REMY HAX

Smolbox runs entirely in a browser tab. It is a full x86_64 virtual machine (VM) sandbox based on Alpine linux that runs under WebAssembly (WASM). It also has “AI” artificial intelligence in the form of an LLM model that runs via WebGPU which is exposed as tool calls inside the VM. You can optionally use the web browser file-picker to mount a folder containing files you want added to the VM, which are mounted read-only under /mnt/host.

Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your numbers with other people’s numbers in such a way that you can verify a chain of trust. Ultimately, at the top of this chain there has to be an entity or entities that are implied to be trustworthy, so that the links further down the chain of numbers can inherit that trust. This is the role of a root Certificate Authority (CA) at the top (root) of the chain.

Cyber, AI, Disruption! There’s some impactful things going on in the world of AI right now and that can make people nervous. There’s also quite a bit going on the the world of Cyber as well, and that’s always gotten people a little shook. Mix them together in a few academic style whitepapers that get traction on social media and you’re got yourself quite the hype train, regardless of whether that was the intention or not.

Every few months there’s some sensational news reporting that some high profile individual doesn’t use bluetooth wireless headphones and everyone goes “Wait, what?”. From Taylor Swift’s public appearances featuring exclusive use of wired headphones to former Vice President Kamala Harris on The Late Show with Stephen Colbert stating:

My LILYGO T-Watch S3 Plus (with GPS) arrived with a non-functional LCD. Here’s how I fixed it. First, power off the device using the yellow switch in the back. Then using a PH00 Phillips head screwdriver… Remove all 4 screws and gently pull away the watch straps. There is an antenna hidden inside one side of the watch bands.

Number 3 may surprise you! I’m kidding of course, blatant web-based phishing attacks are boring. This blog isn’t about those. Most of these examples will probably surprise you in some way. This blog is about the spiraling mess of URI handlers, auth flows, proof-of-presence, and the complete lack of fuzzed code coverage of the ecosystem as a whole.

There’s a new Erlang OTP vulnerability, CVE-2025-4748. It’s an Absolute Path Traversal vulnerability involving a Zip archive, which I have a lot of practice with. It affects Erlang OTP, which a coworker has already written about recently and noted the necessary steps to set up an environment.

Ghidra is the best Android app RE tool. It just seems like it’s not, because the loader has easily fixed quirks. Let me demonstrate. A friend reached out and aired some valid grievances the Java community had with this post, particularly “Ghidra is the best Android app RE tool”. I’ve added a section labeled “Community Feedback” that provides some context for why I made this statement (despite desperately wishing there was other options for my use-case). However, at it’s core: Ghidra can, and does.

Using an AI powered network traffic analysis tool we built called SIFT, GreyNoise has caught multiple anomalous network payloads with zero-effort that are attempting to disable TrendMicro security features in ASUS routers, then exploit vulnerabilities and novel tradecraft in ASUS AiProtection features on those routers.

VPN: phone, not desktop. WiFi: N/A. These statements are correct. Or at least as correct as is applicable to the general user in the scope of the following contextual blog which generally recommends that: “Yes, it’s probably a good idea to be thinking about getting a paid, reputable VPN for your phone.”