Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Sam Curry Profile picture
@samwcyo
Feb 12 • 7 tweets • 4 min read • Read on X
Scrolly
The DOGE website appears to be developed and hosted by Outburst Data, run by current DOGE employee Kyle Schutt.

If you view the source of any page on the DOGE website, you'll see that the images are proxied through Cloudflare's ImageDelivery service. Image
Image
This service is a product by Cloudflare that helps images load quicker, but whenever used, inadvertently leaks a unique ID that ties back to the host's Cloudflare account. The unique ID that DOGE is using is the following: DzHG7ZU0tz6F1ZKEddmHuw Image
After doing a quick Google search for the Cloudflare account ID, we found a forum post by a user named Kyle Schutt who is asking for help developing a NextJS website on Cloudflare, posting the same account ID as the DOGE website in their forum post. Image
Image
After Googling Kyle Schutt's name, we found a (now deleted) GitHub account which referenced him as the CTO of a company called Outburst Data.

There were still more Google results for the Cloudflare account ID, so we went back to Google and continued down the list. Image
Image
We saw the same Cloudflare ID on the AMERICA PAC website, showing that the account was being used to a host a number of different Elon Musk related websites. Image
Image
After digging into Outburst Data, we found a number of different subdomains related to AMERICA PAC, DOGE, and WinRed hosted on the same Outburst Data API domain.

- doge-25f.outburstapi[.]com = DOGE
- ampac.outburstapi[.]com = AMERICA PAC

And a few more in the screenshot. Image
This was super interesting to us, because the DOGE website was deployed a bit atypically compared to the other US government websites we'd seen in the past while participating in responsible disclosure. Thanks to @iangcarroll for the help looking into this.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Sam Curry

Sam Curry Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @samwcyo

Sam Curry Profile picture
Sep 27, 2023
Upon my return to the United States from a trip to Japan, I was directed to a secondary inspection room where I was presented with a Grand Jury subpoena by officers from the IRS-CI and DHS. The subpoena required me to appear in New York to provide testimony for wire fraud. 🧵 Image
For about an hour they asked me vague questions related to a "high profile phishing campaign" and how my IP address could've end up being "tagged" to a threat actor, showing me a manila folder with my own photo, my home IP address, and some random social media accounts of mine.
When I'd arrived at secondary I assumed it was just a random selection, so I'd given my unlocked device to the inspecting officer, but then watched as it was passed to the DHS and IRS-CI agents who were investigating the money laundering, conspiracy, and wire fraud charges.
Read 11 tweets
Sam Curry Profile picture
Nov 30, 2022
More car hacking!

Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.

Here's how we found it, and how it works: Image
After finding individual vulnerabilities affecting different car companies, we became interested in finding out who exactly was providing the auto manufacturers telematic services.

We thought it was likely there was a company who provided multiple automakers telematic solutions. Image
While exploring this avenue, we kept seeing SiriusXM referenced in source code and documentation relating to vehicle telematics.

This was super interesting to us, because we didn't know SiriusXM offered any remote vehicle management functionality, but it turns out, they do! Image
Read 16 tweets
Sam Curry Profile picture
Nov 29, 2022
We recently found a vulnerability affecting Hyundai and Genesis vehicles where we could remotely control the locks, engine, horn, headlights, and trunk of vehicles made after 2012.

To explain how it worked and how we found it, we have @_specters_ as our mock car thief:
Our finding began with @_specters_ reaching out to @bbuerhaus and myself to help explore potential security issues affecting vehicle telematics services.

Most car research we'd seen in the past involved really cool crypto attacks on physical keys, but what about the websites?
Both the Hyundai and Genesis mobile apps allow authenticated users to start/stop/lock/unlock their vehicle. Since we had access to a Hyundai, we began proxying all of the app traffic through Burp Suite and seeing what actual API calls were taking place.
Read 15 tweets
Sam Curry Profile picture
Nov 8, 2022
Between July 7th to July 17th, 2022, we formed a small team of hackers and collectively hunted for vulnerabilities on John Deere’s security program.

During our 10 day engagement, we found 100 unique vulnerabilities with 50 rated critical, 32 high, 14 medium, and 4 low severity.
Throughout the process, our most impactful finding allowed us to provision, modify, impersonate, and delete all John Deere SSO and LDAP users across the entire organization with full access to hundreds of internal and employee-only services including…
Office 365 (full email, file, and spreadsheet access for everyone), NetScaler Gateway for SSL VPN (could grant ourselves full VPN access and login to all applications behind the VPN), Github Enterprise, Service Now, AWS, and many more.
Read 9 tweets
Sam Curry Profile picture
Sep 16, 2022
Someone hacked an Uber employees HackerOne account and is commenting on all of the tickets. They likely have access to all of the Uber HackerOne reports.
The attacker is claiming to have completely compromised Uber showing screenshots where they’re full admin on AWS and GCP.
From an Uber employee:

Feel free to share but please don’t credit me: at Uber, we got an “URGENT” email from IT security saying to stop using Slack. Now anytime I request a website, I am taken to a REDACTED page with a pornographic image and the message “F*** you wankers.”
Read 4 tweets
Sam Curry Profile picture
Apr 1, 2022
Over the last few months, we found a number of vulnerabilities in the largest Discord plugins (Dyno, MEE6, CollabLand) which would've allowed attackers to become administrators, send messages, and DM users.

The tagged hack happened a few days after we accidentally triggered /1 ImageImage
an "@Everyone" message to be sent in a large public server using the Dyno bot, and I'm wondering if the hackers noticed this and began looking themselves? These bots have a massive amount of trust (admin roles on >1mm servers, people click URLs willingly, etc), and for /2
crypto servers (where there really aren't too many points of trust), people only really know to check if the bot is the "official bot" before they'll click a link and sign a message to prove their identity (or whatever a hacker may modify the signing to do). /3
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(