Sakurity Blog

>1. how this works So if you are a developer, your best bet is "How it works?" here: https://github.com/sakurity/securelogin If you don't speak Ruby, hit me up I will dedicate all my time to help you.. and even get free audit as early adopter. FYI we conducted security audit for Auth0 (https://sakurity.com/) Actually by using auth0 you rely not on one central authority, but on two: auth0 and google/microsoft oauth. If _either_ of them is compromised, your users accounts are too. If that worries you, try SL: With SecureLogin you only rely on the local app user installs. First login friction? Not great, but is getting better, I'm giving it daily to normal users and it improves. > If this is just a communication of risks, then those are not being communicated Correct, that message is not very informative. I think it will be removed.

It is great to see them giving out real rewards. It is a big change from when I reported issues back in 2012[1] with them on the starbucks.com domains. They were very nice though, and did let me keep a $200 credit which was quite rare at that time. Also after they fixed it the SAME bug got reintroduced for some reason in 2015[2], and @homakov had the pleasure of reporting it again. At the time I do NOT think they had any actual bounty programs like they do now. I can only hope they now do proper regression testing for these types of issues. [1] https://chadscira.com/post/556999d91cb00914380006ee/Re-Starbucks-unlim… [2] http://sakurity.com/blog/2015/05/21/starbucks.html

Re-reading one of these[0] and seeing, > The unpleasant part is a guy from Starbucks calling me with nothing like “thanks” but mentioning “fraud” and “malicious actions” instead. Sweet! This is all too common these days. Remember when reporting a vulnerability was a great way to get a job? Yeah, those are so 2000s. Maybe there needs to be a campaign about responsible disclosures to encourage businesses to be accepting, not rejecting of these things. [0] http://sakurity.com/blog/2015/05/21/starbucks.html

+1 for homakov. Dude knows what's up. http://www.sakurity.com/

Not sure how many hours go into finding these sorts of vulnerabilities, but his rate of $150/hour[1] seems like a steal compared to the lost revenues he can prevent. [1] http://www.sakurity.com/

Here's the example I point people to when talking about transactions: https://sakurity.com/blog/2015/05/21/starbucks.html

1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html

I hope not as Service Workers is an awful technology. It is completely hostile to users. If I close a web page I expect everything related to that web page to stop. Immediately. I don't expect there to be lingering background threads consuming battery life, network data and disk storage. And in Chrome you can only discover service workers by enabling a Debug mode and memorising a specific URL. Exactly how does a non-developer figure out what is going on ? If Apple had any sense they would ban service workers and instead propose use case specific, tightly focused and managed APIs that focus on security and battery life first. Also just a hint at a future where Botnets are running in your browser: https://sakurity.com/blog/2016/12/10/serviceworker_botnet.html

Other blog entries suffer the same thing, for example https://sakurity.com/blog/2017/04/24/owasp.html

Also, do all of the companies linked to on https://sakurity.com/securelogin actually support this protocol? If not, linking to that page as "Who supports SecureLogin now?" is a bit disingenuous.

Exactly. Even the famed homakov's company delivers keys via HTTP: http://sakurity.com/contact this BS about HTTPS providing the illusion of security is nonsense. It's much harder to even do a protocol downgrade attack (and we have HSTS lists for those!) than it is to replace a single endpoint or key of a HTTP connection.

Egor Homakov strikes again. This guy is a machine, just look at the vulnerabilities he's found this year alone: http://sakurity.com/blog

I have never used a gift card at starbucks before, but that bill [0] doesn't make any sense to me. He says he has two cards: One has $15, one has $5. Card 3203 is billed $14.68 and card 6075 is billed $2.02. The remaining balance on card 3203 is $0, card 6075 has $5.70 remaining. If card 3203 had $15 and card 6075 had $5 before he used them, the remaining balance should have been $0.32 and $2.98, respectively... That's really me guessing, but it could be the $5 was just an example to explain the concept and in fact he used smaller values (e.g. $0.05) to be able to trigger the bug more often without generating too much cash... but he should have explained the bill somehow. [0] http://sakurity.com/img/sbcheck.jpg

The blog post by Egor describing the exploit: http://sakurity.com/blog/2015/05/21/starbucks.html

Here's the write-up from Homokov. The guy is a pen-testing genius: http://sakurity.com/blog/2015/03/15/authy_bypass.html But if you just want the money shot: http://sakurity.com/img/smsauthy.png Yes. Typing '../sms' in the field bypassed the 2nd factor. Just, wow.

Or at least, we can see that Ruby can have stupid security holes too, for example[0]. [0] http://sakurity.com/blog/2015/03/15/authy_bypass.html ("How "../sms" could bypass Authy 2 Factor Authentication".)

For some context, checkout homakov's compilation of white-hat "hustlers" and the bounties they've received: http://www.sakurity.com/hustlers

Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intideceukelaire - https://samcurry.net/ - https://stephensclafani.com/ - https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ - https://blog.assetnote.io/ - https://medium.com/@alex.birsan - https://cablej.io/ - https://jonbottarini.com/ - https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/.

The prevalence of XSS suggest that the web ecosystem has failed to produce the sort of tools you suggest. If such tools actually existed and were good, people would use them and web app exploits would be a curiosity rather than an expectation. However, no such tool exists. I think there's a deeper issue here: the sheer number of ways you can generate XSS alone, even ignoring the other exploit types, is far beyond what any tool is capable of stopping. Look at one of the XSS holes found by Homakov that I linked to from my article: http://sakurity.com/blog/2015/06/25/puzzle2.html The XSS occurs on this line of JavaScript, not HTML: $.get(location.pathname+'?something') That's a simple line of JQuery that does an XmlHttpRequest to the same page that was loaded with an additional parameter. By itself, it is not an XSS. But if the backend is/was running Ruby on Rails (presumably some old version by now) then it could turn into an XSS due to a combination of features that all look superficially harmless. Show me the tool that would have avoided that type of exploit, without already knowing about it and having some incredibly specific hardcoded static analysis rule. When I argue that the web is unsafe by design, it's because cases like that aren't rare, they're common. To paraphrase Veekun, scratch the surface of web security and you'll find yourself in a bottomless downward spiral, uncovering more and more horrifying trivia.

He never 'got a lawsuit.' Instead, he got some comments from the contact to whom he reported it that criticized his approach. It's not even clear just who this person was. It seems he had trouble locating a contact to report security issues to, so this may as well have just been a low level support rep who was in over his head and saying things he shouldn't have. "The hardest part - responsible disclosure. Support guy honestly answered there’s absolutely no way to get in touch with technical department and he’s sorry I feel this way. Emailing [email protected] on March 23 was futile (and it only was answered on Apr 29). After trying really hard to find anyone who cares, I managed to get this bug fixed in like 10 days. The unpleasant part is a guy from Starbucks calling me with nothing like “thanks” but mentioning “fraud” and “malicious actions” instead. Sweet!" http://sakurity.com/blog/2015/05/21/starbucks.html