hackerpain

Using it since a decade, I faced bugs in the PGP encryption add on, they need to work on a lot of things to make it secure. This is my go-to Jabber client.

How does this kind of vulnerability even remain, after code reviews?

Is it hard to spot?

This bug was found by my friend. David has found many creative bugs and we worked on a project together :)

Must say a quick thinker, and he's just 17 or 18.

I think ReCaptcha has been like this since at least last 6 years. Are they copying research?

https://www.youtube.com/watch?v=_RDXtILdkV0&persist_app=1&ap...

Please ignore

they haven't mentioned if an API (or, endpoint) is being DDoSed, just an incident update?

Indeed.

We spent like 12 years trying to create a medium sized business in electronics and we were at that time in an era when mobile phones were still getting popular. It was a nascent stage of refurb smartphone industry but even then it was a steep climb for us!

But there are companies operating in the same segment that started later, with VC and investor backing who rose quite fast.

That's quite hard because getting established in one trade in the industry itself takes a lot of time and effort.

Install code-server (https://github.com/cdr/code-server) on a server, and using it in your phone's browser to develop small web apps (works well in landscape mode with 6 -6.7 inch phones)

If you have a powerful processor and adequate RAM - you can do almost any thing that you do on desktop/pc

I am sorry but that can ruin your career as its illegal. You can't sell or, trade vulnerabilities on live websites like Google as per the terms and conditions of the Google VRP (Responsible Disclosure policy) while it may seem unfair, its illegal to do so.

docs.google.com didn't have X-Frame-Options: DENY nor a restrictive CSP so I think its a browser quirk (rather, a clever bypass) that works here. Also, the author had exploited a postMessage flaw which wasn't validating the host name properly that led to the cross-origin leak of screenshot data

Check this out https://youtu.be/KpkrTUHoWsQ (video about URL validation bypass and SOP)

Google VRP team has a tradition to reward 4 figure and 5 figure amounts to match 1337 or, L33T (Leet or, Elite).

Example bounty amounts - $1337, $3133.7, $13337 and $31337

this one technically requires some user interaction

Anyway, in the past I found a way to takeover an organization account in Google cloud acquisition and they rewarded me $100, saying their "Panel" decided that, Google's VRP panel sucks, so you're right about that.

SolarWinds earlier said the backdoored binaries were put into their servers in March 2020, and hinted that the breach happened in 2020 but seems like the breach happened way before.

See related thread regarding the 2018 credentials leak - https://news.ycombinator.com/item?id=25442734

Yes but how does that work? i have heard of unexploitable overflows how does that work?

and hey: Your username tricked me.

It's not. They may have a private program, don't know.

AWS now sends emails if you commit access keys, even better they are catching loads of other sensitive info having privileged access to the GitHub API. Cool and creepy at the same time, right?

The researcher added there may be some certificates exposed in that repo which may have been used to sign the binaries. It's still a relevant update.

Especially the information that the repo was archived by Web Archive back in 2018. It's not easy to know the "who" but the how can be speculated and investigated.

It's useful but yeah a ton of false positives :) Most common false positives appear to be the test values.

There's some new information released which mentions the github repo name, and since when the vulnerability has existed.

I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact.

How should I report it in your opinion?

Not if you use TruffleHog and GitGuardian.

wasn't even an SFTP I guess?

good old FTP

> We have been advised

Their advisor was smart enough to call it so.

The news and press defined the "attack sophistication". An attack of this scale definitely needs some amount of sophistication but on a difficulty scale of 1-10 to infiltrate their network, I would rate it a humble 0.5/10.

The article has mentioned its purely based on speculation, it doesn't claim - it was the cause. There has to be a bigger chain of attacks that led to the breach.

There was a case where we were able to gain access to Jira instance belonging to a bug bounty target (not even a Red Team engagement), and the Confluence wiki had every credential the company ever used. They used it as a secure credential storage. Majority of their internal panels didn't have a 2FA and we found internal VPN server credentials too (which didn't have source ip restrictions), so we could freely access tons of data. The bounty we got was around $1000 if I could remember, I think this would motivate a lot of hackers to not go the responsible disclosure way, as the incentives are ridiculously low.

But I could access literally everything related to that organization and their clients from that single Github leak (of Jira creds).

For basic live monitoring -- https://www.shhgit.com/

It's possible to monitor them while pushing code, and to have a monitoring system deployed to track them.

I was thinking of open-sourcing our GitHubSniper tool, it basically has API regex from nearly a thousand SaaS and PaaS services and frequently posted sensitive strings, can be deployed via docker ;)

The only thing that stops me from releasing it is I have consistently earned more in bounties than the incentives of actually releasing it publicly. But will eventually release it :)

Most no-code solutions are proprietary and it would be hard to optimize and maintain them. But it may work for smaller applications and mobile apps where you want to define a small set of feature.