeip on stage right now speaking about Server-Side Cross-Site-Scripting.

Watch the live-stream 📺 here:
👇
https://t.co/ENiEQV0W6r

[Balazs Bucsay [EQ] @xoreipeip]

Put together a short blog post detailing a small Ghidra related fix I recently hacked together. Might save others some time.

[Mantra Information Security @MantraInfoSec]

NEW BLOG POST: Automated Function ID Database Generation in Ghidra on Windows - https://t.co/JZ85AUtdoJ

[OWASP London @OWASPLondon]

The next OWASP London Chapter in-person Meetup will take place on Thursday 17th July 2025 kindly hosted by Civo Tech Junction and kindly sponsored by @BlackDuck_SW

Talks from @xoreipeip and Matthew Brady
- Register to attend here:
👇

https://t.co/lziG3WzE0f

[Balazs Bucsay [EQ] @xoreipeip]

I've written a free book to help non-technical readers understand and avoid scams.
It's designed for friends, grandmas, moms&pops. Anyone who might be vulnerable to online or phone scams. Please help spread the word and protect your loved ones.
LINK: https://t.co/BBfKhwlb2R

[/ˈziːf-kɒn/ @x33fcon]

#Workshop "Defeating #Encryption By Using Unicorn Engine" at #x33fcon by @xoreipeip - #reverseEngineering #hardwareHacking #red

[Lukasz Olejnik @lukOlejnik]

Meta and Russian Yandex engaged in unprecedented internet tracking practices, likely illegal with EU data protection law. Companies designed tracking systems that exploited Android's localhost socket permissions to create covert communication channels between websites and native mobile apps, bypassing Android's app sandboxing protections. Android allows any app with internet permission to listen on localhost ports without user consent, and web browsers can access these localhost interfaces. When users visit websites containing Meta Pixel or Yandex Metrica scripts, the JavaScript tracking code sends data directly to specific localhost ports (Meta uses UDP ports 12580-12585 via WebRTC, Yandex uses TCP ports 29009-30103 via HTTP). Facebook, Instagram, and Yandex apps run background services that actively listen on these predetermined ports to receive tracking data, then link this anonymous web activity to authenticated user accounts and transmit the combined data to company servers.

This technique affects billions of Android users and renders privacy protections like incognito mode, VPNs, and cookie clearing completely ineffective. Meta Pixel attempted localhost communications on over 17,000 of the top 100,000 websites, with 78% doing so without user consent. The method allows comprehensive profile building linking anonymous browsing to real identities, tracking everything from shopping to sensitive site visits. It also creates vulnerabilities where malicious apps could eavesdrop on browsing history by listening on the same localhost ports.

This surveillance operated without disclosure. Following public disclosure, Meta immediately ceased the practice and removed related code while browser vendors scrambled to implement protections.

The practice violates multiple GDPR and ePrivacy principles. The technique transforms supposedly anonymous first-party cookies into cross-site tracking identifiers without explicit consent, violating ePrivacy Directive requirements for cookie consent and GDPR's lawful basis for processing. By secretly linking web browsing to app-based identities, it constitutes undisclosed profiling that undermines user expectations and data minimization principles. This is a material for max #GDPR fine. https://t.co/ktHWwllWr4

[DC4420 @DC4420]

We've got two talks tomorrow evening at the Greene Man! @xoreipeip is talking about Cisco phones, and Nick Dunn https://t.co/14XyQwrk9b will explain SOSL injection #defcon #london

[/ˈziːf-kɒn/ @x33fcon]

🚀 #x33fcon 2025 Onsite Workshop! 🚀

Join @xoreipeip to master software reverse-engineering with Unicorn Engine! Learn to dynamically execute and analyze code to crack encryption and obfuscation in binaries using Python and Ghidra. Perfect for #malwareanalysis, #vulnerabilityresearch, and #embeddeddevice hacking.

Details: https://t.co/UfBRtzpXDF

[BSides Birmingham (UK) @BrumBsides]

🎤 Speaker Announcement 🎤

We’re excited to welcome @xoreipeip to the stage!

His talk?

“Is Your Phone Spying on You? An In-Depth Analysis of Vulnerabilities in Cisco VoIP Phones”

Don’t miss this deep dive into device-level security.

#BSidesBirmingham #BSides

[BSides Exeter @BSidesExeter]

Please welcome Balazs Bucsay with their talk on 'Is Your Phone Spying on You?'

Sponsored by Optimising IT | B Corp™, CyberCX, Cydea and Orange Cyberdefense.
Grab your ticket today https://t.co/I0DdHrcHpi

#oooarrcyber

[Hacktivity @hacktivityconf]

🔔 Hacktivity 2025 is calling—for papers, sponsors… you name it! 🎤💡 Want to speak, support, or engage? Now’s the time!📢 Be part of the community → Get in touch! https://t.co/XeRvsoiOX0
#Hacktivity2025 #CFP #CFS #Infosec #CyberSecurity

[Security BSides Prague @bsidesprg]

We’re thrilled to welcome Balazs Bucsay (@xoreipeip), Founder & CEO at Mantra Information Security, as a speaker at BSides Prague 2025. 🎤💻

#bsides #cybersecurity #conference #community #workshop

[Balazs Bucsay [EQ] @xoreipeip]

See you there!

[Mantra Information Security @MantraInfoSec]

Next stop: Prague, Czech Republic! Join us at our Unicorn Workshop at BSides Prague - solve our challenges and win a couple of pints! 🍻 @bsidesprg #bsidesprg #bsidesprague

[Balazs Bucsay [EQ] @xoreipeip]

Why would I use this after the free trial or over the quota? I'd rather pay for something decent than something annoying and unreliable.

[Balazs Bucsay [EQ] @xoreipeip]

Oracle cloud is a crime. You log in and the session times out after a while. You try to log in again, and when you log in, it logs you out. You log in again, but redirects you to a broken page. Log in again and finally work. 1/2

[Balazs Bucsay [EQ] @xoreipeip]

VM created. It runs, it works. SSH is available. 4hours later, the port is open, SSH is not working anymore. OCI used to reboot the machine, which gets stuck in the "stopping" state for hours. Wtf? 2/2