eta66

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

	function jhexdump(array) {
	if(!array) return;
	console.log("---------jhexdump start---------");
	var ptr = Memory.alloc(array.length);
	for(var i = 0; i < array.length; ++i)
	Memory.writeS8(ptr.add(i), array[i]);
	console.log(hexdump(ptr, {offset: 0, length: array.length, header: false, ansi: false}));
	console.log("---------jhexdump end---------");
	}

	from __future__ import print_function
	import frida
	import sys

	session = frida.attach("chrome.exe")
	script = session.create_script("""
	var baseAddr = Module.findBaseAddress("chrome.exe");

	print("chrome.exe baseAddress is at :"+baseAddr);

	/*
	* Copyright (c) 1996, 1998, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*

eta66

Cloudflare

FAQ on the xz-utils backdoor (CVE-2024-3094)

Background