ZERO DAILY
Hacking, AppSec, and Bug Bounty newsletter
2017-04-28 | Phrack is back, hug a hacker, and Alert (TA17-117A)
Friday, April 28
TGIF
TOP STORY
-
Extra! Extra! New Phrack Mag article just published today: VM escape - QEMU Case Study. Combination of CVE-2015-5165 (a memory-leak vulnerability) and CVE-2015-7504 (a heap-based overflow vulnerability) allows an attacker to break out from a VM and execute code on the target host.
HACKTIVITY
-
Stored XSS in community.ubnt.com [8 upvotes] - $500 bounty for this report to Ubiquity Networks by @vibhuti_i. Tenacity pays off (not beg bounty, mind you, valid arguments based on facts and good PoC’s :). Originally closed as informative, re-opened, bounty awarded. All lived (safely) happily ever after!
-
Subdomain takeover #2 at info.hacker.one [31 upvotes] for this report to ahem, HackerOne, by @ak1t4. Simple PoC and repeat of #202767.
LOTS of disclosed DoD reports on Hacktivity today, check it out.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity.
OTHER ARTICLES WE’RE READING
-
Meet the Nu-Nerds by Wired (complete with a fresh updated headline)
-
Hug a hacker: The time has arrived to embrace hackers
-
Foscam, fix your ish
-
That post-quantum cryptography is so hot right now
-
Alert (TA17-117A) | US-CERT security bulletin
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
During this work, we have probably crashed our testing VM more than one
thousand times.
