A $50,000 Bug Could've Allowed Hackers Access Any Microsoft Account

Microsoft has awarded an independent security researcher $50,000 as part of its bug bounty program for reporting a flaw that could have allowed a malicious actor to hijack users' accounts without their knowledge. Reported by Laxman Muthiyah, the vulnerability aims to brute-force the seven-digit...

h1-ctf: [h1-415 2020] @_bayotop h1-415-ctf writeup

TL;DR: Thanks for the challenge! 1. Abusing account recovery via QR codes to get access to [email protected]. 2. Blind XSS in /support/review/ including CSP bypass. 3. Missing input sanitization on name parameter when POSTing to /support/review/. 4. Access to remote debugging port on local...

Microsoft Reports Cyberattacks on Targeted Email Accounts

The Microsoft Threat Intelligence Center MSTIC has released a blog post describing an increase in malicious cyber activity from the Iranian group known as Phosphorus. These threat actors are exploiting password reset or account recovery features to take control of targeted email accounts. The...

HackerOne: Account recovery text message is sending a wrong domain to users.

Hey, I hope you're fine. : Summary: When users setup Account recovery at Authentication section Hackerone sends them text message to their updated phone number with a wrong domain link. Description: When users adds phone number at Account recovery, they get a text message on their phone number,...

New Relic: Missing security best practices (leads to further impact)

Vulnerabilities:- 1.Use of old passwords is possiblecurrent password can be used as new password. 2.Email notification is not being sent to linked mail account while changing passwords steps to reproduce the two issues create account with password example badcracker@123 change password to...

Mail.ru: [account.mail.ru] XSS на странице восстановления пароля

При генерации формы восстановления пароля значение email подставляется туда как есть: https://account.mail.ru/recovery/support?email=%3Csvg%20onload=alertdocument.domain%3E Domain, site, application -- https://account.mail.ru/recovery/support Testing environment -- Firefox 60.0 Chrome 66.0 Steps ...

edmodo.com XSS vulnerability

Vulnerable URL: https://www.edmodo.com/account-recovery?username=...

Trend Micro Deep Discovery Director Command Injection Vulnerability

Trend Micro Deep Discovery is a protection product from Trend Micro that detects and identifies hard-to-find threats in real time and proposes solutions. director is one of the built-in solutions with the ability to update and upgrade various programs in Deep Discovery. A command injection...

Meh : CSRF in Facebook Delegated Account Recovery

Note this is going to be a quick post. This year, at Enigma 2017 Conference, Facebook introduced a way to move Account Recovery beyond Email and the "Secret" Question. After the presentation the moved operationally and presented the first integration partner : Github. These days I have seen a lot...

Facebook Offers a Better Way to Get Back Into Your Locked-Out Apps

At Facebook's F8 conference, the company outlined a refreshing alternative to the bad security questions that plague account recovery across the web. The post Facebook Offers a Better Way to Get Back Into Your Locked-Out Apps appeared first on WIRED...

Facebook Delegated Account Recovery SDKs Published for Java, Ruby Apps

Facebook’s Delegated Account Recovery, a protocol that allows applications to delegate account recovery permission to third-party applications, entered its beta phase today with the release of SDKs and additional support for new platforms. The feature has been running on a trial basis since late...

Facebook Unveils 'Delegated Recovery' to Replace Traditional Password Recovery Methods

How do you reset the password for your Facebook account if your primary email account also gets hacked? Using SMS-based security code or maybe answering the security questions? Well, it's 2017, and we are still forced to depend on insecure and unreliable password reset schemes like email-based or...

Facebook Tackles Account Recovery with Delegated Recovery Protocol

Account recovery, the second fiddle to authentication, still largely hinges on insecure schemes such as security questions or email-based verification for password resets and the like. Facebook today at the Enigma Conference in Oakland, Calif., offered a more modern solution called Delegated...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

phpyun 任意用户密码修改两处 (秒破/demo测试)

简要描述： 好久没看过php了。。。。 如题咯。 详细说明： 来看到找回密码的地方。 app/controller/forgetpwd/index.class.php function sendaction $username=yuniconv"utf-8","gbk",$POST'username'; if!$this-CheckRegUser$username&&!$this-CheckRegEmail$username $res'msg'=yuniconv"gbk","utf-8","用户名不符合规范！"; $res'type'='8'; echo...

Google My Account Privacy and Security Settings

Less than a week after announcing some welcome changes that keep Android mobile app permissions in check, Google on Monday announced a new privacy and security settings tool. My Account walks users through their Google account’s privacy and security settings, points out potential shortcomings and...

Security Questions Not So Secure

The Internet knows a lot about you, including your mother’s maiden name, your favorite food, and what street your first pet grew up on. And, according to some new research from Google, attackers have a good chance of figuring those things out pretty easily, too. The security questions that Google...

Account Recovery Vulnerability Patched in Gmail

A recent set of Google patches included a fix for a serious Gmail account recovery vulnerability, the details of which have been disclosed. Researcher Oren Hafifi of Israel points out in his disclosure that unlocking a Google password opens the door to much more than email, elevating the risk. “D...

Beware of Fraudulent Sites, phishing for Twitter accounts

There's a scam spreading through Twitter Direct messages DMs and fake emails, appealing users to visit a fake twitter phishing site i.e "twittler.com". Scam uses a hijacked Twitter account to send out direct messages that appear completely legitimate. Security blogger, Janne Ahlberg blogged about...

Facebook Issues Security Updates for Mobile App

The Facebook security team is adding some new security features to the social network’s mobile applications, including upgrades to the login mechanism and account recovery options. The first addition is an update to Facebook’s existing login approval mechanism, which they are calling ‘code...