In late July, the government of Kazakhstan attempted to perform a mass man-in-the-middle attack on Kazakh citizens. Users of all Kazakh mobile networks were asked to install a government-issued CA certificate to continue using selected sites such as Google services, Facebook, and Instagram. Under global…
Author Archives Tomasz Andrzej Nidecki
THE AUTHOR
Tomasz Andrzej Nidecki
Principal Cybersecurity Writer
Principal Cybersecurity Writer
What Is a Reverse Shell
To gain control over a compromised system, an attacker usually aims to gain interactive shell access for arbitrary command execution. With such access, they can try to elevate their privileges to obtain full control of the operating system. However, most systems are behind firewalls and…
Instagram Awards a $30,000 Bounty for a Serious Flaw
Laxman Muthiyah, an Indian security researcher, earned $30,000 for finding a serious flaw in the Instagram password reset mechanism. If exploited, the flaw would have let an attacker gain control over any Instagram account in 10 minutes with an investment of approximately $150. The flaw…
Misconfiguration Causes a Leak of One Hundred Million Financial Records
According to a statement by Capital One released on July 19, an unauthorized party gained access to the company’s customer data: approximately 106 million individuals in the United States and Canada. Data was stored in Amazon S3 buckets but accessed using Capital One infrastructure. Capital…
Dynamic Program Analysis and Static Code Analysis in Web Security
There are two primary approaches to analyzing the security of web applications: dynamic program analysis (dynamic application security testing – DAST), also known as black-box testing, and static code analysis (static application security testing – SAST), also known as white-box testing. Both approaches have their…
How Regular Expressions and a WAF DoS-ed Cloudflare
Cloudflare is one of the biggest providers of content delivery network services in the world. On July 2, they experienced a nearly complete service outage that affected all of their customers and lasted approximately half an hour. This unprecedented event was not a result of…
Chrome Removes XSS Protection
On July 15, Google announced that the XSS Auditor module that protects Chrome users against Cross-site Scripting attacks is to be abandoned. It was found to be easy to bypass, inefficient, and causing too many false positives. A similar mechanism was previously used by Microsoft…
SQL Injection Compromises Entire Country
On July 16, the world found out that the tax data of millions of Bulgarian citizens have been stolen. The attacker sent half of the data as proof to many Bulgarian and international media sources. The stolen databases are already available for download via underground…
Does YouTube Ban Hacking Videos?
A wave of dissatisfaction with Google’s YouTube policies has recently spread around the ethical hacking community. On July 2, Kody Kinzie who runs the Null Byte channel on YouTube reported that he was denied the right to upload a new security video. This was because…