A week in security (July 17 – July 23)

Over the last week, we have covered Play Protect, android’s new security system and how the Dutch police ran Hansa Market after the take down of Alpha Bay, both major players on the Dark Web. We also provided some tips on how to stay cyber safe this summer. We also saw how the Terror exploit kit...

Botnet Tweeting, Spamming Porn Shut Down

An adult-themed botnet was found by researchers and dismantled by Twitter last month. The Twitter-based botnet consisted of 86,262 bot accounts, and over the past six months blasted out 8.6 million tweets that attempted to lure males to pornographic, dating, hookup and cheating-spouse websites...

Porn Spam Botnet Has Evil Twitter Twin

Last month KrebsOnSecurity published research into a large distributed network of apparently compromised systems being used to relay huge blasts of junk email promoting "online dating" programs -- affiliate-driven schemes traditionally overrun with automated accounts posing as women. New research...

Keeping up with the Petyas: Demystifying the malware family

Last June 27, there was a huge outbreak of a Petya-esque malware with WannaCry-style infector in the Ukraine. Since there is still confusion about how exactly this malware is linked to the original Petya, we have prepared this small guide on the background of the Petya family. The origin of Petya...

Zomato: Posting to Twitter CSRF on php/post_twitter_authenticate.php

Hi ! This time, i found a CSRF who can lead to arbitrary writing on twitter account of victim if they have added it to zomato : Coupled with a stored XSS, it could be very troublesome to you. In the page, it seems there is no token check at all. You can see in the video the CSRF working and here ...

X (Formerly Twitter): Open Redirect

Hello, i found Open Redirect POC : - go to...

WakaTime: No redirect uri for Twitter Oath resulting in token leak

Good afternoon, There's an opportunity to steal Oath tokens upon the return uri in the following redirect. https://wakatime.com/oauth/twitter/authorize?reason=tweet&next=/share/embeddable/5e22456d-9aae-4267-b1a9-4315c2605d89/0ed2e4de-f479-4e03-a8db-464a0696c08f.svg/tweet If I change the &next= to...

Chat With Hacker Assistant: hackerbot

Chat with your assistant and enjoy hacking This bot is a combination of chatbot and hacking tools Chatting Twitter account analysis Url scan File scan Ip scan Linux enumeration Linux priv escalation checker Shellshock Mimipenguin Installation git clone https://github.com/omergunal/hackerbot cd...

Alio Applicant Portal 6.0 SQL Injection

| \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | | | |...

Motorola G4 & G5 mobile phone was traced to the presence of high-risk kernel command line injection vulnerability-vulnerability warning-the black bar safety net

In a previous article about the Nexus6 root vulnerability in the article, we had mentioned Vulnerability CVE-2016-10277 will likely affect the Motorola device. When we on Twitter by some of the relevant reports after the fact to prove our previous conjecture. In order to prove that Motorola devic...

WordPress WP to Twitter plugin <= 3.2.9 - Cross-Site Request Forgery Vulnerability

Cross-Site Request Forgery Vulnerability was found in WordPress WP to Twitter plugin in 3.2.9 version. If the nonce input field is empty, the nonce check is not run. This happens In the file /wp-to-twitter-manager.php. Solution Update the plugin...

Hackers Are Using An Effective Way to Spread Fake News From Verified Accounts

Social media networks are no doubt a quick and powerful way to share information and ideas, but not everything shared on Facebook or Twitter is true. Misinformation, or "Fake News," has emerged as a primary issue for social media platforms, seeking to influence millions of people with wrong...

See how I found Twitter any accounts to send tweets vulnerabilities and get 7560 $ Bounty-vulnerability warning-the black bar safety net

! Participation in the Twitter vulnerability Bounty project in the process, I passed some Safety tests found that a Twitter presence of significant vulnerabilities: an attacker does not need access to others account permissions, you can order any accounts to publish tweets. I'm in 2017 2 May 26,...

Zendesk: Twitter SSO allows unverified e-mail registration, leads to Slack and social media hijacks

See title. SEE BLOGPOST: "How I hacked hundreds of companies through their helpdesk" https://medium.com/@intideceukelaire/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c...

How I took control of your Twitter account (tweeting, viewing/deleting photos and other media)

Summary: This blog post is about an Insecure direct object reference vulnerability on Twitter which could have been used by attackers to tweet from other accounts, upload videos on behalf of user, delete pics/videos from victim's tweets, view private media uploaded by other twitter accounts etc...

WordPress Social-Stream 1.6.0 Twitter API Secret Disclosure

Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Keys CWE-522 :Insufficiently Protected Credentials Products: Wordpress Social Stream Versions 1.6.0 and lower https://codecanyon.net/item/wordpress-social-stream/2201708 Social Network Tabs Versions 1.7.4 and lower...

Wordpress plugin Social Stream API secret key information leakage vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Wordpress plugin Social-Stream uses the Twitter API key as a parameter of the URL link There is an information leakage that can be...

On EternalRocks, WannaCry, and More

Mike Mimoso and Chris Brook recap the news of the week, including the EternalRocks worm, the latest on WannaCry, a subtitle hack, and a Twitter flaw. Download: ThreatpostNewsWrapMay262017.mp3 Music by Chris Gonsalves...

Keybase Extension Brings End-to-End Encrypted Chat To Twitter, Reddit, GitHub

A recently released Chrome extension, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week. Keybase, a service that allows users to identify themselves with a public encryption key, introduced its end-to-end encrypted chat feature...

Twitter Flaw Could Have Allowed Attacker to Tweet From Any Account

Before it was fixed earlier this year, a flaw in Twitter could have allowed an attacker to tweet as any user. Twitter was quick to resolve the issue, fixing it three days after the researcher–a bug hunter who goes by the handle Kedrisch–reported it via HackerOne. Kedrisch found the vulnerability ...