InfoSec Planet

See full content

See full content

See full content

See full content

President Biden has signed a new cybersecurity order. It has a bunch of provisions, most notably using the US governments procurement power to improve cybersecurity practices industry-wide. Some details: The core of the executive order is an array of mandates for protecting government networks based on lessons learned from recent major incidents­—namely, the security failures of federal cont [...]

See full content

See full content

Implementing API authentication is one of the most critical stages of API design and development. Properly implemented authentication protects data, user privacy, and other resources while streamlining compliance, preventing fraud, and establishing accountability. In fact, broken authentication is one of the leading causes of API-related breaches.  Ultimately, by applying robust authentic [...]

See full content

Yelp disclosed a bug submitted by mester_x: https://hackerone.com/reports/2891449 [...]

See full content

Internet Bug Bounty disclosed a bug submitted by leixiao: https://hackerone.com/reports/1707287 - Bounty: $8000 [...]

See full content

Is there nothing that squid research can’t solve? “If you’re working with an organism like squid that can edit genetic information way better than any other organism, then it makes sense that that might be useful for a therapeutic application like deadening pain,” he said. […] Researchers hope to mimic how squid and octopus use RNA editing in nerve channels that inter [...]

See full content

See full content

See full content

I am always interested in new phishing tricks, and watching them spread across the ecosystem. A few days ago I started getting phishing SMS messages with a new twist. They were standard messages about delayed packages or somesuch, with the goal of getting me to click on a link and entering some personal information into a website. But because they came from unknown phone numbers, the links did not [...]

See full content

Today, January 17, 2025, marks a pivotal moment for the EU financial sector as the Digital Operational Resilience Act (DORA) officially comes into effect. Designed to combat the growing threat of cyberattacks, DORA sets a new standard for cybersecurity resilience across financial institutions and their critical ICT service providers.  With cyberattacks costing the financial sec… [...]

See full content

See full content

Brave Software disclosed a bug submitted by syarif07: https://hackerone.com/reports/2888770 [...]

See full content

See full content

See full content

Residents across the United States are being inundated with text messages purporting to come from toll road operators like E-ZPass, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to set up convincing lures spoofing toll road op [...]

See full content

See full content

Posted by Erik Varga, Vulnerability Management, and Rex Pan, Open Source Security TeamIn December 2022, we announced OSV-Scanner, a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features, as well as expanding ecosystem support to 11 programming languages [...]

See full content

See full content

According to a DOJ press release, the FBI was able to delete the Chinese-used PlugX malware from “approximately 4,258 U.S.-based computers and networks.” Details: To retrieve information from and send commands to the hacked machines, the malware connects to a command-and-control server that is operated by the hacking group. According to the FBI, at least 45,000 IP addresses in the US h [...]

See full content

XVIDEOS disclosed a bug submitted by nagu123: https://hackerone.com/reports/2915502 - Bounty: $200 [...]

See full content

Open URL redirect vulnerabilities are easy to find as they are quite common in applications. This vulnerability type is also often considered a low-hanging fruit. However, as modern applications get more complex, so do the vulnerabilities. And that also makes it possible to escalate these lower-hanging fruits to higher-severity security issues. Just as we've seen how it is poss… [...]

See full content

Cosmos disclosed a bug submitted by julianor: https://hackerone.com/reports/2930811 - Bounty: $2000 [...]

See full content

See full content

See full content

Internet Bug Bounty disclosed a bug submitted by nyymi: https://hackerone.com/reports/2894283 - Bounty: $505 [...]

See full content

A very security-conscious company was hit with a (presumed) massive state-actor phishing attack with gift cards, and everyone rallied to combat it—until it turned out it was company management sending the gift cards. [...]

See full content

In an industry where security needs evolve as rapidly as the threats themselves, standing still isn't an option. At Intigriti, our commitment to innovation goes beyond mere product development – it's about making strategic investments in solutions that truly matter to our customers and the broader security community.  The voice of our customers: Shaping tomorrow's security solu… [...]

See full content

Microsoft today unleashed updates to plug a whopping 161 security vulnerabilities in Windows and related software, including three “zero-day” weaknesses that are already under active attack. Redmond’s inaugural Patch Tuesday of 2025 bundles more fixes than the company has shipped in one go since 2017. Rapid7‘s Adam Barnett says January marks the fourth consecutive month wh [...]

See full content

Flickr disclosed a bug submitted by himu_xjjj: https://hackerone.com/reports/2888001 [...]

See full content

This is a current list of where and when I am scheduled to speak: I’m speaking on “AI: Trust & Power” at Capricon 45 in Chicago, Illinois, USA, at 11:30 AM on February 7, 2025. I’m also signing books there on Saturday, February 8, starting at 1:45 PM. I’m speaking at Boskone 62 in Boston, Massachusetts, USA, which runs from February 14-16, 2025. I’m speaking at the Rossfest Symposium in Cambr [...]

See full content

Basecamp disclosed a bug submitted by shezxi: https://hackerone.com/reports/2686225 [...]

See full content

See full content

It was created in 1973 by Peter Kirstein: So from the beginning I put password protection on my gateway. This had been done in such a way that even if UK users telephoned directly into the communications computer provided by Darpa in UCL, they would require a password. In fact this was the first password on Arpanet. It proved invaluable in satisfying authorities on both sides of the Atlantic for t [...]

See full content

Nextcloud disclosed a bug submitted by offensiveops: https://hackerone.com/reports/2925666 [...]

