In this article, we are looking into the ways DApp developers are able to exploit customization features and architecture flaws of TON Connect Protocol to impersonate legitimate DApps / Wallets, or even exploit vulnerabilities present in Wallets that target TON blockchain.

We've laid our hands on a few TON Crypto Drainers designed specifically to steal native coins, NFTs and Jettons, including: X-TonDrainer, Julia Drainer and TOD / The Open Drainer;

Analyzed their source code, classified them with Levels and discovered what features of legitimate products they exploit in order to appear less suspicious.

The story of an IoT device black-box security analysis from the perspective of a curious Web / Mobile Application Penetration Tester.

It is a research of security issues of a smart flower pot through examination of a variety of entry points along the OSI stack and the interfaces that surround / are included in the Smart Home system, from the local control port to the mobile app.

It's no secret that the problem of loneliness becomes more critical with every passing year, so much so that we can call it a real epidemic and this, unfortunately, will not even be an exaggeration. The modern solution is online dating, but where technology is, there are new ways to attack. It's a pity, but attackers will definetly take advantage of any technical opportunity and purely human vulnerability to achieve their goal.

This article may be useful for those who are interested in reverse engineering, malware or threat intelligence, as well as for anyone who uses dating apps and wants to know about the risks involved.

It so happened that one of the solutions to the problem of collecting user responses is the use of e-mail. E–mail is a complex technology that uses a whole list of components.

In such a scenario, forms act as intermediaries between a number of components and a user, which, as is known from history, inevitably leads to the exploitation of vulnerabilities through user input – to injections.

And, since the attacker has a chain of components of various implementations at his disposal, such functionality is a spacious field for analyzing and conducting not one, but several types of injections at once.