#responsibledisclosure — Public Fediverse posts

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

Bedtime Bug Hunting at BSides Belfast 🐛

A magic-link login, one badly timed Back button and a very unexpected result.

No fancy tools—just curiosity, testing assumptions and thinking like a real user.

Thanks to everyone who came along and to the BSides Belfast team. Recording coming soon.

https://bsidesbelfast.org/schedule/

#BSidesBelfast #CyberSecurity #AppSec #MobileSecurity #ResponsibleDisclosure

if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:

https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/

#responsibledisclosure #3DPrinting

if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:

https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/

#responsibledisclosure #3DPrinting

if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:

https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/

#responsibledisclosure #3DPrinting

if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:

https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/

#responsibledisclosure #3DPrinting

if you're using #lychee slicer by #Mango3D, you might want to change your email address to something random:

https://ghost.orkpiraten.de/security-issue-at-mango3d-lychee-slicer/

#responsibledisclosure #3DPrinting

A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.

#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics

#virgroup

A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.

#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics

#virgroup

A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.

#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics

#virgroup

A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.

#CyberSecurity #ResponsibleDisclosure #MobileSecurity #InfoSec #TechEthics

#virgroup

Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.

#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity

Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.

#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity

Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.

#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity

Spent about two hours doing reverse engineering on an app with 5M+ downloads, just to check how other devs handle security compared to my own products.

Found 6 real vulnerabilities, some critical. Client-side premium status checks, trusted user certs in a production build, a secret key baked right into the compiled code - the kind of stuff that should get caught in code review.

Reported everything privately to the dev team, no pressure, no public disclosure. Not naming the app - the point isn't to call anyone out, it's that even apps with millions of users ship basic security mistakes.

Good reminder to keep auditing my own stuff too. Security isn't a checkbox, it's a habit.

#AppSecurity #ReverseEngineering #MobileSecurity #InfoSec #AndroidDev #ResponsibleDisclosure #CyberSecurity

three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

patched in 4.14.6.

https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc

https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc

#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

patched in 4.14.6.

https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc

https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc

#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

patched in 4.14.6.

https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc

https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc

#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

patched in 4.14.6.

https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc

https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc

#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

three critical (9.1) advisories for wazuh i reported were published today. same trust assumption broken in three places: the cluster fernet key authenticates membership, and the cluster protocol then lets that peer pick filesystem paths.

CVE-2026-49441: the peer-supplied metadata key in process_files_from_worker is used directly as the destination path. write etc/ossec.conf, root rce via wazuh-logcollector.

CVE-2026-48024: same function, merged-file branch. traversal in the merged header name and in merge_type.

CVE-2026-48162: the DAPI tmp_file field is joined to WAZUH_PATH with os.path.join and shipped back to the peer. absolute paths win, so it reads anything the wazuh user can open. grab private_key.pem, forge ES512 admin jwts offline. survives cluster key rotation, since the jwt keypair is a different scope.

patched in 4.14.6.

https://github.com/wazuh/wazuh/security/advisories/GHSA-3v57-hgvj-3vj2

https://github.com/wazuh/wazuh/security/advisories/GHSA-gh4h-fx78-q8xc

https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc

#Wazuh #InfoSec #CVE #SIEM #ResponsibleDisclosure #CyberSecurity

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.

What's exposed:

• Creator emails, conference IDs, recording status, timestamps
• Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
• Government meetings from 23 countries
• Corporate meetings from thousands of companies

Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.

Full writeup: https://bobdahacker.com/blog/tldv-hack

#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy

The vulnerabilities are gone. The shame lingers, soulbound, forever.

Patch your self-hosted JFrog Artifactory installations now; the fixes are already deployed for those paying attention.

Reward: You've received a Cursed Depot Key. Effects unknown. No refund button.

#ZeroDay #JFrog #Artifactory #VulnerabilityDisclosure #InfoSec #ResponsibleDisclosure (2/2)

The vulnerabilities are gone. The shame lingers, soulbound, forever.

Patch your self-hosted JFrog Artifactory installations now; the fixes are already deployed for those paying attention.

Reward: You've received a Cursed Depot Key. Effects unknown. No refund button.

#ZeroDay #JFrog #Artifactory #VulnerabilityDisclosure #InfoSec #ResponsibleDisclosure (2/2)

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

🙏 New Blog Post

The Pope's official prayer app has an IDOR that lets anyone pull user data for all 719,517 accounts. One GET request per user. No auth check.

What's exposed:

• Email addresses
• Names
• Country
• Date of birth (they call it "borned_date" lol)
• Account role (it's "PRAYER" for everyone, obviously)

Also found:

• Signup endpoint returns the email verification token in the response body, so you can verify accounts without accessing the inbox
• Their verification emails fail their own domain's authentication requirements

Reported January 3rd. Emailed 9 people. A journalist also contacted them. Zero responses. Still live six months later. Vow of silence I guess.

Full writeup: https://bobdahacker.com/blog/click-to-pray

#InfoSec #BugBounty #ResponsibleDisclosure #IDOR #Security #CyberSecurity #Privacy #DataExposure #ClickToPray #Vatican #APISecurity

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

https://web.brid.gy/r/https://bobdahacker.com/blog/click-to-pray

Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated

Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated

Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated

Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated

Oh, look! An anonymous hero 🤡 on #GitHub is handing out unreported 0-days like candy, because nothing screams "responsible disclosure" quite like a digital piñata of exploits. 🎉 But hey, don't abuse them, they're just for "alluring" people. Yeah, right. 🙄
https://github.com/bikini/exploitarium #anonymoushero #0days #responsibleDisclosure #cybersecurity #HackerNews #ngated

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

Fileless RCE on stock Android (~2.5B devices). Reported to Google VRP, confirmed by their own engineering team, closed as NSBC anyway.

Full writeup:
https://www.researchgate.net/publication/407433163_Fileless_Code_Execution_via_Semantic_Gap_in_Android_WebView_Bridge_Architecture_A_Case_Study_in_Platform_Security_Boundary_Ambiguity

#AndroidSecurity #infosec #Android #MobileSecurity #VulnerabilityResearch #RCE #BugBounty #VRP #ResponsibleDisclosure #AppSec #ThreatIntel #WebView #ZeroDay #CVE

✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass.

Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse.

Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack

#InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure