Security Hacks

1599 Articles

This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster

September 4, 2026 by 18 Comments

The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities.

CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication is required for exploitation, if the vulnerability exposes confidential data, and other criteria. A CVSS of 10 is as bad as it gets, and having three of them at once is certainly attention-getting. Of the three vulnerabilities fixed, one allowed unauthenticated modification of data in the hosted instance, a second allowed arbitrary code execution via the GraphQL interface, and the third allowed arbitrary SQL commands that could modify the database.

ServiceNow claims Adobe, Lenovo, Fedex, and Fujitsu among their high-profile customers. With luck, the vulnerabilities were patched before significant public exploitation could happen.

Router Malware

Previously in 2026 the US Government warned against embedded malware found in consumer routers, which may be linked to the FCC enacting bans against certification and import of foreign-made consumer devices. This week, the NVD (National Vulnerability Database) reported specific embedded malware in the Zbtlink and MoreQuick brands of devices.

Multiple versions of the firmware, for multiple lines of products, contain a backdoor service that uses unencrypted UDP to connect to a command and control (C2) service. The service, or anyone able to intercept the network traffic, since it’s unencrypted, can execute commands as root, allowing them to change configurations, open tunnels, or steal ISP credentials.

The malware is baked into the firmware, so removing it is impossible for most users: a factory reset wouldn’t do. In theory if third-party firmware like OpenWRT supports these devices, the hardware could be made safer with a custom install.

Given how commonly the same device is marketed under dozens of names, likely the same devices and firmware have yet to be identified under other brands. Continue reading “This Week In Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, And AI Makes Things Worse, Faster” →

A small rocket is shown launching into the sky, with a trail of smoke leading into the mount of a black pipe. Four large plastic pieces are falling away from below the rocket.

Tube Launch Boosts Rocket’s Performance

September 3, 2026 by 19 Comments

If you want improve a model rocket’s performance, all the common options come with serious trade-offs: you could increase the motor’s size, which raises safety issues, or you could cut down on weight, which limits the possible payload. [Con Hathy] was therefore intrigued by the design of the Arcas sounding rockets, which with the aid of a gas-fed launch tube could reach an altitude of 100 km. Even in models without a gas generator, a launch tube apparently boosted performance, an effect which [Con] was able to replicate in a much smaller model rocket.

In theory, as the rocket engine fires, it should pressurize the tube behind the rocket, providing an extra boost out of the tube. To test this, [Con] 3D printed a test rocket, launched it both from a standard rail and from a tube, and compared the results. During tube launches, a printed sabot fit around the rocket and formed a seal with the launch tube. The results were surprising: the tube-launched rocket actually performed substantially worse than a rail launch. After building a simulation, [Con] found that, as the rocket moves down the tube, the volume of tube it needs to back-fill with gas increases faster than the engine puts out exhaust; it was pulling a slight vacuum behind it, slowing itself down.

To solve this, [Con] decreased the diameter of the launch tube. To let the rocket fit into the tube, he also modified it to use pop-out stabilizer fins which wrap around the rocket while in the tube. The sabot was also shrunk, and had foam added to improve the seal between it and the rocket. For this second test, [Con] also connected a pressure sensor to the base of the launch tube. The results on the second launch were much better: according to an altimeter, it managed to fly 72% higher. Based on the pressure sensor’s data, a longer tube could have squeezed out still more performance, but this still demonstrated the principle quite well.

We’ve seen a tube-launched rocket before, though not with such a performance focus.

Continue reading “Tube Launch Boosts Rocket’s Performance” →

This Week In Security: Android Malware, VOIP Hijack, Signal Contact Discovery, And TeamPCP Arrests

August 28, 2026 by 4 Comments

On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices. Continue reading “This Week In Security: Android Malware, VOIP Hijack, Signal Contact Discovery, And TeamPCP Arrests” →

This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement

August 21, 2026 by 20 Comments

Apple has started sending some users push notifications warning that they have been targeted with specific malware. No specific information about the threat Apple detected is available. While multiple iOS attacks were released in spring of 2026, they all target much older versions of iOS and older hardware versions.

Users in 110 countries have received notifications recently, warning them they may have been targeted or already impacted by malware such. Apple typically uses the crash reporting mechanism for system apps to track new attack trends. The majority of users will likely never see an alert from Apple because malware with state-level capabilities like the Pegasus family is extremely expensive to develop. However, commercial availability means that some governments have deployed them against political opponents, protesters, human rights lawyers, and journalists.

If Apple pushes a security alert, it will show up as an email and a standard system notification, but also as a notification inside the Settings application. While email and notifications can be spoofed as part of phishing attempts, to date there is nothing which can generate false alerts inside Settings.

Almost universally in these cases, Apple recommends enabling “Lockdown Mode“, which adds extra protection to devices at the cost of decreased battery life and slower performance. Lockdown mode disables custom fonts on web pages, accelerated JavaScript, restricts message attachments over SMS and iMessage, and disables other common paths used by malware to steal data. Android devices offer a similar feature since Android 15 that is less comprehensive but can still provide additional safeguards for users directly at risk.

