PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking Chess.com and Accessing 50 Million Customer Records

samcurry.net | blog | #bug-bounty | #account-takeover | #api-security | #mobile-security | #chess-com | #signature-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Sam Curry recounts hacking Chess.com's mobile API: signed requests to api.chess.com seemed untamperable, until a flaw in how signatures were verified led to full takeover of any user account.
Published
Collected

Related coverage

blog · samcurry.net
Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More
Sam Curry's team found automotive API flaws across brands: VIN numbers sufficed for remote commands and account takeover at Kia, Honda and Nissan, while Mercedes-Benz SSO exposed internal systems.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
blog · samcurry.net
Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel
A flaw in Subaru's STARLINK admin panel gave unrestricted access to vehicles and accounts in the US, Canada and Japan—remote commands, a year of location history, PII—keyed on a last name and ZIP.
blog · samcurry.net
Hacking Kia: Remotely Controlling Cars With Just a License Plate
Kia vulnerabilities let attackers remotely unlock, start and track any hardware-equipped vehicle with a license plate—~30 seconds, subscription or not—and add themselves as invisible second users.
blog · samcurry.net
Hacking Starbucks and Accessing Nearly 100 Million Customer Records
A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.
blog · samcurry.net
Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts
Chasing Rocket League's white-hat reward, Sam Curry chained HTTP path normalization quirks and cache poisoning into account theft—a walkthrough of finding bugs in a seemingly boring web target.
Back