See full content

Doppler disclosed a bug submitted by clubbable: https://hackerone.com/reports/2921905 [...]

See full content

Not sure this will matter in the end, but it’s a positive move: Microsoft is accusing three individuals of running a “hacking-as-a-service” scheme that was designed to allow the creation of harmful and illicit content using the company’s platform for AI-generated content. The foreign-based defendants developed tools specifically designed to bypass safety guardrails Microsof [...]

See full content

Reconnaissance is an important phase in bug bounty and in pentesting in general. As every target is unique and as we often do not have access to the code base, we'd need to come up with unique methods to gather useful and accurate data about our target to help us find vulnerabilities. In this article, we will be covering 7 overlooked reconnaissance techniques that you can apply… [...]

See full content

Trellix disclosed a bug submitted by r4v: https://hackerone.com/reports/2817658 [...]

See full content

See full content

See full content

See full content

News: A sponge made of cotton and squid bone that has absorbed about 99.9% of microplastics in water samples in China could provide an elusive answer to ubiquitous microplastic pollution in water across the globe, a new report suggests. […] The study tested the material in an irrigation ditch, a lake, seawater and a pond, where it removed up to 99.9% of plastic. It addressed 95%-98% of plast [...]

See full content

See full content

What is the Digital Millennium Copyright Act and what are the implications of its recent ruling for AI researchers? [...]

See full content

See full content

404 Media and Wired are reporting on all the apps that are spying on your location, based on a hack of the location data company Gravy Analytics: The thousands of apps, included in hacked files from location data company Gravy Analytics, include everything from games like Candy Crush to dating apps like Tinder, to pregnancy tracking and religious prayer apps across both Android and iOS. Because mu [...]

See full content

Extensibility in Burp Suite is about giving you and your team the power to customize, enhance, and extend Burp Suite to match your testing needs and objectives. This comprises a powerful suite of tool [...]

See full content

See full content

See full content

Welcome to the first Bug Bytes of 2025! Each month, we team up with bug bounty experts to bring you insights, platform updates, new programs, and upcoming community events—all to help you find more bugs! Latest Platform Updates Altera, an Intel company, has officially opened its public bug bounty program on our platform!     Ready to put your skills to the test and get rewarded… [...]

See full content

See full content

See full content

See full content

See full content

See full content

See full content

As we step into 2025, many of us are setting resolutions to improve, grow, and achieve more. At Intigriti, we’re doing the same—but with a twist. Our commitment isn’t just about us - it’s about you. When you invest in us, we invest in you.  This year, we’re kicking off a blog series to showcase how we’re doubling down on the areas that matter most to our customers. First up: Tr… [...]

See full content

See full content

See full content

APIs are the backbone of modern digital ecosystems, but their misuse can expose systems to cyber threats. Effective API throttling not only optimizes performance but also acts as a critical defense mechanism against abuse, such as denial-of-service attacks. Discover how this powerful strategy enhances API security and safeguards your organization’s data in an interconnected world.  What i [...]

See full content

MTN Group disclosed a bug submitted by tinopreter: https://hackerone.com/reports/2635315 [...]

See full content

MTN Group disclosed a bug submitted by tinopreter: https://hackerone.com/reports/2633959 [...]

See full content

MTN Group disclosed a bug submitted by tinopreter: https://hackerone.com/reports/2633888 [...]

See full content

Mozilla disclosed a bug submitted by jabiyev: https://hackerone.com/reports/2860983 [...]

See full content

Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound communications to their users, including emai [...]

See full content

See full content

See full content

Why ROI is not the most effective method to quantify cybersecurity investments — and how ROM can help. [...]

See full content

Mozilla disclosed a bug submitted by dotxml: https://hackerone.com/reports/2387297 [...]

See full content

See full content

See full content

See full content

See full content

See full content

Cross-site scripting (XSS) vulnerabilities are quite common and fun to find. They also carry great impact when chained with other vulnerabilities. But there's another variant of this vulnerability type that's not as easy or common to find as the other XSS types. Especially with the delayed execution and the hidden injection point, it makes it difficult for most hunters to searc… [...]

See full content

See full content

See full content

See full content

See full content

See full content

See full content

See full content

Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea. One of several se [...]

See full content

Internet Bug Bounty disclosed a bug submitted by saurabhb: https://hackerone.com/reports/2828271 [...]

See full content

Internet Bug Bounty disclosed a bug submitted by saurabhb: https://hackerone.com/reports/2828263 [...]

See full content

See full content

See full content

Image: Shutterstock, Dreamansions. KrebsOnSecurity.com turns 15 years old today! Maybe it’s indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024’s most engrossing security stories were about bad things happening to bad guys. It’s also an occasion to note that despite my publishing fewer stories than ever this past year [...]

See full content

See full content

Truecaller disclosed a bug submitted by marcotuliocnd: https://hackerone.com/reports/2493860 - Bounty: $500 [...]

See full content

Acronis disclosed a bug submitted by darkdream: https://hackerone.com/reports/2038943 - Bounty: $100 [...]

See full content

See full content

AWS VDP disclosed a bug submitted by zolaer9527: https://hackerone.com/reports/2894222 [...]

See full content

See full content

curl disclosed a bug submitted by scottarterbury: https://hackerone.com/reports/2912277 [...]

See full content

MTN Group disclosed a bug submitted by nhx1: https://hackerone.com/reports/2321874 [...]

See full content