Attacking Airplane Networks

With research that will surely result in some breathless reports, researchers presented at Usenix 2026 an attack against the communications bus of a Boeing 737.

The ARINC 429 bus is a communications architecture for planes, similar to the CAN bus used in cars. Once you are connected to that bus, it can be vulnerable in the same ways cars can be vulnerable to data manipulation. In the Usenix paper, researchers discovered that one access port to the airplane communications system is easily reached from the outside of the plane, though “easily” in this context means “by airplane maintenance technicians”. The paper represents over a decade of work by the team in obtaining and building a test lab of avionics equipment to represent an actual airplane, culminating in an embedded device described as “the size of a quarter” that plugs into the communications port and provides remote access over WiFi.

It needs to be emphasized, given other recent news, that this is a piece of hardware being added to the plane which communicates over WiFi, and not a way to attack an unmodified plane via passenger WiFi!

Once part of the ARINC bus, it seems access is basically unfettered: the team describes being able to reprogram the autopilot, feed the pilot displays false data, and being able to modify the temperature and weight data shown, which could lead to miscalculations in take-off speeds with obviously catastrophic results. Fortunately, the researchers have also been working with Boeing since 2020 to address the issues being found, and the practicality of the attack in the wild remains largely theoretical. The research team has recommended removing the external ports in future aircraft, and blocking access to them physically, like with epoxy, in the current designs.

If reading security research papers is your kind of fun, be sure to check out the rest of the papers that were part of Usenix 2026.

Continue reading “This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement” →

Researchers Hack An Airline Analog

August 16, 2026 by 24 Comments

Modern airliners are rather complicated feats of engineering. Innumerable safety-critical components are connected with tens of miles of wiring, complex digital buses, and dozens (perhaps hundreds) of computers. But, as hackers, we know that any computer can be hacked and, of course, aircraft avionics are no different. 

Modern aircraft typically use the ARINC 429 protocol. This differs from many protocols we see where multiple transmitters are allowed. ARINC 429 has a single transmission source. This makes a transmission-override attack hypothetically difficult, as an attacker was thought to need to physically replace a legitimate transmitter (like a flight management computer), a rather daunting task. However, the ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so by transmitting on the same line, an attack device can simply override the legitimate transmitter’s power.

Continue reading “Researchers Hack An Airline Analog” →

This Week In Security: BugTraq, AI Hacks, And Being Dumb On Planes

August 14, 2026 by 17 Comments

After a multi-year hiatus, the venerable BugTraq mailing list is back!

For decades, BugTraq was the place where vulnerabilities were disclosed, from the early days when nearly all vendors viewed all security research as a hostile force, through to the modern era of working with vendors to coordinate disclosing bugs. With the rise of bug bounty programs and other social changes, the mailing list slowly died: what started in 1993 ended in 2021 is returning. The new maintainer, Jonathan Brossard, says in his announcement “The mission is unchanged: full disclosure, researcher-first, no corporate filter.”

Don’t Be Dumb on Planes

In the unlikely event anyone here needs to be told: Don’t do dumb things on planes.

It seems that someone coming home from from the DEF CON hacker conference in Las Vegas decided to mess with the in-plane WiFi, and is likely now in the “find out” phase of doing something dumb. There hasn’t been any public followup beyond the original reports: a passenger on a Delta flight leaving Las Vegas brought up a fake WiFi hotspot named “Delta WiFi FAST” to trick other passengers into connecting, and attempted to disable the in-flight WiFi using a denial of service attack.

Continue reading “This Week In Security: BugTraq, AI Hacks, And Being Dumb On Planes” →

Hacking Fiber To The Home

August 13, 2026 by 43 Comments

When we think about security threats, we generally imagine them coming from far away across the wider internet. But what if the connection between you and your ISP was the target? [Rithwik Jayasimha] and [Rithvik Vibhu] have explored how fiber to the home connections may not be as secure as you would hope.

The hack centers around fiber-to-the-home connections, of which many deployments rely on Gigabit Passive Optical Network (GPON) standards. The key there is the “passive” part—these networks don’t rely on active components to switch signals. ISPs run central trunk lines out to optical line terminals (OLT), with passive splitters installed in neighborhoods to serve a number of downstream subscribers. Each subscriber then has something called an Optical Network Unit (ONU) in their home, which filters out the traffic intended for that specific subscriber.

Therein lies the flaw, though. Light (and thus, data) for many subscribers flows into the home, and it’s only the ONU that is filtering that out. Hack the ONU, or replace it… and you have access to downstream traffic from your neighbors that you shouldn’t be able to access.

The duo were able to hack an ONU to forward every single frame it receives, revealing downstream data intended for other homes in their immediate neighborhood. A great deal of traffic is encrypted these days, which provides a layer of safety, but it is by no means an ideal situation that such a hack is possible at all. They also explored other threats, such as installing splitters in publicly-accessible infrastructure, and compromising an upstream OLT and using it to flash firmware to other subscriber’s ONUs on the network. All this was presented in a talk at DEF CON, too, which can be viewed online.

It’s a concerning look at an often unconsidered link in the network chain. Few of us expect our data to be snooped upon in between us and the ISP, after all.

Continue reading “Hacking Fiber To The Home” →