Zer0day Sec 🗡

Offensive security & HI 0-day research: Web/API/Mobile AppSec, Web3 & Smart contracts. |PGP: C06C 0972 E7F1 8889 C5B5 E0D9 6115 241C E57C C932 | $0DAY on TON

[Zer0day Sec 🗡 @0daysec_xyz]

At https://t.co/LH8i9oZP2Q, we operate on a contingency model because we are CONFIDENT in our ability to find all & what others miss. If our research finds zero critical or high-severity vulnerabilities, you pay $0. DM open.

We find zero-days even after you think all angles are covered. We challenge every project today: request a free audit, and we will show you.

#freeaudit #adversarial #0dayHI #bugbounty #web3security #web2security #appsec

[Zer0day Sec 🗡 @0daysec_xyz]

@Tangem Email sent. Awaiting feedback

[Zer0day Sec 🗡 @0daysec_xyz]

@Biggestbughere @0xdEb0x1 @d0rsky You are correct. But this fact makes me question our latest find: oversight or reliance on obfuscation?

Whatever, it is wrong, and needs urgent fix.

Devs need to do better.

[Zer0day Sec 🗡 @0daysec_xyz]

Dear devs, before you hit that Publish button, check again and again:

Any debug path reachable by attacker mistakenly left in the build?

You may be exposing too much by this oversight.

#AndroidSecurity #Android #Reverse-engineering #AppSec

@0xdEb0x1 @d0rsky

[Zer0day Sec 🗡 @0daysec_xyz]

@concodefi Agreed.

[Zer0day Sec 🗡 @0daysec_xyz]

@BalaiBB As the digital economy evolves in the age of AI, user privacy will be a rare thing. As AppSec, I can tell you nothing is secret or private
This is not about telegram.

Seen a simple trading app sending your PII to foreign intelligence authorities without consent.

Be wise.

[Zer0day Sec 🗡 @0daysec_xyz]

@chrisdior777 I believe you.

[Zer0day Sec 🗡 @0daysec_xyz]

@0x15_eth @immunefi Hmm 🤔

[Zer0day Sec 🗡 @0daysec_xyz]

Being healthy is a success milestone that many people forget to celebrate.

Let's celebrate today!
Seriously.

#HealthIsWealth

[Zer0day Sec 🗡 @0daysec_xyz]

Albeit a good tool, you should NOT let AI make uou lose your critical thinking, your creativity, and your "superior" human intelligence.

Do not become complacent!

Keep sharpening your skills, knowledge, and intelligence.

[Zer0day Sec 🗡 @0daysec_xyz]

@immunefi This is critical

[Zer0day Sec 🗡 @0daysec_xyz]

@DmytroMatviiv @webrainsec Big congratulations

[Zer0day Sec 🗡 @0daysec_xyz]

@HackenProof @xalerafera @0xaudron @tchkvsky_eth Gunning for this board!
WAGMI

[Zer0day Sec 🗡 @0daysec_xyz]

As AppSec engineers, we can't begin to name all we've found under the hoods of your seemingly safe apps. Wallets compromises are warranted.

Devs need to do better.

Security by obfuscation is lie.

Simple.

Cc @0xdEb0x1

#AndroidSexuroty #ReverseEngineering #Android #DevSecOps

[Zer0day Sec 🗡 @0daysec_xyz]

@HackenProof I dont go that long stretch man. Not good for the health.

You gotta take a break.

For me, I play COD mobile (exciting), and some Chess.

Then hang with fhe kids.

And come back with great ideas.
😃

[Zer0day Sec 🗡 @0daysec_xyz]

Me, when my 10-month-old mediation request ticket finally gets a first reply from a mediator.

I mean, the project could already be out of business by this time, lol.

This is not mediation.

#bugbounty

[Zer0day Sec 🗡 @0daysec_xyz]

@intigriti We hac-k in the cloud. No PC.

[Zer0day Sec 🗡 @0daysec_xyz]

Evergreen post:

Dear projects, your scope exclusions are an attacker's hapoy path.

Think it.

