Include Security Blog

Hey HN, we're IncludeSec. We've done thousands of assessmnts for hundreds of clients and are well on our way to replacing all of the legacy lower-quality junior heavy appsec consulting teams doing work in Silicon valley and the rest of the US tech sector...and we're continuing to growing quickly! (but we wont get too big, we like smaller company vibes) We're currently looking for these roles: 1) (US Only) An application security expert who isn't afraid of the management side of things to join our rapidly expanding team as a Managing Consultant perhaps you're a people manager, or don't mind talking to clients and can help our sales team out with the tech side of things? 2) (EU, South Am, North Am) An application security hacker who wants to hack on a ton of apps for small and big tech companies and even loves security research too perhaps! https://old.reddit.com/r/netsec/comments/mi5lrc/rnetsecs_q2_2021_infor… Looking forward to hearing from you HN! -Erik Cabetas- Founder, IncludeSec <my first name>@IncludeSecurity.com http://blog.includesecurity.com

This is an excellent tool to have as a security consultant, and it just keeps getting better and better. When approaching a large codebase, it enables you to write custom rules that match on certain antipatterns you've spotted that may be unique to the codebase. That's the real value of the tool, but the repository of per-language rules is also convenient for quickly finding low-hanging fruit (like every use of a potentially injectable function such as exec,system,etc. in PHP). For example, a webapp may have been designed such that authorisation needs to be explicitly added with a line or two to each controller. A semgrep rule can be written to match all the controllers which are missing this line. Then these controllers can be manually reviewed to assess whether unauthorised access should be allowed. Depending on what you are trying to match, this is something that may be very complex or even impossible to implement accurately in plain grep. Some languages like Ruby have powerful static analysis tools (Brakeman) that can also do this, but the benefit of Semgrep is the flexibility across multiple languages and how readable the rulesets are. [1] [1] https://blog.includesecurity.com/2021/01/custom-static-analysis-rules-…

From a previous HN discussion, these are known DNS addresses to block in regards to Smart TVs being used a residential proxies: https://news.ycombinator.com/item?id=48422993 Specific Domains: proxyjs.brdtnet.com proxyjs.luminatinet.com proxyjs.bright-sdk.com clientsdk.bright-sdk.com clientsdk.brdtnet.com Wildcard domains: *.brdtnet.com *.luminatinet.com *.luminati.io Source: https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingro…

Aye, with Tinder, but no extra-devices or actual travel was needed: https://blog.includesecurity.com/2014/02/how-i-was-able-to-track-locat…

Tinder once had this exact problem. You could find users' exact locations via triangulation, since the API reported an exact distance from your location: http://blog.includesecurity.com/2014/02/how-i-was-able-to-track-locati…

This is a special case of a Server-Side Request Forget vulnerability. Validating schemes is part of the answer but not the whole answer because attackers can still forge requests to internal resources you have firewalled off from the internet. These were recently released to help people deal with these issues since the details can be finicky: http://blog.includesecurity.com/2016/08/safeurl-server-side-request-fo…

As a longtime Dropcam owner, I find this very unsettling. Truth be told, Dropcam service has steadily decreased in quality ever since the Nest acquisition. Not a month passes without an unexplained multi-hour outage; our mobile apps are randomly logged out every few days, requiring us to enter lengthy passwords while nervously wondering what that motion alert might be about. One day the whole Nest rigmarole will become inconvenient for google and poof - our $200+ camera will become yet another paperweight. My only hope is that FOSS will become an option for these devices. There have been examples[0] of Dropcams getting rooted, so perhaps not all is lost here. [0]: http://blog.includesecurity.com/2014/04/reverse-engineering-dropcam-ro…

I wonder how hackable it is. Edit: http://blog.includesecurity.com/2014/04/reverse-engineering-dropcam-ro… http://blog.includesecurity.com/2014/03/Reverse-Engineering-Dropcam-Co…

Reversing the Dropcam Part 1: Wireless and network communications http://blog.includesecurity.com/2014/03/Reverse-Engineering-Dropcam-Co…

Interesting and well written article that mirrors/foreshadows how LLMs do and will change other scenes. As I don't know much about the CTF scene, I looked for other takes on this topic. Here's an article from 2015 about how tool-assistance already changed CTFs: > Individual skill will undoubtedly be a factor next year. But, I'm left wondering whether next year's DEFCON CTF will tell us anything more than how well-developed each team's tools are (and how well they can interpret the results). https://fuzyll.com/2015/ctf-is-dead-long-live-ctf/ But there are quite a few recent (2026) articles with the same core message as in the original article, e.g., https://blog.includesecurity.com/2026/04/ctfs-in-the-ai-era/ or https://k3ng.xyz/blog/ctf-is-dead And here's someone explaining how Claude Max allowed them to win CTFs: > I had always been interested in CTF as one of the only ways people could compete and show off their skill in coding/problem solving on a global scale. It was just too difficult and didn't make sense for me to learn the fundamentals as an electrical engineer. As time went on, I got better and better, and it was hard to tell whether it was because of experience or if it was because of improvements in AI. > I accomplished my goals, and for that reason I'm quitting CTF, at least for now. [...] I'd like to think I highlighted the problem before it became a bigger issue. So, how do we fix this? Teams and challenge authors losing motivation is not good. CTF…

Thanks for the link, I will give it a proper read first thing tomorrow morning. From my very quick skim your attack is far more advanced than what I did. It was enough to just set some registers via the debugger and single step an instruction. With just a single load gadget I could dump the entire ROM. I did not bother with a write gadget as for the Nordic SoC you can just reflash the extracted image without enabling protection and then go from there. I personally did not know about this article, I have not touched the Cypress eco system much, if at all. I linked to a previous article that this project was based on [1]. What I find interesting is that Cypress uses a similar split ROM as Nordic for some kind of system code and data like calibration values. Really neat to see how other vendors do this. [1] https://blog.includesecurity.com/2015/11/firmware-dumping-technique-fo…