Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Rithwik Jayasimha Profile picture
Rithwik Jayasimha
@thel3l
basic persistent threat @_lagrangepoint \n hacker, designer, dilettante \n prev @claygorilla @tensorfuse \n currently: solving hardware sourcing in india
Jan 12, 2025 • 22 tweets • 8 min read
Last year, a friend was planning a trip to an amusement park for her bday. Site design is often a good heuristic for security and the design wasn't inspiring confidence—so I went poking.

A fun story of finding a payment bypass in PayU India and the subsequent disclosure arc: amusment park clearly not amused with my kind, and have obviously had folks bother them before haha Some background: @PayUindia is one of the largest payment gateways, used by over 500k+ merchants online in India.

When you pay for things online, merchants will rely on PayU to say "Yes, we got da money!"—and trust that yes, they really did.

This becomes important later. Image
Nov 26, 2024 • 16 tweets • 6 min read
Last month, a number sent me malware via an APK titled 'Union Bank Aadhar Update' on Whatsapp.

These typically just lamely forward all SMSes received to steal OTPs, but this one turned out to be a significantly more sophisticated op.

Some notes from taking down a scam network: jadx output of the malware, where you can see the endpoint it is trying to send all the victim's smses to. I used jadx to decompile the APK, and it was immediately apparent that this was not the run of the mill op that just forwarded SMSes.

Here's a side by side of another such SMS stealing scam I received in July and this on the right: What a sms stealing APK typically looks like—just dumb forwarding to a number
This malware—not doing anything suspicious until it's instructed to by A C&C server.
Nov 12, 2024 • 15 tweets • 4 min read
Apple released a hearing aids feature for the AirPods Pro a while ago. I bought a pair for grandma, but then realized that the feature was geoblocked in India

So we at @_lagrangepoint decided to unblock it. It ended up involving a leaky microwave and building a Faraday cage: An Airpods case, an iPad, and a Faraday cage made of copper and aluminum At first, we thought it would be easy—spoof IP location with a VPN, maybe rewrite some requests in a proxy, how hard could it be?
May 4, 2024 • 9 tweets • 3 min read
We reversed the Rabbit R1 🐇 and got it to run on our phones!

This gives us future OTA updates, access to new features without a device + works perfectly without root/system perms!

(Blog post below) Here's how we did it (article by @MishaalRahman):

androidauthority.com/rabbit-r1-besp…