ZERO DAILY

Hacking, AppSec, and Bug Bounty newsletter

2017-08-14 | RE Malware 101, unserialize(), and APT Trends Report

Monday, August 14

Make it a great week!

TOP STORY

  • Reverse Engineering Malware 101 by @malwareunicorn. Learn fundamentals, malware techniques, RE tools, triage analysis, static analysis, and dynamic analysis.

HACKTIVITY

You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity

TWEET OF THE DAY

  • PSA: Don't use unserialize() on untrusted input (see http://php.net/unserialize )
    PHP will no longer treat unserialize() bugs are security bugs. - @nikita_ppv

OTHER ARTICLES WE’RE READING

ABOUT ZERO DAILY

Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.

Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?

Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com

Get this email forwarded to you? Click here to subscribe to the Zero Daily
 

Treating unserialize issues as security creates the false sense that we expect it to be secure, when we absolutely don't. We'll continue fixing these bugs of course, But after discussing it on the security mailing list, we decided to finally stop treating those as security issues. Unserialize is inherently insecure, people should know it and act accordingly.

Zeev Suraski