293 karma · joined May 5, 2020
frida.re has a ton of useful features and community tooling built around it including scripts that will let you "un-pin" certificates by hooking and rewriting the functions that verify whether cert pinning worked or not.
https://codeshare.frida.re/@masbog/frida-android-unpinning-s...
It seems like if you add supply to one area of the housing market like the one above, there is a group of people ready to take advantage of that supply. 3bdroom apartment renters buy a home, then 2bdroom apartment renters get a bigger place that's affordable and meets their needs.
Assuming this works exactly like intended, that 1 family with two or three houses now only owns one and 2 other families get a house, then you're freeing up supply across the whole range of properties.
This might be true for an individual that only owns one or two properties, but for a company that owns tens or hundreds of properties they can let stuff set empty to drive up prices on all of their other properties.
There are different types of web security vulnerabilities and the attacks you see from automated scanners are likely to be far less sophisticated than targeted web attacks. Specifically these scanners are going to spam out widespread and common CVE's that might grant privileged access to the server or dump credentials in some fashion.
The more sophisticated attack you described is essentially an overflow, and most modern web servers are usually written in memory-safe languages making it very unlikely to see that type of attack on the web. More often it's the underlying OS, servers, or communication stacks (bluetooth, TCP, nginx, etc) that have these types of vulnerabilities since they are often written in low level non memory safe languages like C and C++.
Attacks that exploit the HTTP and HTTPS protocol are a little more interesting. Request smuggling lets you trick certain load balancers and webservers by sending an HTTP request "smuggled" inside of another HTTP request.
Here is a blog by James Kettle's about some request smuggling vulnerabilities and the impact they can have. https://portswigger.net/research/http2
There's really a lifetime's worth of knowledge on web security and the type of stuff you see in scans is just trying to hit the low hanging fruit. Portswigger has loads of free challenges and information about different web security topics.
Unfortunately, there are plenty of serious (business critical) servers that _ARE_ vulnerable to these types of attacks. I've found and remediated things like this all the time. One very common example I've seen of the `.env` issue is Django servers that are exposed to the internet in with debug=True. There's probably thousands if not tens of thousands of servers leaking credentials this way on the internet now.
Beyond that, companies often have internal systems that do not meet the same security standards that external systems require, and sometimes those systems get shifted around, maybe it's moved to a new subnet, maybe a third-party needs access and the CIDR range gets fat fingered in the firewall. Regardless - now that "internal system" is exposed to the internet with all the dangerous configuration.
The seller is motivated to make the buying process as easy, fast, and uncomplicated as possible. This is a direct correlation with how many things they sell, and in response how much money they make.
On the other hand - consumer opinion and regulation forces them to ensure that the buying process is secure, that someone else isn't buying things on your account, that they have proper logging of what goes on, etc.
The seller shouldn't "Fix" the buying experience by removing the security aspects of it. They should fix the buying experience by using modern authentication like passkeys and ensuring that their applications and sites support password managers.
I'll happily take this shit-show cacophony of various 2fa methods and authentication types if nobody is stealing money from my bank account or ordering stuff on ebay on my behalf.
The flip side of this - is that if companies properly setup auth and allow you to use username+password (or passkeys) and a TOTP method then this is all basically copy/paste from your password manager or verify on your phone and the process is super easy.
Many people won’t know it’s deprecated until the code fails to run, and having new functions rather than changing the functionality of existing functions makes it much easier to identify what is actually happening.
.net webapps written in asp.net behave similar to PHP in that any file with a .aspx extension that is within the web root will execute by default. This means that asp (and php) webservers are particularly vulnerable to RCE attacks because the default configuration of the server turns an "arbitrary file upload" into a remote code execution instead.
Where an asp.net server would handle front-end and api and they would be tightly coupled, we've moved on to where the most common configuration is a separate API and frontend. I believe you lose a lot of the benefit of using asp.net to try and decouple them.
On a totally personal note, as a penetration tester I've proxied requests from a LOT of different APIs on a lot of different technologies and asp.net is hands down one of the worst to test, the way it handles requests under the hood is unruly and ugly. Some might say that's a positive in terms of security, but IMO it makes it harder to identify vulnerabilities in your system.
I think there have been a few different noteworthy events where issues have popped up. I'll link to a couple of articles I've found on the topics.
https://themedicinemaker.com/business-regulation/amazons-fda...
https://www.sitejabber.com/resources/counterfeit-cosmetics-t...
