Hacker News Reader

EatonZon Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

In this case, AI wasn't used for anything.

EatonZon Exploiting vulnerabilities in Johnson and Johnson web apps

Thank you for the laugh (:

EatonZon Hacking India's largest automaker: Tata Motors

TruffleHog: https://trufflesecurity.com/trufflehog

I worked for them a little bit and their product is really impressive and works great.

EatonZon Hacking India's largest automaker: Tata Motors

Appreciate the insight!

EatonZon Exploiting McDonald's APIs to hijack deliveries and order food for a penny

There are certainly more things I could have done to get more $/hour. I ultimately find these things enjoyable and help keep my skills sharp.

EatonZon Exploiting McDonald's APIs to hijack deliveries and order food for a penny

It would be nice to see rewards that scale with severity. Ultimately they did accomodate me by sending a gift card I can use instead of coupons I would likely have given away, so I appreciate that. Most companies don't offer me anything!

EatonZon Ask HN: Who wants to be hired? (March 2023)

Location: Florida, USA

Remote: Yes

Willing to relocate: No

Résumé/CV: https://eaton-works.com/resume/

Email: eaton@eaton-works.com

I am an experienced C# / .NET Windows desktop developer of more than 15 years with an interest in file systems, reverse-engineering, and security. Some of my recent security disclosures have been front-page news on major media outlets such as Automotive News[1] and TechCrunch[2].

Currently seeking new opportunities in the C# / .NET and/or security space.

Please see my website for a full catalog of my notable work: https://eaton-works.com/

[1] https://www.autonews.com/mobility-report/how-toyotas-supplie...

[2] https://techcrunch.com/2022/06/22/jacuzzi-flaws-admin-expose...

EatonZon How the Xbox 360 knows if your hard drive is genuine

I have just put up an Atom feed, more details: https://eaton-works.com/2023/01/28/syndication-feed-now-avai...

EatonZon How the Xbox 360 knows if your hard drive is genuine

https://i.imgur.com/AFZIA3p.png

It takes in the RSA signature, SHA data hash, and RSA key type. Key types are: XE_PIRS_RSA_KEY = 0x0, XE_LIVEDRM_RSA_KEY = 0x1, XE_DEVICE_RSA_KEY = 0x2 (this is the Sata verification key), XE_XSIGNER2_RSA_KEY = 0x3

It uses key type to load the corresponding public key from memory at static addresses, then verification takes place.

EatonZon How the Xbox 360 knows if your hard drive is genuine

Thank you for the kind words :D My contact info is here: https://eaton-works.com/contact/

EatonZon How the Xbox 360 knows if your hard drive is genuine

If anyone is interested in RSS you can subscribe here to be notified when it's available (I will post about it): https://eaton-works.com/subscribe

You can then unsubscribe & that will delete your email from my list, if you prefer RSS over emails.

EatonZon How the Xbox 360 knows if your hard drive is genuine

Glad everyone enjoyed the writeup! I have several more interesting writeups planned, including a significant hack disclosure (not Xbox/gaming related), so keep an eye out (:

EatonZon How the Xbox 360 knows if your hard drive is genuine

It's a 2048-bit key. If it was 1024 maybe it could eventually be cracked? With 2048, I don't think it will be.

EatonZon How the Xbox 360 knows if your hard drive is genuine

There are "transfer flags" on content items that control whether they could be copied/moved.

EatonZon How the Xbox 360 knows if your hard drive is genuine

Microsoft also knows if you have USBs connected to your console (: If any are connected, it will report back the sizes.

EatonZon How the Xbox 360 knows if your hard drive is genuine

The key is inside of the hypervisor. Not changeable if you want to retain your unmodded status.

EatonZon How the Xbox 360 knows if your hard drive is genuine

I have received other requests for this. I thought about it when I redesigned the site, but didn't think people really used RSS that much anymore. I have it on my list to implement (:

EatonZon How Microsoft attempted to make the Xbox 360 dashboard load faster

I've added it to the to-do list, but I would not be surprised if it's inaccessible. The HTTP request to download it has console ID as a header.

EatonZon How Microsoft attempted to make the Xbox 360 dashboard load faster

Craziness is one way to define it (:

And it is still valid!

EatonZon How Microsoft attempted to make the Xbox 360 dashboard load faster

The dash is one of the last things loaded on the nand. At that point all the critical stuff has been loaded. They also had to compress the dash for storage on the nand, or else the file system would have went beyond capacity.

EatonZon IBM Plex Typeface (2018)

I recently redesigned my site using the IBM Plex font, if anyone wants to see how it looks in-use: https://eaton-works.com/

EatonZon Cloudflare announces fourth quarter and fiscal year 2021 financial results

They added an "Export" button a while ago, so you can now download the original image.

EatonZon Cloudflare launches Workers Unbound, next evolution of its serverless platform

Been waiting for .dev too. Haven't been able to get any info from them as to when it will be supported ):

EatonZon Porting my website to Workers Sites and Zola

As a workaround maybe you could, behind the scenes, split large files into 2 (or more) key-value pairs, and then bill appropriately for the use of 2 key-value pairs instead of just 1.

EatonZon Porting my website to Workers Sites and Zola

Building a non-prod Angular project produces a 7 MB js file, so the 2 MB limit definitely needs to be raised. I think it would make sense to have a higher limit for certain file types, like js and html.

I am very interested in this feature, but the limit is a bit concerning right now.

EatonZon Stripe Billing

Looks like a nice improvement. There's some very bizzare design decisions with Subscriptions, so hopefully this will start making things more flexible.

EatonZon Key iPhone Source Code Gets Posted Online

Probably, still spooky to see that there!

EatonZon Key iPhone Source Code Gets Posted Online

Interesting: https://github.com/h1x0rz3r0/iBoot/blob/master/apps/iBoot/bo...

EatonZon Reverse engineering and removing Pokémon GO’s certificate pinning

Things are stabilizing, was not expecting the article to get this many hits!

EatonZon Reverse engineering and removing Pokémon GO’s certificate pinning

Definitely not my intention. )-: Embeds will be gone soon.