Category Archives: shopify

Weather Channel, Shopify, & SAC – Hack Naked News #221

Posted on by

    This week, SUPRA Smart TV flaw lets attackers hijack screens with no video, 20,000 Linksys routers leak historic record of every device ever connected, a new attack creates ghost taps on Android smartphones, and an Australian teenager that hacked i… Continue reading Weather Channel, Shopify, & SAC – Hack Naked News #221→

Shopify, Intezer, & Weaponized Vuln. – Hack Naked News #215

Posted on by

    This week, a weather channel that was knocked off air by a malicious attack, how bad bots make up 20 percent of web traffic, ransomware ravages municipalities nationwide, a flaw in Shopify API exposed revenue and traffic data of thousands of stores… Continue reading Shopify, Intezer, & Weaponized Vuln. – Hack Naked News #215→

Before breaking up with Shopify, Mailchimp quietly acqui-hired LemonStand, a Shopify competitor

Posted on by

Here’s an interesting twist on the story from last week about the break-up between Shopify and Mailchimp, after the two said they were at odds over how customer data was shared between the two companies. It turns out that before it parted ways with Shopify, Mailchimp had quietly made an acquisition of LemonStand, one of the […] Continue reading Before breaking up with Shopify, Mailchimp quietly acqui-hired LemonStand, a Shopify competitor→

Shopify pays $15,250 bug bounty for a Christmas Eve vulnerability

Posted on by

This one had the potential for a holiday nightmare: A security researcher reported a critical vulnerability to the Canadian e-commerce company Shopify late on Christmas Eve last year. Instead, Shopify fixed the bug within 12 hours and paid out $15,250 to a bug bounty hunter who goes by the handle Cache-Money. The bug potentially allowed an attacker to bypass Shopify’s email verification process and ultimately gain access to an online store they didn’t own. For a platform whose entire reason to exist is to host stores and protect retailers, any threat of hijackings is a big deal. “We tracked down the bug to a race condition in the logic for changing and verifying email addresses,” Shopify’s security team explained on the platform HackerOne, which handles Shopify’s bounty program, including communication and payment with researchers. A race condition is a situation in programming where the result depends on a certain sequence of events. Vulnerabilities can result if a […]

The post Shopify pays $15,250 bug bounty for a Christmas Eve vulnerability appeared first on Cyberscoop.

Continue reading Shopify pays $15,250 bug bounty for a Christmas Eve vulnerability→