Businesses fail and are replaced with other businesses all the time, it's part of the normal flow of capitalism. Within a specific community, as businesses come and go, as long as the old one is replaced with a new one then employment opportunities are still around. Eventually something will open up that is a home run and then that store will flourish in the community, which will likely create even MORE employment opportunities and if it's a local store then a lot of that money will stay local in the hands of employees, owners, local government (taxes).
Someone walking around your neighborhood cutting every single electric line on the side of a house, risking electric shock and trespassing on your private land is much more likely to get caught than somebody rolling through your neighborhood with a flipper zero and a high power antenna turning off all of your meters.
If someone had a grudge against you, and they started to "release the magic smoke" from your meter once a week and the power company is upset with you and your HVAC system doesn't work anymore, in addition to the fact that the compressor in your AC is toast because of someone energizing and de-energizing the circuit so rapidly. Now you are out thousands of dollars and, on top of all that, no matter how many cameras you put up, you'll have a hard time figuring out who's doing it.
One good option would be to spin up a second server/instance/container, run binary on new system, ensure it's good, once comfortable then swap DNS entry to the new system.
If you're talking about trade secrets, I believe if there is evidence in the product/products that a former employees company is releasing that seems to be operating or working in a similar product they could gather publicly available evidence, hire a PI, and ultimately attempt to subpoena additional information if there is sufficient evidence that the employee is actually sharing trade secrets from a previous company.
Can't really blame anyone for being concerned about corporate retaliation, but there are most certainly institutions that would send an email on your behalf to disclose vulnerabilities to a security@ email if you wanted to remain anonymous out of a sense of caution.
On top of that you've made some inflated comments on the general security practices about this company with no real evidence and the vulnerabilities listed best-practices at best and inconsequential at worst.
I question the motives behind a post like this:
Does the author have some financial incentive to attempt to discredit Stytch? Does the author want to cause some panic/concern by making scary claims about Stytch? Does the author not truly understand the impact of their vulns and thing that this is a serious issue when it's not?
I can't say but the whole situation really sits wrong with me.
Regardless this is a HUGE stretch to say "has no CRSF-protection in their authentication API". You've shown one instance where they don't have CSRF protection on an endpoint that could be argued it's not necessary. Do they have CSRF protection on endpoints that let you adjust your account, perform actions in an app, or other legitimately concerning endpoints?
The pain point for me is that my family/friends circle isn't willing to try and use new software especially stuff that might be custom or have some lack of features.
It took me a year or more to get my dad to send me pictures and videos over FB Messenger instead of SMS (he has an iphone and I have an android). Maybe I just need some new persuasion tactics but the idea of putting energy and time into building a custom app for my family and then dealing with pushback and a reluctance to use it just sounds exhausting to me.
List of CVEs for flash player - lots of 10s in there. https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...
While I also struggle with the android/apple divide in my family I feel like getting them all to agree to use an existing social platform would be exceptionally difficult, but it would be orders of magnitude easier than getting them to use a custom or relatively unknown app for comms unless it did something really special or novel.
"Essential" is interesting because you could definitely argue that HTTP isn't essential, but I don't think there is any feasible way of denying that the formalization and acceptance of early internet protocols (UDP, TCP, HTTP, FTP, etc) have played a significant role in shaping our modern technology world.
In a similar way, having reasonable standards makes it easier for everyone that isn't an expert in a particular field to just use something that is likely to work reasonably well while they worry about some other special part of their idea.
Objective C does retain perms by default using some common move techniques.
Lack of standardization might just make it harder for Joe to filter through the google searches and figure out what algorithm to use. He may just pick the first result on Google, which is an ad for the highest bidder on some keywords which may or may not be good.
You are totally right that open source is powering countless things people use regularly but I expect most people don't even know what open source software is, much less care about it.
Current internet service there is provided by Frontier Communications. They offer "advertised" speeds of 6 Mbps but for years my parents internet came in around 1 or 2 on a good day. Service is abhorrent and they are still using phone lines that will likely never be replaced. They've taken serious advantage of the state of WV and even after a class action lawsuit in 2015 that they settled on I doubt it will ever improve.
My parents finally got starlink setup ~3 months ago, it's around 100 mbps (roughly 100x as fast) and way more reliable even though it's satellite.