A space where I talk about Application Security & other stuff

Opinions are my own

This House is Haunted: a decade old RCE in the AION client

himazawa published on 2025-08-23 included in category Vulnerability-Research

TL;DR

I found a RCE in the AION client starting from 3.0 (not confirmed the latest version vulnerable) using the built-in housing system. Private servers are still vulnerable.

Important Note

In the initial version of this post I wrote that the housing system was removed in 5.0 but some players made me notice that this is wrong indeed the housing system is still there in the retail version of AION (still maintained) but not present in the classic version of the game. This is interesting because apparently we have a bigger playground to investigate, maybe in a follow-up.

When I was younger, MMOs were everywhere. World of Warcraft had already taken over the world with millions of players, Lineage II and Runescape had their own massive communities, and when AION launched in 2009 by NCSoft (a South Korean Company) it quickly became one of the most populated MMOs, with around 6 million players in Asia and 1 million in Europe.

My keyboard was misbehaving so I had to exploit my NAS

himazawa published on 2024-08-07 included in category Vulnerability-Research

I recently received my ZimaCube: a NAS from IceWhale, the same company behind the ZimaBlade, ZimaBoard and most notably CasaOS, a UI to manage docker applications.

Debloating the Onyx Boox Go 10.3

himazawa published on 2024-08-02 included in category Reviews

I was looking for an eink tablet to r ead books and take notes while I’m away from home.

After adventuring in the eInk rabbit hole I decided to go for the Onyx Boox Go 10.3: a Black and White eInk Android Tablet with 300ppi that’s also good for taking notes, weighting only 365g!

I was a bit concerned about this report from Mozilla so I decided to take a look at the device.

The xz backdoor from a Security Engineer persepective

himazawa published on 2024-03-30

As you probably already heard, the xz package got compromised.

The package was used as entrypoint to inject malicious code in sshd, altering the authentication flow. This forged vulnerability is now known as CVE-2024-3094.

Security Theatre? More like Security Circus

himazawa published on 2023-02-13 included in category General-Knowledge

I have seen many companies invest significant time and resources into security measures that have little to no actual effect on security. This is commonly referred to as “security theater”.

Long Time No See

himazawa published on 2023-02-06 included in category Blog-News

Long time no see, uh? Lot of stuff happen since the last post in 2018 on the old blog.

Getting "Zero Click" Remote Code Execution in Mycroft AI vocal assistant

himazawa published on 2018-06-10 included in category Vulnerability-Research

1 Introduction

During my journey contributing to open source I was working with my friend Matteo De Carlo on an AUR Package of a really interesting project called Mycroft AI. It’s an AI-powered vocal assistant started with a crowdfunding campaign in 2015 and a more recent one that allowed Mycroft to produce their Mark-I and Mark-II devices. It’s also running on Linux Desktop/Server, Raspberry PI and will be available soon™ on Jaguar F-Type and Land Rover