[Zer0day Sec 🗡 @0daysec_xyz]

YOUR EXCLUSIONS - AN ATTACKER'S HAPPY PATH

Amessage to every protocol with a 10-page out-of-scope list. You think you are limiting researcher reports. You are actually publishing an attacker's roadmap.

Every exclusion on your scope list is an implicit announcement:
"We have decided not to defend this surface."
And attackers read scope lists too.

The most dangerous exclusions in bug bounty programs today:

☆ Centralization / single points of failure: "Trusted role, out of scope." Bybit lost $1.5B to exactly this. The researcher who flagged it got nothing. The attacker who found it got everything.

☆ Admin key compromise: "Assumed trusted, out of scope." Every insider job in Web3 history lived behind this exclusion. The team called it trust. The attacker called it access.

☆ Known issues, "Already acknowledged, out of scope." Known to whom? If it is known and unfixed, it is not out of scope. It is a liability with a timestamp.

☆ Economic / governance attacks: "Design decision, out of scope." Mango Markets. $100M. Design decision exploited.

☆ Frontend / UI issues: "Out of scope." Until a DNS hijack drains your users' wallets through your own interface.

☆ Third party dependencies: "Not our code, out of scope." It is your integration, your design choice. It is your users' funds. It is your postmortem.

☆ All forms of DoS: "No direct fund loss, out of scope." A denial of service attack that freezes a bridge, blocks withdrawals during a market crash, or prevents liquidations from executing is not a minor inconvenience. It is a weapon. DoS that halts protocol operations long enough for cascading failures is indistinguishable in outcome from a direct drain, except the attacker never touched a single token. Unavailability is a loss vector. Treat it like one.

☆ Theoretical vulnerabilities without PoC: "Unproven, out of scope." Some of the most critical findings in Web3 history were theoretical, until they weren't.

Here is the uncomfortable truth:
Every item you exclude from scope because it is inconvenient to fix (or you just don't want to pay bounty) IS A DOOR you have chosen to leave open.

Researchers walk away when they see it out of scope.
Attackers walk in.

The out-of-scope list is not a liability shield.
It is a prioritised list of your undefended surfaces, published publicly, for anyone willing to read it carefully.
The attacker does not respect your scope list.
They study it.

A well-scoped bug bounty program is not just generous to researchers.
It is a statement of genuine security intent.

Narrow scope = narrow coverage = wide open attack surface.
DoS, centralization, admin keys, governance, dependencies, all roads lead to the same destination when left undefended.
The attacker just picks the one you marked out of scope. 🔍

REVIEW YOUR EXCLUSIONS NOW!
Not for the researcher's sake. But for you, for your users'. 🔍🎩

#Web3Security #BugBounty #DOAW #Whitehat #DeFiSecurity
@zer0day_sec | https://t.co/kycpgE8mCC

[Zer0day Sec 🗡 @0daysec_xyz]

Private Key compromise:

Whitehat: N/A, Out of scope

Attacker: In scope.

Got it?

[Zer0day Sec 🗡 @0daysec_xyz]

@peckshield @PeckShieldAlert @wasabi_protocol Private Key compromise is OUT OF SCOPE.
Even attackers know, and they dont exploit it.

It's a universally known rule. Report closed as N/A.

A rule that has come biting so hard.

Please try and close this exploit as N/A.

And when your investors ask questions, tell them its N/A

[Zer0day Sec 🗡 @0daysec_xyz]

Yes we checked its not just about our report, its the brand's custom. Response efficiency is in the red. While app has over 200m installs.

Meaning a hack would impact over 200 million users today.

What kind of corporate culture is that?

It is confusing at times.
Security...

[Zer0day Sec 🗡 @0daysec_xyz]

Its increasingly become more & more crucial for researchers to ensure they spend their valuable time & resources on ONLY projects that:

1. value users security, & can patch a crit on weekend
2. are honest, responsible, & value contributions
3. are financially sound.

#3 is key.

[Zer0day Sec 🗡 @0daysec_xyz]

This is the primary recon.
Once this goes wrong, everything else could become meaningless.

We've a live Crit (mass ATO/total fund loss) report sitting unpatched in queue of a Android mobile consumer app project for over a month!

Why? Likely reasons 1 and 3!

What a brand!