Hacking, AppSec, and Bug Bounty newsletter
2017-06-29 | NotPetya is Not Ransomware, CTF alert, and Stackhackr
Thursday, June 29
Petya.2017 is a wiper not a ransomware. Matt makes a case that the purpose was a lure to control the media narrative, purely destructive and not for explicit financial gain. Kaspersky agrees, saying “we have thought that the threat actor cannot decrypt victims’ disk, even if a payment was made.” Hence, wiper.
Stored XSS in comments on starbucks.uk.blog [17 upvotes] - $500 bounty for this report to Starbucks by @bayotop. Google dorking FTW.
CTF alert: https://h1702ctf.com/. Come join us in Vegas. The game is afoot beginning 2017-07-01.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity
TWEET OF THE DAY
Regular ransomware authors must be terribly frustrated that NotPetya did damage to their reputation of "pay and you'll get your files back". - @martijn_grooten
OTHER ARTICLES WE’RE READING
Petya: Same same, but different
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: firstname.lastname@example.org
Get this email forwarded to you? Click here to subscribe to the Zero Daily
Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process