Posts
2428Following
590Followers
1310Heretek of Silent Signal
repeated
BrianKrebs
briankrebs@infosec.exchange
At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week. Squarespace bought all assets of Google Domains a year ago, but many customers still haven’t set up their new accounts. Experts say malicious hackers learned they could commandeer any migrated Squarespace accounts that hadn’t yet been registered, merely by supplying an email address tied to an existing domain.
From the story:
"...an analysis released by security experts at Metamask and Paradigm finds the most likely explanation for what happened is that Squarespace assumed all users migrating from Google Domains would select the social login options — such “Continue with Google” or “Continue with Apple” — as opposed to the “Continue with email” choice.
Taylor Monahan, lead product manager at Metamask, said Squarespace never accounted for the possibility that a threat actor might sign up for an account using an email associated with a recently-migrated domain before the legitimate email holder created the account themselves.
“Thus nothing actually stops them from trying to login with an email,” Monahan told KrebsOnSecurity. “And since there’s no password on the account, it just shoots them to the ‘create password for your new account’ flow. And since the account is half-initialized on the backend, they now have access to the domain in question.”
6
13
0
repeated
Yellow Flag
WPalant@infosec.exchangeIt has been a while since I’ve written about Avast, so today I give you “How insecure is Avast Secure Browser?”
https://palant.info/2024/07/15/how-insecure-is-avast-secure-browser/
Note: This isn’t a vulnerability disclosure, merely an overview of problematic design decisions.
TL;DR from the article: I wouldn’t run Avast Secure Browser on any real operating system, only inside a virtual machine containing no data whatsoever.
Some highlights:
- Eleven pre-installed browser extensions but only two visible to users.
- Two extensions unnecessarily relax Content-Security-Policy protection.
- One of these two extensions also requesting all privileges possible, despite not actually using them.
- Two extensions accept messages from any other extension and any Avast website, the latter without enforcing HTTPS connections.
- One of these extensions, Privacy Guard (sic!), will expose information about your browser’s tabs via that messaging interface and provide updates as you browse the web.
- The “onboarding” experience is designed as an extremely flexible way to nag you into using products that benefit Avast financially.
- To make this “onboarding” work, the browser exposes internal APIs to a number of Avast domains that a huge number of third parties can put content on. Not only can each of these third parties abuse this access, a single XSS vulnerability will extend the access to any website on the internet (no effective CSP protection).
Enjoy!
2
5
0
repeated
Kellerman Raynberg
deadblackclover@functional.cafeA Brief Retrospective on SPARC Register Windows
https://danielmangum.com/posts/retrospective-sparc-register-windows/
0
4
0
buherator
buheratorhttps://hackaday.com/2024/07/15/linksys-velop-routers-caught-sending-wifi-creds-in-the-clear/
0
3
1
repeated
Thinkst Canary
ThinkstCanary@mastodon.sdf.orgWe love Open Source contributors.
If you are a significant contributor to an Open Source project, DM us, and we will give you a full briefings pass to BlackHat USA (absolutely free).
__
* Tickets handed out totally at our discretion;
** We only have a few tickets left;
0
3
0
repeated
Mattias Wadman
wader@fosstodon.orgfq 0.12.0 released 🥳 nothing fancy, REPL and jpeg fixes otherwise mostly update of dependencies.
0
2
0
buherator
buheratorInteresting thread on safe crash handling in the light of signal handler races
https://www.openwall.com/lists/oss-security/2024/07/12/1
0
1
2
buherator
buheratorhttps://hackaday.com/2024/07/14/a-64-bit-x86-bootloader-from-scratch/
0
0
0
buherator
buheratorhttps://hackerone.com/reports/2585385
0
0
0
buherator
buheratorhttps://hackerone.com/reports/2585381
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.
0
0
0
repeated
samczsun
samczsun@infosec.exchangeSpent the last four days coordinating incident response for the Squarespace domain hijackings with @tay and @AndrewMohawk. Now that it seems to be resolved, we wrote a little postmortem/retrospective
1
3
0
repeated
HyperDbg
hyperdbg@infosec.exchangeStarting from v0.10 (the next version), HyperDbg uses @keystone_engine as its assembler. ❤️
Thanks to our new team member @AbbasMasoumiG for adding it.
The following commands are added to assemble virtual and physical memory:
1
1
1
repeated
Marco Ivaldi
raptor@infosec.exchangeClever & fun technique to dump #Windows LSA secrets bypassing #EDR by @sensepost
Dumping LSA secrets: a story about task decorrelation
https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
0
5
1
buherator
buherator
0
0
2
buherator
buheratorhttps://blog.trailofbits.com/2024/07/12/announcing-aes-gem-aes-with-galois-extended-mode/
0
0
2
buherator
buheratorhttps://soroush.me/blog/2024/06/mongodb-nosql-injection-with-aggregation-pipelines/
0
0
0
buherator
buheratorhttps://ssd-disclosure.com/ssd-advisory-sonicwall-sma100-stored-xss-to-rce/
0
1
1
repeated
Marco Ivaldi
raptor@infosec.exchangeIntroduction to the Wild West of Proof of Concept #Exploit Code (#PoC) aka SSHing the Masses
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
1
2
0
repeated
