Eaton Zveare
eaton-works.com · Personal blog · on HN since 2016
Eaton Zveare, a software developer, writes up security research on large companies' web systems, such as Intel, Honda and Toyota, and reverse engineering.
What HN saysHN links his write-ups of vulnerabilities he found in corporate systems; the given comments also include a job posting and some discussion of the disclosure timeline.
22HN people shared it
6linked it in comments
37stories submitted
1.1Kstory points
3 months agolast shared
2016people per year2026
Most-shared posts
- 1Intel Outside: Hacking every Intel employee and various internal websites5 people · 27 points · first shared 2025 · 2 comments on HN
- 2Reverse engineering and removing Pokémon GO’s certificate pinning4 people · 150 points · first shared 2016 · 58 comments on HN
- 3Compromising Honda's entire dealer eCommerce platform and 1k dealer websites4 people · 4 points · first shared 2023 · discussion on HN
- 4Hacking India's largest automaker: Tata Motors3 people · 277 points · first shared 2025 · 99 comments on HN
- 5Hacking into Toyota’s global supplier management network3 people · 7 points · first shared 2023 · discussion on HN
- 6How Microsoft attempted to make the Xbox 360 dashboard load faster2 people · 5 points · first shared 2023 · discussion on HN
- 7Hacking a pharmacy to get free prescription drugs and more2 people · 3 points · first shared 2026 · discussion on HN
- 8CVE-2023-6483: Improper/missing API authentication in ADiTaaS v5.12 people · 3 points · first shared 2023 · discussion on HN
- 9Using cookies to hack into a tech college's admission system2 people · 2 points · first shared 2026 · discussion on HN
- 10Hacking into an insurance company by exploiting their premium calculator1 people · 459 points · first shared 2024 · 101 comments on HN
- 11Exploiting McDonald's APIs to hijack deliveries and order food for a penny1 people · 113 points · first shared 2024 · 18 comments on HN
- 12Hacking into the worldwide Jacuzzi SmartTub network1 people · 36 points · first shared 2022 · 1 comments on HN
- 13How the Xbox 360 knows if your hard drive is genuine1 people · 17 points · first shared 2023 · 5 comments on HN
- 14Exploiting vulnerabilities in Johnson and Johnson web apps1 people · 3 points · first shared 2026 · discussion on HN
- 15Taking remote control over industrial generators1 people · 3 points · first shared 2025 · discussion on HN
What HN people wrote when they linked it
supriyo-biswas · 2025-11-09
> Based on sheer CS grad numbers why wouldn't companies just shift their r& operations there then?
There are lots of CS grads, yes. But most colleges out there are mostly degree mills, and this carries on to the workplace, where your average software engineer or engineering manager has very little understanding of what they’re actually doing (this[1] article was posted on HN, which will tell you the quality of engineering in India).
For anything slightly complicated, companies seem to be only interested in hiring from the best colleges and pay out of their nose in the process. A friend of a friend does some hardware work at a FAANG, and gets paid at almost that level.
[1] https://eaton-works.com/2025/10/28/tata-motors-hack/
EatonZ · 2023-03-01
Location: Florida, USA
Remote: Yes
Willing to relocate: No
Résumé/CV: https://eaton-works.com/resume/
Email: [email protected]
I am an experienced C# / .NET Windows desktop developer of more than 15 years with an interest in file systems, reverse-engineering, and security. Some of my recent security disclosures have been front-page news on major media outlets such as Automotive News[1] and TechCrunch[2].
Currently seeking new opportunities in the C# / .NET and/or security space.
Please see my website for a full catalog of my notable work: https://eaton-works.com/
[1] https://www.autonews.com/mobility-report/how-toyotas-supplier-portal-g…
[2] https://techcrunch.com/2022/06/22/jacuzzi-flaws-admin-exposed-users/
guluarte · 2025-11-01
btw... some urls in this image contains js with vulnerabilities https://eaton-works.com/cdn-cgi/imagedelivery/VwwCqBIYNXeyNQwEQ8uyVQ/f…
https://imgur.com/a/ybFcY5Y
https://imgur.com/Pf7ywbK
cjs_ac · 2024-01-17
The author of the article also rediscovered this vulnerability in June 2023.
https://eaton-works.com/2023/06/06/honda-ecommerce-hack/
josu · 2024-01-17
>October 18, 2023: I noticed the vulnerability is now fixed – the email sending API now requires authentication. I ask CERT-In if TTIBI can offer a bug bounty reward.
>TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter.
The letter:
"Dear Eaton Zveare,
This email is written in appreciation and recognition of your efforts for bringing our attention to the "Cryptographic Failures" in one of the Indian websites on 08.08.2023. The role of responsible security researchers is pivotal for creating a secure cyber ecosystem and CERT-In strongly believes in working actively with a researcher like you for the discovery of cyber security vulnerabilities and their subsequent remediation in a responsible manner.
We look forward to your valuable contribution in future as well.
Thanks & Regards"
https://eaton-works.com/cdn-cgi/imagedelivery/VwwCqBIYNXeyNQwEQ8uyVQ/9…
seanp2k2 · 2017-06-15
The tools are there for you to try it:
https://www.charlesproxy.com/documentation/faqs/using-charles-from-an-…
http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAn…
You could probably also do it with the emulator. You may need to do something like https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ or it could be even harder: http://docs.mitmproxy.org/en/stable/certinstall.html#certificate-pinni…
There are of course ways around this: https://serializethoughts.com/2016/08/18/bypassing-ssl-pinning-in-andr…
If you need some more hints: https://github.com/ac-pm/SSLUnpinning_Xposed
https://forum.xda-developers.com/showthread.php?t=3034811
https://eaton-works.com/2016/07/31/reverse-engineering-and-removing-po…
If you do this, please write it up. I'm sure that many people would be interested in this research if it hasn't already been done.
EDIT: In the spirit of POC||GTFO, I got curious and did it myself. I don't see any evidence of any mic uploads. The worst thing I see is it posting your current location. Here's a screenshot of the typical stuff I was seeing (this particular one is for the messenger portion of the app, and it looks like it's pulling in assets for stickers. I have the Pusheen pack because it's hella adorbs): https://i.imgur.com/dVekldx.png
It's POSTing to graph.facebook.com as you scroll to get more data. It's just JSON and pretty easy to figure out what's going on. I just…