Monday, April 2
TOP STORY
What happened to southern hospitality? The sad irony of Georgia's state legislature passing S.B. 315 is that its capital city is in the midst of a cybersecurity crisis. EFF calls the bill an anti info-sec law.
HACKTIVITY
Unintentional file creation caused at Tempfile with directory traversal [12 upvotes] - $500 bounty for this report to Ruby by @ooooooo_q.
`protobufjs` is vulnerable to ReDoS when parsing crafted invalid *.proto files [9 upvotes] - no bounty for this report to Node.js third-party modules by @chalker.
You can see all the latest and greatest disclosures and bounties on www.hackerone.com/hacktivity
TWEET OF THE DAY
The nightmare voting security scenario for a democracy isn't just stolen elections, but disrupted elections, where there's disagreement about who takes office. Current electronic voting systems aren't designed to effectively resist this, especially when state actors are involved. - @mattblaze
OTHER ARTICLES WE’RE READING
Yevgeny Nikulin, the Russian hacker accused of breaching LinkedIn, Dropbox and Formspring was extradited to the US. Cyberscoop’s Patrick Howell O’Neill was at his hasty hearing.
1.1.1.1 by Cloudflare: the fastest, privacy-first consumer DNS service. Follow more on #1dot1dot1dot1. Daniel Miessler wishes it did security filtering as well.
Saks Fifth Avenue and Lord & Taylor breach (5 million credit cards stolen)
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
Get this email forwarded to you? Click here to subscribe to the Zero Daily
While lawmakers did make a major concession by exempting terms of service violations under the measure—an exception we’ve been asking Congress for years to carve out of the federal Computer Fraud & Abuse Act (CFAA)—the bill stills fall short of ensuring that researchers aren’t targeted by overzealous prosecutors.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.