MonkeHacks #76

Welcome back to MonkeHacks. I took a much-needed break for two weeks or so. Right now, I’m in Japan on a holiday. I visited my friend in Austria on August 24, flew to Japan on Aug 26, and spent a few days in Tokyo and Hakone. In Tokyo, I took a day out to Yokohama to have yakiniku with my friends mokusou, kodai, hakupiku and Mike (sorry Mike, I don’t have your handle…). Hakone is amazing. They have sulfuric volcanic vents there that you can view by cable car, and on clear days you can see Mt. Fuji. The entire area is a hot spring resort, because the volcanic activity in the area supports the hot springs (onsen). I saw Yuji (who works for CTBB) near Hamamatsu and we had a quick catch-up. In Kyoto, I visited a ton of temples and had some amazing sushi. I’m back in Tokyo now, en-route to Sendai to visit my relatives. I went bouldering with Kodai and Sou yesterday, and I stayed up late to see the total lunar eclipse from Tokyo. So, all in all, it’s been a hell of a few weeks.

Weekly Ideas / Notes 

• For once, it was nice not to think about hacking at all for a few weeks. Of course, I got the itch to work again when I was hanging out with Mokusou and those guys, but stepping away from hacking entirely for a little while has given me some clarity on just how much infosec dominates my life. This isn’t necessarily a bad thing, but rather an observation. I’m really looking forward to stepping back into hacking in the next few days; I have a LHE in Mexico in early October with Google, and I want to do some in-depth reading on LLMs in preparation for HackAICon in Lisbon from September 24-26.

• On Wednesday, I fly back to Edinburgh via Abu Dhabi and London. I’m looking forward to returning to my routine again and getting my life and work back on track. Hopefully, I’ll have some more things to write about as I get back to security work.

• In the next week I’ll publish an article I’ve been working on that details how I travel, and why I advocate for travelling lightly. I’m looking forward to sharing it with you all!

• On an unrelated note, I did not realise just how great saunas and cold baths are for muscle recovery. I’m strongly considering getting a membership for one back in Edinburgh.

Reading List

• Currently:

  • Fiction:

    • Solenoid by Mircea Cărtărescu (130/600 pages)

    • Guards! Guards! by Terry Pratchett

  • Non-Fiction:

    • A Random Walk Down Wall Street by Burton Malkiel (150/300 pages)

    • How The World Made The West by Josephine Crawley Quinn (100/400 pages)

• Next on the list:

  • Fiction: Mort by Terry Pratchett

  • Non-Fiction: Day Zero to Zero Day by Eugene Lim (SpaceRaccoon)

Resources

• Phrack 72: The timeless Phrack magazine publishes another issue. If you’re in security for the love of it, then Phrack should be something you follow very closely.

  • In particular, I found The Art of PHP - My CTF Journey and Untold Stories! to be very interesting, as it’s written by one of my heroes, Orange Tsai. Getting a glimpse into such a brilliant mind is a privilege.

• We Hacked Burger King: How Authentication Bypass Led to Drive-Thru Audio Surveillance: This was depressing to read in the sense that you really feel that the world is built on a very flimsy foundation.

• Remote code execution though vulnerability in Facebook Messenger for Windows: A pretty succint exploit with a giant bounty.

• Secondary Context Path Traversal in Omnissa Workspace ONE UEM: More fantastic research from the Assetnote/Searchlight team. I almost feel sorry for the vendors at this point.