home.social

#responsibledisclosure — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #responsibledisclosure, aggregated by home.social.

  1. BobDaHacker 🏳️‍⚧️ @[email protected] ·

    🤖 Hacked China's Biggest Robotics Company (Pudu Robotics)

    Pudu makes those cat-faced BellaBot robot waiters you see in restaurants, plus cleaning robots, disinfection bots, and even FlashBots with mechanical arms for offices.

    Found critical vulnerabilities in their app controlling their entire global fleet:

    • Zero authentication on APIs
    • Could control any robot worldwide
    • Accept 20k store IDs in single request, no rate limiting
    • Could steal food, documents, redirect hospital medicine delivery
    • FlashBot with arms could grab files & use elevators

    Reported Aug 12. Sent emails to sales, support, tech teams - all ignored.

    Had to email Skylark Holdings (7000+ restaurants) and Zensho directly about their compromised robots.

    Pudu responded in 48hrs with obvious ChatGPT template - forgot to replace "[Your Email Address]" placeholder. Fixed 2 days later.

    Thousands of robots (BellaBots, KettyBots, FlashBots, etc) in hospitals, restaurants, offices worldwide were vulnerable for a long time.

    Full Technical Writeup: bobdahacker.com/blog/hacked-bi

    #infosec #robotics #BellaBot #PuduRobotics #security #vulnerability #responsibleDisclosure #cybersecurity

    #infosec #robotics #bellabot #pudurobotics #security #vulnerability
  2. Dissent Doe :cupofcoffee: @[email protected] ·

    In August 2020, @SchizoDuckie and I published what was to become the first of a series of articles or posts called "No Need to Hack When It's Leaking."

    In today's installment, I bring you "No Need to Hack When It's Leaking: Brandt Kettwick Defense Edition." It chronicles efforts by @JayeLTee, @masek, and I to alert a Minnesota law firm to lock down their exposed files, some of which were quite sensitive.

    Read the post and see how even the state's Bureau of Criminal Apprehension had trouble getting this law firm to respond appropriately.

    databreaches.net/2025/07/04/no

    Great thanks to the Minnesota Bureau of Criminal Apprehension for their help on this one, and to @TonyYarusso and @bkoehn for their efforts.

    #dataleak #misconfiguration #incidentresponse #incidentmanagement #responsibledisclosure #securityalert #infosec

    #dataleak #misconfiguration #incidentresponse #incidentmanagement #responsibledisclosure #securityalert
  3. Antonio Francesco Sardella @[email protected] ·

    The advisory of the authenticated command injection I found on Cacti 1.2.24 has been published (CVE-2023-39362).

    github.com/Cacti/cacti/securit

    #security #cybersecurity #websecurity #appsec #applicationsecurity #hacking #responsibledisclosure #exploit #cacti #rce #commandinjection #remotecommandexecution #cve202339362

    #security #cybersecurity #websecurity #appsec #applicationsecurity #hacking