https://bitecode.blog/categories/security/Recent content in SECURITY on Bitecode blogHugoen-usWed, 09 Oct 2024 00:00:00 +0000https://bitecode.blog/2024/10/09/git-spoofing/Wed, 09 Oct 2024 00:00:00 +0000https://bitecode.blog/2024/10/09/git-spoofing/<h2 id="introduction">Introduction</h2> <p>when checking git log or GitHub commits history we can see that each commit has a corresponding author. We learned to trust that information.</p> <p>What if I told you that this information can be easily spoofed?</p> <h2 id="what-is-git-log">What is git log</h2> <p>Every time we commit changes to the git repository, git stores information about the author of the commit.</p> <p>This information is stored per commit object and can be displayed by executing <code>git log</code> command.</p>https://bitecode.blog/2024/04/05/jvm-serialization-exploits/Fri, 05 Apr 2024 00:00:00 +0000https://bitecode.blog/2024/04/05/jvm-serialization-exploits/<h2 id="intro">Intro</h2> <p>The Java Virtual Machine (JVM) provides a mechanism for persisting Java objects, known as serialization. When introducing, it was a great step forward, as developers stopped reinventing the wheel and writing the same (still complex) boilerplate code. As we later learned it also opened a pandora box. I will try to describe the problem in the article below.</p> <h2 id="problem">Problem</h2> <p>This process of serialization involves converting the state of an object into a byte stream, which can then be reverted back into a copy of the object. That way we can persist any object, store it, then load whenever we want.</p>