#responsibledisclosure — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #responsibledisclosure, aggregated by home.social.
-
if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:
https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/
-
if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:
https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/
-
if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:
https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/
-
if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:
https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/
-
if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:
https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/
-
A real case: why response speed to a security report reflects company culture
Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.
Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.
We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.
Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.
A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.
Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.
Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.
The difference isn't about resources. It's about a culture of accountability.
Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.
#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics
-
A real case: why response speed to a security report reflects company culture
Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.
Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.
We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.
Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.
A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.
Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.
Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.
The difference isn't about resources. It's about a culture of accountability.
Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.
#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics
-
A real case: why response speed to a security report reflects company culture
Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.
Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.
We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.
Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.
A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.
Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.
Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.
The difference isn't about resources. It's about a culture of accountability.
Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.
#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics
-
A real case: why response speed to a security report reflects company culture
Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.
Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.
We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.
Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.
A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.
Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.
Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.
The difference isn't about resources. It's about a culture of accountability.
Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.
#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics
-
Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.
Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.
Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.
Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.
#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity
-
Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.
Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.
Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.
Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.
#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity
-
Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.
Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.
Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.
Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.
#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity
-
Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.
Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.
Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.
Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.
#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity
-
three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.
CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.
CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.
CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.
patched in 4.14.6.
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc
#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity
-
three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.
CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.
CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.
CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.
patched in 4.14.6.
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc
#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity
-
three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.
CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.
CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.
CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.
patched in 4.14.6.
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc
#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity
-
three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.
CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.
CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.
CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.
patched in 4.14.6.
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc
#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity
-
three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.
CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.
CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.
CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.
patched in 4.14.6.
https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2
https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc
https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc
#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity
-
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy
-
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy
-
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy
-
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy
-
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy
-
The vulnerabilities are gone. The shame lingers, soulbound, forever.
Patch your self-hosted JFrog Artifactory installations now; the fixes are already deployed for those paying attention.
Reward: You've received a Cursed Depot Key. Effects unknown. No refund button.
#ZeroDay #JFrog #Artifactory #VulnerabilityDisclosure #InfoSec #ResponsibleDisclosure (2/2)
-
The vulnerabilities are gone. The shame lingers, soulbound, forever.
Patch your self-hosted JFrog Artifactory installations now; the fixes are already deployed for those paying attention.
Reward: You've received a Cursed Depot Key. Effects unknown. No refund button.
#ZeroDay #JFrog #Artifactory #VulnerabilityDisclosure #InfoSec #ResponsibleDisclosure (2/2)
-
🙏 New Blog Post
The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.
What's exposed:
- Email addresses
- Names
- Country
- Date of birth (they call it "borned_date" lol)
- Account role (it's "PRAYER" for everyone, obviously)
Also found:
- Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
- Their verification emails fail their own domain's authentication requirements
Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.
Full writeup: https://bobdahacker.com/blog/click-to-pray
#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity
-
🙏 New Blog Post
The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.
What's exposed:
- Email addresses
- Names
- Country
- Date of birth (they call it "borned_date" lol)
- Account role (it's "PRAYER" for everyone, obviously)
Also found:
- Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
- Their verification emails fail their own domain's authentication requirements
Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.
Full writeup: https://bobdahacker.com/blog/click-to-pray
#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity
-
🙏 New Blog Post
The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.
What's exposed:
- Email addresses
- Names
- Country
- Date of birth (they call it "borned_date" lol)
- Account role (it's "PRAYER" for everyone, obviously)
Also found:
- Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
- Their verification emails fail their own domain's authentication requirements
Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.
Full writeup: https://bobdahacker.com/blog/click-to-pray
#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity
-
🙏 New Blog Post
The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.
What's exposed:
- Email addresses
- Names
- Country
- Date of birth (they call it "borned_date" lol)
- Account role (it's "PRAYER" for everyone, obviously)
Also found:
- Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
- Their verification emails fail their own domain's authentication requirements
Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.
Full writeup: https://bobdahacker.com/blog/click-to-pray
#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity
-
🙏 New Blog Post
The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.
What's exposed:
- Email addresses
- Names
- Country
- Date of birth (they call it "borned_date" lol)
- Account role (it's "PRAYER" for everyone, obviously)
Also found:
- Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
- Their verification emails fail their own domain's authentication requirements
Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.
Full writeup: https://bobdahacker.com/blog/click-to-pray
#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity
-
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray
-
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray
-
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray
-
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray
-
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray
-
Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated -
Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated -
Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated -
Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated -
Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated -
Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.
#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE
-
Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.
#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE
-
Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.
#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE
-
Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.
#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE
-
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.
Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.
Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack
#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure
-
You demonstrate a fileless RCE chain. Complex delivery, in-memory execution, zero detections, confirmed working on multiple devices.
The vendor reviews it twice, involves engineering, then tells you:
"Your research demonstrates a complex chain for delivering and executing code."
...and closes it as 'intended behavior. Not a platform vulnerability.'
Question: is it a vulnerability?
Follow-up: does your answer change if the attack surface exists *between* components — where no single owner's scope definition covers the full chain?
Asking because I have a paper dropping soon about that.
#VRP #responsibleDisclosure #semanticGap #infosec #securityResearch