I am absolutely delighted to share that I'll be giving a talk at Reversim Summit 2025 on breaking Pokémon Go's anti-cheating mechanism! On a personal note, every time I visit Reversim, it shows me just how awesome, welcoming, and genuinely interesting community-driven events can be.

Breaking 'Em All! The blog posts going deeper into hacking Pokemon Go that accompany my #DEFCON talk are live on my blog! taltechtreks.com/2024/04/06/H... taltechtreks.com/2025/08/09/H... Happy to get questions on the research!

Talking in an hour at #DEFCON about Pokemon Go on track 3. Couldn't be more excited! I've worked on it multiple nights in the past months, and I hope you'll enjoy it! If you're not here in person, you can catch the talk live at www.youtube.com/live/fzbrrKP... or www.twitch.tv/defcon_dctv_...

Giving a talk on Pokemon Go, I just had to convert myself to a Pokemon trainer. The amazing Ryan Rockenbaugh surprised me with a limited edition sticker of Trainer Tal Sticker wall at #DEFCON got 2, and I will be giving what's left tomorrow at my talk Breaking 'Em All! 11:30 Track 3. See you!

Excited and humbled to speak once again in DEF CON. Talk is on Saturday at 11:30, track 3. I'll be in the conf till Sunday, hit me up if you want to chat over the talk or any other project.

The #DEFCON 33 schedule is live and I'm excited to announce I'll be giving a talk this year on unique research I was a part of a few years back! "Breakin 'Em All – Overcoming Pokémon Go's Anti-Cheat Mechanism" Join me on stage - Sat, 11:30 AM, Track 3 defcon.org/html/defcon-...

Looks like I'll be at Hacker Summer Camp this year! Exciting #DEFCON33 ☺

Just got back from #AppSecIL2025! Ended up 4th place in the #CTF 🎉 Solved 12/15 challenges alone - Android pwn, JS sandbox escapes, cache poisoning, XSS bypasses. The usual suspects: SQLi, LDAP injection, XXE. Had a blast! Looking forward to the next one. Writeup: taltechtreks.com/2025/06/04/a...

I'm building something cute and new, but as opposed to my normal ways, this time I'm using #Cursor heavily and the flow blows my mind. Although I'm certain that without prior good knowledge of coding it wouldn't work that well.

Ah, I wondered when this was due to come out. Can't wait to experiment! www.anthropic.com/news/integra...

Excited to present my research tomorrow at #RSAC! Come by to hear John and me share conclusions and insights on the first publicly available report on Non-Human identity security! See you there, May 1, 10:50 am at Moscone West 3004!

For today, a bit Friends content! Or, uhh, actually, computer science! What’s the largest sofa you can pivot around a corner? Heard about this problem in the past, but I thought it's one of those we will never be able to prove. (At least until quantum computers arrive to solve some NP problems)

Took a bit of hiatus from posting here, was quite busy the past few months (CFP season amiright…) But I do have more cool stuff ready for sharing as well as writing 2 blog posts about projects I worked on lately. Looking forward to sharing with you all

Great time presenting OWASP NHI Top 10 at #SnowFROC! If you're here, come say hi!

Well, that was an hour of my life well spent. An amazing adaptation of minesweeper to include old-school RPG elements. UPDATE: Had to go back and play, another 4 hours to achieve a perfect clear. Incredible game!

Great thread on the emerging new details on the ByBit breach

A cute post showcasing the basis of every website - HTML! The site goes over (almost) all HTML tags, by using them. Seeing this, it’s unfortunate that text inputs in websites don't allow most tags but rather encapsulate how the final result is displayed for users. Give us more, please!

Managed to squeeze in 2 talk submissions to #fwd:cloudsec just before the first round CFP closes. Hoping for good news, will be the perfect reason to finally attend in person!

Check out this wild project: #Steam #Brick. The author transformed the Steam Deck to a brick that still connects to screens or VR while reducing size by a third Projects like this (author used steam-provided data) are a great example of "right-to-own", critical to enhance electronics sustainability

#OAuth #phishing apps are coming to get you - now on #X! It's annoying to see yet another case of how easy it is to fake consent screens that look identical to real companies. Why we still lack mandatory verification processes for new OAuth apps is beyond me. x.com/thealexbanks...

#OIDC identity providers in #AWS have been getting more attention lately and rightfully so: It’s unfortunately surprisingly easy (and common) to create misconfiguration within the necessary conditions on OIDC-based #IAM roles trust policy.

So, #OAuth implementations seem to always have some edge case or quirk making it vulnerable in odd ways. This particular exploit leveraged an open redirect in an app's OAuth callback, combined with #Google OAuth's quirks to steal authorization codes on visiting a malicious website.

#DeepSeek roasts me based on my #UserAgent: Your browser history is so bare even your referrer ghosted you, your 2560x1440 screen is just compensating for how bland Firefox 134 on Windows 10 is, and 16 CPU cores in Tel Aviv? Congrats, you’re the NPC overclocking spreadsheets in the Silicon Wadi.

Cute bit of #internet history, this post shows why #Git gives you 0.1 seconds to decide if it runs a fixed command. Turns out, backwards compatibility in code is hard, especially if the code is distributed widely, and can lead to these kind of funny instances (and other that can cause real damage)

I love #hacking #embedded systems, and also #gaming when time permits. Imagine my delight seeing a post that blends both! Two decades after its release, someone revisits the idea of “just” using the original #Xbox CPU's #JTAG connector to debug it.

The Dead Internet Theory is just a meme, right? Well…something strange happens over at PhysicsForums. Once an active forum for physics students, now a quieter place. A year ago, posts appeared, made by users long after their last login. LLM-generated replies back-inserted into the DB Must read!

