14-06-26, 06:50 PM
Hello everyone. We are Orcinus Orca.
Due to a change of plans, our team needs to recruit one more member who specializes in low-level coding. If you're a free agent, still "lonely" in the scene, and have the skills to operate at the core, hit us up. Sincerely.
DM for details.
05b0ad506bba9fbd093cdc26eea9cb7053c56ca94bc68276c3b23c21cc03b4cb1b
Today, I am exposing how fragile the infrastructure of eero (Amazon’s mesh WiFi brand) truly is. The entire ecosystem, from the Shopify Storefront to the AWS backend, has been laid bare through an attack chain we recently finalized.
1. The Dev Token Fatal Flaw
We discovered an exposed Dev token (bd22faf8641a63b57178d93351c31663) that retains full administrative privileges over the Production environment at store.eero.com. With the write_customers scope, we successfully executed the following operations:
2. AWS Secrets Manager ARNs Exposure
Amazon’s engineering team inadvertently leaked sensitive ARNs within public JavaScript files:
3. Full WiFi Infrastructure Takeover (OTP Prefix Leakage)
The API at e2ro.com leaks the OTP prefix directly in the login response. This allows anyone to bypass 2FA and take over any account among the 2 million eero Plus subscribers, gaining absolute control over their home WiFi networks.
4. Internal Business Intelligence
We have also exfiltrated unreleased product catalogs, including the eero Signal (5G) and internal project codenames such as Andytown, Eden, and Snowbird.
And here is the punchline: do you really think I leaked this before "handling" your systems? What did I actually do? Did I hijack the payment gateways, ATO every user account, or am I currently commanding your entire WiFi infrastructure? The answers are already inside your system, if you are even capable of finding them.
And stay tuned--we are about to Microsoft 365 and Wickr. They will be 'on air' in just a few days.
The file below is the result of our operation.
https://gofile.io/d/0GSrjI
---Orcinus Orca---
Due to a change of plans, our team needs to recruit one more member who specializes in low-level coding. If you're a free agent, still "lonely" in the scene, and have the skills to operate at the core, hit us up. Sincerely.
DM for details.
05b0ad506bba9fbd093cdc26eea9cb7053c56ca94bc68276c3b23c21cc03b4cb1b
Today, I am exposing how fragile the infrastructure of eero (Amazon’s mesh WiFi brand) truly is. The entire ecosystem, from the Shopify Storefront to the AWS backend, has been laid bare through an attack chain we recently finalized.
1. The Dev Token Fatal Flaw
We discovered an exposed Dev token (bd22faf8641a63b57178d93351c31663) that retains full administrative privileges over the Production environment at store.eero.com. With the write_customers scope, we successfully executed the following operations:
- Created new customer accounts on Production (ID: 8736934723638).
- Generated 42-day customer access tokens without any verification.
- Hijacked the checkout payment flow for high-value carts.
2. AWS Secrets Manager ARNs Exposure
Amazon’s engineering team inadvertently leaked sensitive ARNs within public JavaScript files:
- Stripe API Key: eero-com/test/stripe/api-key-iUss5l
- Shopify Admin Token: eero-com/test/shopify/us-admin-token-uobxPs
- AWS Account ID: 962437816249 (us-west-2)
3. Full WiFi Infrastructure Takeover (OTP Prefix Leakage)
The API at e2ro.com leaks the OTP prefix directly in the login response. This allows anyone to bypass 2FA and take over any account among the 2 million eero Plus subscribers, gaining absolute control over their home WiFi networks.
4. Internal Business Intelligence
We have also exfiltrated unreleased product catalogs, including the eero Signal (5G) and internal project codenames such as Andytown, Eden, and Snowbird.
And here is the punchline: do you really think I leaked this before "handling" your systems? What did I actually do? Did I hijack the payment gateways, ATO every user account, or am I currently commanding your entire WiFi infrastructure? The answers are already inside your system, if you are even capable of finding them.
And stay tuned--we are about to Microsoft 365 and Wickr. They will be 'on air' in just a few days.
The file below is the result of our operation.
https://gofile.io/d/0GSrjI
---Orcinus Orca---