PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why I didn’t catch any Pokemon today

blog.trailofbits.com | blog | #mobile-security | #privacy | #oauth | #trail-of-bits | #pokemon-go | #permissions
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits investigates Pokemon Go's Google account permissions: the app used an undocumented OAuthLogin scope, bypassable jailbreak detection, and silently re-enables revoked permissions.
Published
Collected

Related coverage

blog · semperis.com
Practice Checkpoint 2: Setting Agent Identity Permissions
Semperis practice checkpoint two wires up the Entra ID agent permission model: direct app-only roles on the agent identity plus inheritable delegated permissions granted at the blueprint level.
research · blog.quarkslab.com
Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool
Quarkslab explains why auditing Microsoft Entra ID app permissions is hard — inheritance via ownership, groups and federation hides effective privileges — and introduces its open-source QAZPT tool.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
Back