Responsible Disclosure: Chrome security bug let tabs draw over each other ($1k bounty)

by @edent | , , , , | 1 comment | Read ~1,105 times.

The Google Logo.

Chrome for Android had a flaw which let one tab draw over another - even if the tabs were on completely different domains. A determined attacker might have been able to abuse this to convince a user to download and installed a spoofed app. See Chrome Bug #1242315 for details. Demo Here's a video of…

Full Disclosure: XSS in Getty Images

by @edent | , , , | 3 comments | Read ~570 times.

Javascript popup on the Getty Images website.

I've spent two months trying to report this issue to Getty images. They haven't responded to my emails, phone calls, Tweets, or LinkedIn messages. I've tried escalating through OpenBugBounty and HackerOne - but still no response. I've taken the decision to fully disclose this XSS because the Getty Images sites accept payments from users -…

Responsible Disclosure - John Lewis

by @edent | , , , | 1 comment | Read ~749 times.

John Lewis Website with a big circle drawn on it.

The HTML5 specification is complicated. I've been an author on it, and even I couldn't tell you all the weird little gotchas it contains. Between that and "idiosyncratic" browser engines, it's a wonder the world wide web works at all. Let's talk about the humble <meta> element. As its name suggests, it contains metadata about…

Even Google forgets to renew its domains

by @edent | , , , , | 13 comments | Read ~32,880 times.

Domain showing as available to purchase.

tl;dr Google forgot to renew a domain used in their documentation. It was mildly embarrassing for them. And possibly a minor security concern for some new G-Suite domain administrators Background Choosing a good example domain, to use in documentation, is hard. You want something which is obviously an example, so that users understand they have…

Responsible Disclosure: SVG injection in Three.co.uk

by @edent | , , , , , | 4 comments | Read ~539 times.

The website has a circle drawn on it.

Here's a quick write-up of a minor XSS (Cross Site Scripting) vulnerability on the website of Three.co.uk - one of the UK's mobile providers. A brief recap... Most websites have a search function. If you search for something which cannot be found, the site will often say "No results found for XYZ." If we can…

€100 Bug Bounty from Intigriti - please stop tracking your confirmation emails!

by @edent | , , , , | 1 comment | Read ~529 times.

Weird confrimation address.

There's a new bug bounty provider in town! The Belgian company Intigriti. This is a quick write-up of how I found a trivial bug in their own system. The EU has announced that it is providing funding for bug bounties on critical open source projects. They've split the programme between HackerOne and Intigriti. I signed…

$3k Bug Bounty - Twitter's OAuth Mistakes

by @edent | , , , , | 4 comments | Read ~15,688 times.

A Twitter login screen. Highlighted is the information that it cannot access your DMs.

Imagine the scenario. You're trying out some cool new Twitter app. It asks you to sign in via OAuth as per usual. You look through the permissions - phew - it doesn't want to access your Direct Messages. You authorise it - whereupon it promptly leaks to the world all your sexts, inappropriate jokes, and…

Responsible Disclosure: CloudFlare - more interested in tracking than security

by @edent | , , , | 2 comments | Read ~519 times.

A confirmation email asking me to click on a link,

CloudFlare claim they want to secure the web - but they seem more interested in tracking their customers than giving them decent security. Upon registering with the Internet giant, users are encouraged to confirm their email addresses. So far, so standard. This is the confirmation message CloudFlare sends out: Looks good! Hey! I wonder where…

Udacity Bug Bounty - or, please stop tracking every link in your emails

by @edent | , , | 2 comments | Read ~850 times.

Clicking on the button shows an insecure web address.

Look, I know your company wants metrics. I know your boss wants to see the exact percentages of people who click on links in your emails. Your sales team are desperate to track conversions. Someone wants to optimise your funnel for reasons which are unclear to you, a lowly engineer. So you make the mistake…

Self-inflicted Denial of Service on GitHub (Disclosed)

by @edent | , , | Read ~202 times.

I've found an interesting, but low severity, way for a malicious user to selectively deny access to specific GitHub issues and Pull Requests. This doesn't affect the whole site - just targeted pages. It doesn't require elevated permissions, nor any special skills. This is just GitHub punching itself in the face. Here's how it works.…