Wednesday, January 3
TOP STORY
'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign. The fix will introduce notable performance penalties on Intel machines. Read more in the reddit thread.
HACKTIVITY
Android MailRu Email: Thirdparty can access private data files with small user interaction [8 upvotes] - $300 bounty for this report to Mail.Ru by @dzmitry.
Crafted frame injection leading to form-based UI redressing [14 upvotes] - $100 bounty for this report to Automattic by @edio.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity
TWEET OF THE DAY
Market self-regulation assumes (at least) 3 things not present in IoT market:
1 Buyers can distinguish among alternatives
2 Buyers can account for true cost and risk
3 Buyers/operators have recourse when reasonably foreseeable harms are not addressed - @beauwoods
OTHER ARTICLES WE’RE READING
Speaking of IoT: Botnet's Huawei router exploit code is now public
No more paperless voting machines? This bill would “drive a stake through the heart of paperless voting”.
"Host Tool", a Chrome extension for quickly changing between vhosts on bug bounty targets! By @_ruby.
CSRF in phpMyAdmin. PMASA-2017-9
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
Really, criminals are the only people on the planet who read the Terms of Service on websites. No one else reads them
The Original Internet Godfather
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.