Still surprised with how people use LLMs for cool stuff. This one uses o1 and makes it play Codenames with itself. If you played it, you know it's tricky to give good hints, and o1 crushed it. Wonder how it works when not playing itself. If I played someone with my brain, the game would be easy :)

The #GPT #o1 model was very exciting initially, but I completely stopped using it. The long wait and the laziness of my prompts made the chat-based models much better. This post explains how to interact with o1. In short - it comes down to good #prompts so o1 one-shots the response.

Honey, wake up - #clickjacking is back. A decade ago, #clickjacking was the hot new #attack—tricking users into clicking invisible #frames layered over legit websites, unknowingly performing actions on their social media, corporate accounts, or even banks. 1/3

#Hacker #News today: Well-written piece about a paper on #E2EE (end-to-end encryption) when it comes #AI. AI circled us back to the old problem: devices are too weak to handle computations, so we offload them to more powerful systems—essentially handing most sensitive data over to big data. (1/5)

#Hacker #News daily: A month with Devin – an interesting log from a team that put one of the most hyped startups to the test. The conclusion? Potential is definitely there, but it’s still wrestling with similar challenges ML algos suffered from in the past - mostly the need to manually verify work.

This provides important insights 💡 CA policies cannot block anything until AFTER authentication occurs This means CA cannot help with password spray/credential stuffing. This is why we have Password Protection and Smart Lockout. learn.microsoft.com/... learn.microsoft.com/...

This old post from 2006 jumped on my feed and I recalled reading it back then, I wasn't too familiar with binary search, but was still shocked a simple #overflow bug was so prevalent. 20 years later, I totally see how generative #AI might cause thousands more of these issues to continuously pop up

Oh boy, Sam Curry comes again with yet another critical #vulnerability, now in Subaru vehicles, basically allowing full remote control over the cars. #Automotive security is no joke, but manufacturer's still live by security standards from the beginning of the century. samcurry.net/hacking-subaru

Got secrets? An API? Tokens? Or a fancy new AI bot? The OWASP NHI Project team just dropped the Non-Human Identities Top 10 Project, breaking down the biggest risks + how to secure them. :closed_lock_with_key: Check it out here: https://t.co/wmUD9x9sJO

#Hacker #News daily: Sometimes, you read amazing things online and just go with: What. This is one of these things. Apparently, it's entirely feasible for build a functional CPU using...regex? This madman has built it, and an entire chess engine on top of it. Simply incredible.

Excited to introduce the #OWASP Non-Human Identities Top 10 for 2025! 🚀 What risks do devs face using non-human identities? I tackled this together with other experts to shine light on this emerging issue. Check out the project's page for a sneak peek, or click on top to dive deeper into the risks

#Hacker #News daily: these 24 fun facts about SQLite, the most used database engine today. My favorites? #7/8 - It's not easy to contribute code to SQLite. #14 - Reading/writing blobs with SQLite can be faster than `fread` #19 - The reason why the prefix for temp files is `sqlite_` backwards

Back with some #Hacker #News. This time - some theory! I really like clustering algorithms. They tend to make order into data that can be really confusing. This blog explores a very important theorem from 2002 - showing no clustering algorithm can essentially fulfill all we want from it. (1/3)

Been a while since I've read some papers. My #LLM based monitoring pinged this paper on solutions for distributed cloud. Here's my review. #CompSky Token-based identity management in the distributed cloud A short article proposing a method for #IAM on #distributed #cloud environments. (1/5)

I love the annual tradition of @lorenzofb.bsky.social @zackwhittaker.bsky.social and @carlypage.bsky.social highlighting the best cybersecurity stories (and, in quite a few cases, thorough investigations) that other people wrote techcrunch.com/2024/12/24/t...

#Hacker #News daily: a directory for hosting verified SSH keys to email mapping. Might currently be a little niche, but I think that a wide adoption of this could ease both user management for SSH servers, and for CLI applications.

#Hacker #News Daily: This time, turns out the internet is full of wrong bi-directional BFS implementations! This exceptional blog post covers the issue from the very beginning. Definitely worth reading! zdimension.fr/everyone-get... (1/4)

Today, rspack, a rust-based tool that helps speed up the process of preparing code for websites and apps, has announced a compromise to two of their packages - rspack/core and rspack/cli. github.com/web-infra-de...

Back with some #Hacker #News daily: Github repos similarity map based on starring users. Data is beautiful. And when there's a lot of it - it's interesting how we still make it work (cloud!) One point of interest is that you can use this to find who's similar to you based on the stars metric.

It's over - I completed #Hacking #Google CTF! The last challenge is nice finale to the saga, which was a perfect mix between difficult and unique #cybersecurity concepts. I'm happy I chose to post about it. Wasn't easy, but it improved my confidence in writing. More on this and challenge write-up

Today's an exciting day...A bit different than my usual posting, but I'm happy to say that we've raised $45M for our series B! 🎉 Astrix was my home for the past 3 years, and it has been nothing less of a great time. More to come! (Soon back with the usual tech stuff :))

Today in my #Hacker #News feed: Holy crap. Sometimes web research is like magic, all you need is a foot in the door. Also, how do you screw up authorization so bad? As a last note, it's unbelievable that EA doesn't have a bug bounty program. Wtf battleda.sh/blog/ea-acco...

Is #IAM really the worst? I recently came across this blog post by Mathew Duggan, titled "IAM is the Worst." It reviews a big issue in managing identities in the IAM system in cloud environments: the permissions themselves. matduggan.com/iam-is-the-w... (1/7)

Having no time for #HackerNews today, here's something else: I built an automation that parses daily feed of arXiv papers with cs.CR/CC tags with an LLM to only forward things it deems I will be interested in. So far I collected a some interesting papers on #cybersecurity topics. Here's the first: