Vulnerabilities in the hidden magic of Lodash, Ramda and Underscore

We looked at the internals of JavaScript/TypeScript's most popular utility libraries and found interesting issues.
The post contains hacking challenges/live demos.
We recommend checking it out if you work with the affected libraries.

https://positive.security/blog/lodash-ramda-underscore-vulnerabilities

At #38c3, we presented our #BlinkenCity research, which started as a fun art project idea, and ended up as a plausible European #blackout scenario.

https://www.youtube.com/watch?v=DAf-T3bFJFs

Details: https://positive.security/blog/blinkencity-38c3

TL;DR: Some European countries use unencrypted and unauthenticated #longwave radio to steer parts of their renewable power, enough to potentially cause a Europe-wide blackout.

The control signals can be sent with just a #Flipper Zero over short distance, or via self-built transmitters over a long distance (e.g. using a kite to lift an antenna wire).

The system is also used for street lamp control, allowing for a scaled-up “Project #Blinkenlights” art installation that transforms an entire city into a screen (for astronauts).

The company operating this system has threatened us with lawsuits and (now publicly) denies the risk.

We built a stealth AirTag clone that is not detected by Apple’s tracking protection. It works by only sending one beacon per generated public key.

https://positive.security/blog/find-you

The source code for the ESP32 firmware and macOS retrieval application used in our experiment can be found here:
https://github.com/positive-security/find-you

We present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved)

https://positive.security/blog/video-depixelation