
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
The EyeFi cards include both some 2-8GB of SDHC storage and an embedded microprocessor with WiFi (802.11bgn) that can upload images as soon as they have been captured. While the software bundled with the cards is closed and Win/OSX only, the protocol is decently clean SOAP (like XML RPC via HTTP) and can be implemented with twisted and soappy.
After associating with one of the configured wireless networks,
the card authenticates a session with the server. The shared
secret needs to be obtained from the settings of the Win/OSX
application. The server can cope with multiple cards that are
identified by their MAC address. After authentication, the card
pushes the images that have not yet been posted to the server.
The server unpacks the tarred bundle (optionally in a directory
per MAC address). It then resolves the wireless networks that were
logged by the card at the time the picture was taken into a
geolocation using the Google API. The geolocation data is stored
in an XMP sidecar. Finally, you can trigger your own scripts
on complete upload, extraction and tagging.
FAQs
EyeFi Server Framework
We found that eyefi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.