Collaborate Disseminate
Reading into the various SSE options on S3, I’m can’t understand the following:
What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against?
I can only think of a physical attack vector,… Continue reading What attack vectors does AWS SSE-S3 help mitigate?
The home surveillance cams have hard-coded credentials. Continue reading Guardzilla Home Cameras Open to Anyone Wanting to Watch Their Footage
I’m relatively new to Subdomain Takeover and have a lack of knowledge – that I want to fill – wether and when it is possible to hijack a subdomain.
I started to do learning by doing and found a subdomain that gave me a 404 … Continue reading Subdomain Takeover At Amazon ELB-Server?
I’ve done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment providers have now moved a… Continue reading Find Security Flaws in My Payment Page
The information was exposed on a public Amazon S3 bucket by a Virginia-based political campaign and robocalling company. Continue reading Thousands of U.S. Voter Personal Records Leaked by Robocall Firm
If i found aws s3 bucket how could I know the owner of this aws s3 bucket
I noticed that recently our website has been performing poorly and often using 100% CPU usage on users machines. After looking into this I have noticed that all of the jquery files on our CDN were edited 6 days ago and are no… Continue reading Monero being mined on our server
A popular Android app called Drupe, downloaded over 10 million times, has been leaving users’ selfie snapshots, audio messages, and other sensitive data exposed for anybody to see.
Read more in my article on the Hot for Security blog.
Continue reading Drupe app removed from Google Play store after photos and messages leaked publicly
I see that using AWS S3 with https, it comes with a wildcard SSL cert.
Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the same wildcard)?
Assuming t… Continue reading Risk of man in the middle attack on AWS S3 due to wildcard SSL certs
Chances are that you’ve never heard of Washington-based data firm LocalBlox. But that doesn’t mean that they haven’t heard of you. And it doesn’t mean that your personal information hasn’t been recklessly exposed through their sloppy disregard for th… Continue reading 48 million people put at risk after firm that scraped info from social networks left it exposed for anyone to download