Friday, April 21
TGIF!
TOP STORY
Design flaws in Lastpass 2FA implementation. Stored QR codes lead to pwnage. Passwordhash = Lastpass is storing the 2FA secret seed under a URL that can be derived from your password.
HACKTIVITY
CSRF Token Bypass in Account Deletion [5 upvotes] - no bounty for this report to GitLab by @7h0r4pp4n. Out of scope bug but great teamwork and communication stream. TLDR: Warden vulnerability was verified and patch released.
Race Condition Vulnerability On Pornhubpremium.com [6 upvotes] - $520 bounty for this report to Pornhub from @jaydipm. Exploit allowed the hacker to use gift codes across multiple accounts.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity.
OTHER ARTICLES WE’RE READING
The DEA aint no NSA. $575K for 0-days from Hacking Team and a 1 for 17 batting average.
Tanium demo “We’ll show you everything you want to see. Everything.”
The “how to hack while in federal prison toolkit”. Thanks Lifehacker.
The Internet of Trouble, complements of the Internet of Things.
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Hacking just means building something quickly or testing the boundaries of what can be done. Like most things, it can be used for good or bad, but the vast majority of hackers I’ve met tend to be idealistic people who want to have a positive impact on the world.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty solutions encompass vulnerability assessment, crowdsourced security testing and responsible disclosure management. Discover more about our hacker powered security testing solutions or Contact Us today.