Thursday, August 23
TOP STORY
The Democratic National Committee said there was an attempted breach on its voter database but it turns out it was just a test by the Michigan Democratic Party.
TWEET OF THE DAY
People speak about the "security poverty line", but the harsh truth is that there is an "engineering poverty line" in tech, and many large, world-famous companies fall below it. Good security is normally a result of healthy IT engineering culture & competence …. - @halvarflake
OTHER ARTICLES WE’RE READING
Tavis reports more Ghostscript Issues: TL;DR: Tavis urges that distributions start disabling PS, EPS, PDF and XPS coders in policy.xml by default.
Ryuk Ransomware: A Targeted Campaign Break-Down research by Checkpoint
Senate Rules Committee postponed markup of the Secure Elections Act, and Alex Stamos says It’s Too Late to Protect the 2018 Elections, so let’s prepare for 2020 in a Lawfare guest blog.
Victor Gevers: this will end bad. Over 38 thousand Elasticsearch servers are vulnerable, some leaking sensitive data belong to big IT / Security companies.
Spyfone spyware left several terabytes of “unencrypted camera photos” in a poorly-protected Amazon S3 bucket.
The Verge reports on insider trading schemes based on accessing unpublished press releases from business newswires and selling them, via middlemen, to stock traders for a cut of the profits from the short or long trade. Actors involved could have been responsible for the SEC’s EDGAR filing system breach that continued from October 2016 to April 2017.
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
What I thought infosec would be: hack all the things, 0days, owning the red team, rollerblades
What infosec is: meetings, SMBv1, Splunk, having strong opinions about teledildonics.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.