Tal Skverer

It happened! My #DEFCON 33 talk on hacking Pokémon Go is live! Looking back, it was an absolute pleasure to dip into that 2016 nostalgia and share with the security community the untold story of Team Unknown6, on stage in front of a packed full audience. m.youtube.com/watch?v=2En9...

Had a great time presenting the OWASP Top 10 NHI Project today at #LASCON Austin with Tomer Yahalom! We've had the pleasure to give the talk to a great crowd and amazing people. Looking forward to the second day filled with interesting talks!

Breaking 'Em All! The blog posts going deeper into hacking Pokemon Go that accompany my #DEFCON talk are live on my blog! taltechtreks.com/2024/04/06/H... taltechtreks.com/2025/08/09/H... Happy to get questions on the research!

Talking in an hour at #DEFCON about Pokemon Go on track 3. Couldn't be more excited! I've worked on it multiple nights in the past months, and I hope you'll enjoy it! If you're not here in person, you can catch the talk live at www.youtube.com/live/fzbrrKP... or www.twitch.tv/defcon_dctv_...

Giving a talk on Pokemon Go, I just had to convert myself to a Pokemon trainer. The amazing Ryan Rockenbaugh surprised me with a limited edition sticker of Trainer Tal Sticker wall at #DEFCON got 2, and I will be giving what's left tomorrow at my talk Breaking 'Em All! 11:30 Track 3. See you!

Excited and humbled to speak once again in DEF CON. Talk is on Saturday at 11:30, track 3. I'll be in the conf till Sunday, hit me up if you want to chat over the talk or any other project.

The #DEFCON 33 schedule is live and I'm excited to announce I'll be giving a talk this year on unique research I was a part of a few years back! "Breakin 'Em All – Overcoming Pokémon Go's Anti-Cheat Mechanism" Join me on stage - Sat, 11:30 AM, Track 3 defcon.org/html/defcon-...

Looks like I'll be at Hacker Summer Camp this year! Exciting #DEFCON33 ☺

Just got back from #AppSecIL2025! Ended up 4th place in the #CTF 🎉 Solved 12/15 challenges alone - Android pwn, JS sandbox escapes, cache poisoning, XSS bypasses. The usual suspects: SQLi, LDAP injection, XXE. Had a blast! Looking forward to the next one. Writeup: taltechtreks.com/2025/06/04/a...

I'm building something cute and new, but as opposed to my normal ways, this time I'm using #Cursor heavily and the flow blows my mind. Although I'm certain that without prior good knowledge of coding it wouldn't work that well.

Ah, I wondered when this was due to come out. Can't wait to experiment! www.anthropic.com/news/integra...

Excited to present my research tomorrow at #RSAC! Come by to hear John and me share conclusions and insights on the first publicly available report on Non-Human identity security! See you there, May 1, 10:50 am at Moscone West 3004!

For today, a bit Friends content! Or, uhh, actually, computer science! What’s the largest sofa you can pivot around a corner? Heard about this problem in the past, but I thought it's one of those we will never be able to prove. (At least until quantum computers arrive to solve some NP problems)

Took a bit of hiatus from posting here, was quite busy the past few months (CFP season amiright…) But I do have more cool stuff ready for sharing as well as writing 2 blog posts about projects I worked on lately. Looking forward to sharing with you all

Great time presenting OWASP NHI Top 10 at #SnowFROC! If you're here, come say hi!

Well, that was an hour of my life well spent. An amazing adaptation of minesweeper to include old-school RPG elements. UPDATE: Had to go back and play, another 4 hours to achieve a perfect clear. Incredible game!

Great thread on the emerging new details on the ByBit breach

A cute post showcasing the basis of every website - HTML! The site goes over (almost) all HTML tags, by using them. Seeing this, it’s unfortunate that text inputs in websites don't allow most tags but rather encapsulate how the final result is displayed for users. Give us more, please!

Managed to squeeze in 2 talk submissions to #fwd:cloudsec just before the first round CFP closes. Hoping for good news, will be the perfect reason to finally attend in person!

Check out this wild project: #Steam #Brick. The author transformed the Steam Deck to a brick that still connects to screens or VR while reducing size by a third Projects like this (author used steam-provided data) are a great example of "right-to-own", critical to enhance electronics sustainability

#OAuth #phishing apps are coming to get you - now on #X! It's annoying to see yet another case of how easy it is to fake consent screens that look identical to real companies. Why we still lack mandatory verification processes for new OAuth apps is beyond me. x.com/thealexbanks...

So, #OAuth implementations seem to always have some edge case or quirk making it vulnerable in odd ways. This particular exploit leveraged an open redirect in an app's OAuth callback, combined with #Google OAuth's quirks to steal authorization codes on visiting a malicious website.

#DeepSeek roasts me based on my #UserAgent: Your browser history is so bare even your referrer ghosted you, your 2560x1440 screen is just compensating for how bland Firefox 134 on Windows 10 is, and 16 CPU cores in Tel Aviv? Congrats, you’re the NPC overclocking spreadsheets in the Silicon Wadi.

Cute bit of #internet history, this post shows why #Git gives you 0.1 seconds to decide if it runs a fixed command. Turns out, backwards compatibility in code is hard, especially if the code is distributed widely, and can lead to these kind of funny instances (and other that can cause real damage)

The Dead Internet Theory is just a meme, right? Well…something strange happens over at PhysicsForums. Once an active forum for physics students, now a quieter place. A year ago, posts appeared, made by users long after their last login. LLM-generated replies back-inserted into the DB Must read!

Still surprised with how people use LLMs for cool stuff. This one uses o1 and makes it play Codenames with itself. If you played it, you know it's tricky to give good hints, and o1 crushed it. Wonder how it works when not playing itself. If I played someone with my brain, the game would be easy :)

The #GPT #o1 model was very exciting initially, but I completely stopped using it. The long wait and the laziness of my prompts made the chat-based models much better. This post explains how to interact with o1. In short - it comes down to good #prompts so o1 one-shots the response.