Legal Robot: Missing Issuer parameter on TOTP 2FA

During our 2FA challenge, a security researcher discovered that the Issuer parameter was not set in the TOTP URL that gets turned into a QR Code. While there is no direct security impact, it does make 2FA software tokens more difficult to manage...

Legal Robot: [New Feature] Password history check

A security researcher discovered that old passwords could be reused and suggested that Legal Robot check new passwords against previous passwords. i discovered that old passwords could be reused and suggested that Legal Robot check new passwords against previous passwords. i really thank legal...

Legal Robot: Users with 2FA can have multiple sessions

While going live with additional 2FA options, a security researcher discovered that users that had enabled 2FA no longer executed regular logon hooks. Most of Legal Robot's logon hooks have no security impact, but one action logs out other sessions when a new session begins. While there is no...

Legal Robot: Account profile shows encryption recovery box for all users

A security researcher discovered that the encryption recovery section on the Legal Robot account profile page was shown to all users, even those that were not using the feature. There was no security impact from any user seeing or using the feature - quite the opposite, in fact. However, when...

Legal Robot: Enhancement: email confirmation for 2FA recovery

While searching for other issues, a security researcher proposed an enhancement to our 2FA account recovery: require email verification for 2FA recovery use. We implemented this change and thank @goodhackonly for an excellent suggestion that makes Legal Robot even more secure...

Legal Robot: 2FA user enumeration via password reset

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...

Legal Robot: Missing link to TOTP manual enroll option

While going live with additional 2FA options, a security researcher discovered that during TOTP enrollment, only a barcode was displayed to users, no TOTP manual enroll option with a printed base32 secret was provided for non-smartphone users...

ALPINE-CVE-2017-9347

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID...

Watch Hackers Sabotage an Industrial Robot Arm

Researchers were able to take control of a 220-pound robotic arm to damage the products it manufactures---or the person that operates it. The post Watch Hackers Sabotage an Industrial Robot Arm appeared first on WIRED...

Weblate: 7BO: Binary Option Robot URL should be HTTPS

SUMMARY This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Not really a security bug, but I think will be a good idea to add HTTPS on 7BO: Binary Option Robot Button. Navigate this URL:...

CVE-2016-1148

Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates...

CVE-2016-1148

CVE-2016-1148 affects Akerun – Smart Lock Robot App for iOS prior to v1.2.4, where the iOS app fails to verify SSL server certificates. This undermines TLS trust and can enable a man-in-the-middle attack to eavesdrop on encrypted traffic. The issue is documented in multiple sources (including JVN...

Legal Robot: Big XSS vulnerability!

Here you can see that XSS but which is openly redirectable.. Plz fix it and pay me bounty...

Legal Robot: sql injection vulnerablity found

a Blind Text Injection Differential vulnerablity was found on your site in the url :https://www.legalrobot.com/assets/icons a GET request made on GET /assets/icons/?v=9wr1emhXD568%3B'%20UNION%20SELECT%208%2C%20tablename%2C%20'vega'%20FROM%20informationschema.tables%20WHERE%20tablename%20like'%25...

Robots Rife With Cybersecurity Holes

Robots with inadequate security could be hacked and cause physical harm or be used to spy on unsuspecting owners in the near future. Researchers at IOActive Labs released a report Wednesday warning that consumer, industrial and service robots in use today have serious security vulnerabilities...

Legal Robot: S3 ACL misconfiguration

Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...

Legal Robot: Missing restriction on string size in profile fields

Security researcher reported that there was no restriction on the amount of text that could be inserted into a user's profile field. The researcher also demonstrated that when the text size was large enough the service was restarted, resulting in a momentary outage in our non-production environme...

Google Explorer - Google Mass Explorer

+Google Mass Explorer This is a automated robot for google search engine. Make a google search, and parse the results for a especific exploit you define. The options can be listed with --help parameter. Intro: This project is a main project that i will keep upgrading when new exploits are...

Legal Robot: Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy

While password complexity requirements were implemented in the original signup page, these were not added to the password reset page. Thanks to this security researcher's efforts, we've added this functionality there as well...

Legal Robot: Information Disclosure on rate limit defense mechanism

Security researcher showed that we were returning the number of seconds to wait between attempts. While this can be helpful for legitimate users, it's more likely to be exploited by attackers that simply need to set a timer for the number of seconds we return in the error message...