InfoSec Write-ups

> Also, if most of your endpoints require auth, this is not typically a problem. Many systems are not sparse, and separately, that's simply wrong. Unguessable names is not a primary security measure, but a passive remediation for bugs or bad code. Broken access control remains an owasp top 10, and idor is a piece of that. Companies still get popped for this. See, eg, google having a bug in 2019, made significantly less impactful by unguessable names https://infosecwriteups.com/google-did-an-oopsie-a-simple-idor-worth-3…

I came across this writeup: https://infosecwriteups.com/pwndbg-gef-peda-one-for-all-and-all-for-on… It describes how to configure GDB with the GEF, PEDA and PWNDBG plugins. (I've only really used gdb-peda, would be great to get some time to learn the others)

That's rather alarmist and exaggerated. "Every plugin is a disaster". No it isn't. Shopify isn't immune to vulnerabilities: https://infosecwriteups.com/how-i-gained-access-to-revenue-and-traffic… I wouldn't recommend Shopify. Clunky, slow, overpriced. And business inventory shouldn't be outsourced and hosted on third party platforms. Self-managed solutions offer more options to scale and add features, customization and generally taking control over the way your business is presented online. This matters, and customers notice the confidence of a business owning its online presence. Doesn't need to be Wordpress, but even if it is, the option to use something like Snipcart is there if WooCommerce isn't wanted. No need to switch everything over to hosted solutions like Shopify. > "You can use a screwdriver as a hammer if you try hard enough, but that doesn't make it actually a hammer or the right tool to use." Not sure why you thought it necessary to expand "right tool, right job" into that longer version, but you're implying Shopify is the hammer. Why? Because it has "shop" in the name? They stack a bunch of technologies together just like everyone else. And with that comes attack surfaces and issues just like anyone else.

It is most likely this: https://wicg.github.io/local-network-access/ For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration. One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-r… XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world. Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.

The "AI" additions to Notepad are not limited to systems with an NPU. Why would they be, it's powered by LLMs running on Azure [0]. These sudden additions also correlated with the first CVE [1] in Notepad since its inception, so maybe their attention isn't where it should be. I for one very much mind this and many other inclusions including the metastatic takeover off Office. OneDrive also was forced upon and severely worsened functioning software, despite not being "AI", so there is precedent at least. [0] https://support.microsoft.com/en-us/windows/enhance-your-writing-with-… [1] https://infosecwriteups.com/the-dumb-editor-that-got-too-smart-when-fe…

It took me 4 years from learning to code and getting my first check. My writing from 4 years ago (at 16 yrs old) is extremely cringe but here's a link: https://infosecwriteups.com/how-i-earned-47000-usd-as-a-high-school-st… A lot of time has passed since then. There was a lot I didn't realize back then: - With the money I earned + another bounty I got a year later, I was able to actually move to the UK for uni, something my parents never could've afforded - Being known for reverse engineering was a huge factor in me getting 2 of my internships - Having the background knowledge in cybersecurity has helped immensely for me as a software engineer for problem solving - I am now building a startup in the cybersecurity space as a software engineer. No more relying on the good will of companies for bug bounties

Well, exfiltration via CSS is possible already: https://infosecwriteups.com/exfiltration-via-css-injection-4e999f63097… I don't see these new CSS features opening up privacy issues, though.

https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-r… https://news.ycombinator.com/item?id=20387298

This is the company that thought it was OK to install an always-on web server on my Mac. Apple pushed a special fix, just to remove it. I already have zero trust in them, and this does not change that. https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-r…

This is really incredible. With a rooted android phone and these tools, plus a couple others [1,2,3], you can get a skeleton to implement a backend for any app you want. [1]: https://github.com/koxudaxi/fastapi-code-generator [2]: https://github.com/ioxiocom/openapi-to-fastapi [3]: https://infosecwriteups.com/hail-frida-the-universal-ssl-pinning-bypas…

Several months ago I found a really interesting article by @avi_lum about the misconfigured services across the globe. https://infosecwriteups.com/how-i-discovered-thousands-of-open-databas… Then I got super curious to use the same strategy and build a pluggable NodeJS script that scans multiple ports in many CIDR blocks. You can find it from these links; https://github.com/tugkan/sk4ll https://www.npmjs.com/package/sk4ll

Oh, here we go! Just a week ago, thousands of unsecured databases on AWS! https://infosecwriteups.com/how-i-discovered-thousands-of-open-databas…

The package event-stream was compromised and went unnoticed for 60 days: https://medium.com/intrinsic-blog/compromised-npm-package-event-stream… The package axios was compromised, and hijacked the author's credentials, so every attempt at a fix was unfixed. https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compr… The xz utility was backdoored for 2 months: https://gigazine.net/gsc_news/en/20240403-timeline-of-xz-open-source-a… A student researcher took over Python ctx and PHPass package maintainership, pushing out malicious changes, and that took over 7 days to be detected and fixed: https://infosecwriteups.com/how-i-hacked-ctx-and-phpass-modules-656638… Kaspersky found multiple PyPI packages that had been exploited for more than a year: https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-year… "LoftyLife" packages were exploited for several months: https://securelist.com/lofylife-malicious-npm-packages/107014/ Now that the attack window has changed to 7 days, all new exploits like these will come with time bombs to not trigger until 8 days.

Zoom has long been the most unsecure video/voice application. Remember how they installed an open web server on people's computers which could be accessed by anyone through the web? https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-r… Apple had to step in and patch it for them: https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/ Or when they sent your chat data to Facebook? https://www.vice.com/en/article/zoom-ios-app-sends-data-to-facebook-ev… How it was discussed on HN: https://news.ycombinator.com/item?id=22703000 Or when Zoom was leaking private information? https://www.vice.com/en/article/zoom-leaking-email-addresses-photos/ Or do you remember how those geniuses rolled their own crypto? https://citizenlab.ca/research/move-fast-roll-your-own-crypto-a-quick-… Or maybe you remember that Zoom has the ability to listen in in real-time on meetings held on their platform? https://www.bbc.com/news/world-us-canada-55372493