Thursday, January 25
TOP STORY
Big tech companies get (deeper) into the cybersecurity business. Chronicle by Alphabet and Amazon acquired security startup Sqrrl. MIT wonders, is this a good thing? Bruce Schneier would probably say no.
HACKTIVITY
Authenticated DOM-based XSS in deals.razerzone.com via the rurl parameter. [10 upvotes] - no bounty for this report to Razer US by @edio.
POST XSS in careers.razerzone.com via the txt_email parameter. [10 upvotes] - no bounty for this report to Razer US by @edio.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity
TWEET OF THE DAY
ICYMI: Dept of Commerce drafted a report on botnets & other distributed, automated attacks, w significant attention to addressing IoT Security. We need your input on making it better, esp. on actions & next steps!... - @allanfriedman
OTHER ARTICLES WE’RE READING
Slides by Mathy Vanhoef about the #KRACK attack against WPA2 including some of his thoughts and remarks on multi-party vulnerability coordination (slides 40 - 44).
Rules and targets for Pwn2Own 2018 announced
Hacker101: Free class for web security by @daeken
Cyber Incident and Breach Trends Report by Online Trust Alliance. See Politico’s notes for the highlights.
ICO funded projects hit by 100 cyber attacks a month according to Group IB
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
Never forget: when trying to explain a bad organizational outcome, incompetence is usually the better explanation than malevolence.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.