Collaborate Disseminate
Many governments around the world still rely on security by obscurity even though it’s one of the first things you learn not to do, when learning about information security. Is it more secure for them? How is their methods be… Continue reading Why do governments still use security by obscurity?
In 2016, a hacker group calling itself the Shadow Brokers released a trove of 2013 NSA hacking tools and related documents. Most people believe it is a front for the Russian government. Since, then the vulnerabilities and tools have been used by both government and criminals, and put the NSA’s ability to secure its own cyberweapons seriously into question. Now… Continue reading Leaked NSA Hacking Tools
Join the Disclose.io Movement!
Video and Slide Deck from EH-Net Live! April 2019
The Internet has an Auto-Immune Problem! It affects everyone on the planet, whether they’ve been the victim of a cyber-attack directly or not. Even those who have ne… Continue reading Video: Safe Harbor for Hackers
What is the most responsible way of disclosing an open AWS S3 bucket?
Let’s say there are sensitive documents inside, such as contracts with the company logo, that lead you to believe that it belongs to a specific company. … Continue reading How to disclose an open S3 bucket?
An XSS vulnerability report was made via Open Bug Bounty, which was fixed, confirmed and a reward was made.
The reporter has marked the issue was resolved. They have further offered to remove the vulnerability from the Open … Continue reading Is it bad practice to remove a resolved report from Open Bug Bounty archive?
This question already has an answer here:
As a student, how do I safely and responsibly disclose a serious security issue in a school environment?
4 answers
… Continue reading How to disclose school vulnerability as student [duplicate]
Register Now to Join the Disclose.io Movement!
The Internet has an Auto-Immune Problem! Members of the InfoSec industry need to lead the way in providing a global environment that encourages responsible security research to protect both the ethical hac… Continue reading Webinar: Safe Harbor for Hackers
I have successfully discovered a vulnerability in the New York Times website. Is there any known way I can report this? I have not attacked it. But I found a bypass. What should I do?
Let’s say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination.
I’ve reported this within my company and to the com… Continue reading How to properly disclose a security vulnerability anonymously?
There is a kind of race condition between the time when a developer releases a security update and the time when the security update is actually applied by the user. In the meantime, an attacker will be able to learn about th… Continue reading Avoiding the race condition between time of release and time of update