Friday, April 5
TOP STORY
RCE via SSTI in Handlebars was reported to Shopify by @Zombiehelp54 during the h1-514 live hacking event as an “almost bug” last October. The hacker continued testing and achieved RCE. Love this. See Zombiehelp54’s full writeup for more details.
TWEET OF THE DAY
First rule of "breach response fight club:" NEVER, EVER lie to a reporter. Second rule: funneling your lies through a PR firm makes you look worse - @MalwareJake
OTHER ARTICLES WE’RE READING
Great blog by NCC Group: Use of Deserialisation in .NET Framework Methods and Classes, comes recommended by @infosec_au
Bromium maps out a malware distribution network, including malware hosted on US soil
SwissPost halts e-voting plans. Good review by The Daily Swig’s James Walker
Doyensec presented at Black Hat Asia: two examples of Electron “insecure preload” vulnerabilities affecting Wire App and Discord.
Ongoing DNS hijacking campaign targeting consumer routers reported by BadPackets
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
“The most rewarding thing about sharing research is seeing other people surpass it.”