Not surprising, Ditto always sucked

Good catch!

Is dead 😩

Wisp never prepared me for this

Meanwhile, @npub1v5uf...n0v5 continues to malfunction against Amber. Guess I'll jump into my backup podcast app :(

Thanks for telling us.

Ditto’s bug was arbitrary JavaScript in the app WebView (XSS), not RCE, from which they could drive the app. Including the session keys, but no stealing of the key.

But, UTXO Told me it didn't matter. 😭

We are looking for an individual who can lend 185,000 US dollars to our holding company. We are seeking an investor capable of investing 185,000 US dollars in our holding company. We will establish an animation film production company using the 185,000 US dollars you will lend to our holding company. We will establish an animation film production company with the 185,000 US dollars you invest in our holding company. We will use the 185,000 US dollars you invested in our holding company to establish an animation film production company, and we will have increased that investment amount within a few months. By using the 185,000 US dollars you invested in our holding company to launch an animation film production company, we will increase the value of your investment within a few months. We will have increased the 185,000 US dollars you invested in our holding company within a few months. We will use the 185,000 US dollars you lent to our holding company to establish an animated film production company, and within a few months, we will significantly increase the 185,000 US dollars you lent to our holding company. Since animated films attract significant public interest today and we intend to undertake international animation projects, the animation film production sector will generate substantial revenue for us. Since animated films currently attract more attention and we will be working on international animated film projects, the animation production sector will provide us with significant revenue. By establishing an animation production company, we will generate substantial revenue within a few months. By utilizing artificial intelligence tools as well, we will be able to produce animated films more quickly. We will produce professional-quality animated films covering a wide range of topics. Since we will be producing animated films across many categories and in multiple languages, our viewership will increase rapidly. Since animated films are currently very popular and we excel in the field of advertising, the animated films we produce could garner millions of views in a short time. How will revenue be generated, and how will we increase our audience? Since the animated films we will produce will be in many languages, it will increase the viewership of our animated films internationally. Since we will produce animated films in many categories instead of just one, the animated films we make will receive more viewership. We will produce animated films in at least seven different categories every year. Since we will produce high-quality and more professional animated films, our films will be watched by millions internationally. We will earn money per view by sharing the animated films we produce on various social media platforms such as YouTube, Instagram, Facebook, and TikTok. Since the animated films we will produce will be in many languages, we will earn money per ticket by screening our animated films in cinemas of many countries. We will earn revenue per ticket by screening the animated films we produce in movie theaters across many countries. By releasing the animated films we produce on various streaming platforms such as Netflix and Amazon Prime, we will generate significant revenue. We will release the films we produce on our own website; through a paid subscription model, viewers wishing to watch our animated films will purchase subscriptions, thereby generating revenue for us. As the audience for the animated films we produce grows, we will generate significant revenue by promoting sponsors' products in our future animated films. By embedding trailers of the animated films we produce onto blogs and news sites, we will increase the international viewership of our animated films. By promoting our animated films on various high-traffic websites and social media accounts, we will achieve a large audience. By using advertising tools such as Google Ads, YouTube Ads, and Facebook Ads, we will be able to introduce our animated films to the entire world more quickly. As our fan base grows, we will generate extra revenue by producing and selling products—such as toys, mugs, and sweaters—featuring the characters from our animated films. We will generate significant revenue by broadcasting our animated films on television channels in many countries. By employing a very strong marketing strategy, we will generate millions of dollars in revenue from the animated film industry in a short time. How will the process work? First, we will establish an educational website offering professional-level training in animated film production. Even someone with absolutely no knowledge of making animated films can become a professional within one month by studying the animation course on our training site. We will train and hire our own animation production staff. Since we will train our team ourselves, we will be able to work in a more coordinated manner, which will enable us to complete the animated films we produce more quickly. Within two months, we will have trained and recruited staff to establish our own animation film production team. We will assemble a professional-level animated film production team within two months. Within two months of assembling our animation film production team, we will produce professionally designed animated films covering various topics and in multiple languages We will produce animated films in at least 7 different categories within two months. Once our animated films are completed, we will release them in various places and start earning money within two months. We will generate substantial profits within two months of completing our animated films, thanks to our strong marketing strategy. Within two months, we will rapidly generate substantial revenue by releasing our film on platforms such as Netflix, Amazon Prime, TikTok, Instagram, and YouTube, as well as in movie theaters across many countries. One month after releasing our animated film internationally, we will generate revenue of at least 7 million US dollars. We will generate at least 7,000,000 US dollars in revenue one month after releasing our animated films in many countries. Since the animated films we produce will be in multiple languages ​​and across various categories, they will quickly garner high viewership. Today, animation film production companies generate average annual earnings of at least 800 million US dollars. Thanks to our strong advertising tactics, we will generate more revenue in the future. We will have generated at least 7,000,000 US dollars in revenue within a total of 7 months. How much income will you generate by investing 185,000 US dollars in our holding company? If you lend 185,000 US dollars to our holding, I will return your money as 370,000 US dollars on 30/04/2027. If you invest 185,000 US dollars in our holding, I will return your money as 370,000 US dollars on 30.04.2027. We will increase the 185,000 US dollars you have lent to our holding company by utilizing it in the animated film production sector, and I will return the funds to you as 370,000 US dollars on April 30, 2027. I will return your money to you as 370,000 US dollars on April 30, 2027. April 30, 2027, is the date we will repay your money. You will have generated twice as much revenue within a few months. I will repay you the 185,000 US dollars you lent to our holding company as 370,000 US dollars when the date of April 30, 2027, arrives. We will invest the 185,000 US dollars you have lent to our holding company into the animated film production sector to further increase the amount, and when April 30, 2027, arrives, I will return the money to you as 370,000 US dollars. By investing 185,000 US dollars in our holding company, you will generate substantial returns in a short period—don't miss this opportunity. How to contact us: To learn how you can grow your money by investing in our holding company, send a message to my Telegram username, Signal number, or email address listed below, and I will provide you with detailed information. To learn more about our animated film project and how you can invest 185,000 US dollars in our holding, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. To learn how you can lend 185,000 US dollars to our holding and increase your money even more within a few months, and to get detailed information, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. Send us a message via Telegram, Signal, or email for detailed information. I have listed our contact details below; you can obtain detailed information by sending a message to any of them. To learn how you can lend 185,000 US dollars to our holding and to get detailed information about our animated film project, send a message to my Telegram username, Signal contact number, or email address below, and I will provide you with detailed information. To learn how you can further increase your money within a few months by investing 185,000 US dollars in our holding and to get detailed information about our animated film production project, send a message to my telegram username, signal username, or email address below. To learn how you can increase your money, send a message to my Telegram username, Signal contact number, or email address below. My Telegram username: @adenholding Signal contact number: +447842572711 Signal username: adenholding.88 my email address: iuheatr@proton.me

Wisp wouldn't automatically have the same bug, but it also would need to be security audited to know if it has any before we know its truly safe. Ditto had the benefit here that someone tested it for security vulnerabilities so they had a proper chance to fix them.

If in theory it was tampered with you'd just have to revoke it in your signer. I don't think anyone exploited it in the wild.

Well, you could get the nsec if they aren't using a signer.

It's just a WebView shell. Not Kotlin or something.

That's the concern for users that enabled auto-allow for amber specifically, the xss would have the ability sign arbitrary requests on behalf of the user. For nip46 aka bunker users, it would be a Harvest Now, Decrypt Later attack with exfiltrated session keys.

That's why you should use a real signer and not grant universal permission.

Regardless of the shoulds, that's the scope of this exploit.