Want to be part of a great security team and do security research full-time? We've got just the role! Tinder is looking for an experienced researcher to go deep and find new bugs. Learn more about it here! https://t.co/uOD8CYMCtS
Calling all hackers! You can now find the bug of your dreams with @Tinder's #bugbounty program, which has just gone public! Check out their program page for more details: https://t.co/W8Nqqe2rCJ #happyhacking
Forgot I pushed my AWS asset collection script a while ago. I know there are others.. no attempt to overshadow those. It can attempt to enumerate and assume role into all organization accounts to grab external facing stuff. https://t.co/Xc8yrjnCBe
Run every repo from a GitHub user through truffleHog to find leaked keys:
curl https://t.co/e8rlaMNdHE<username>/repos?per_page=1000 | jq '.[].html_url' | xargs -I{} sh -c 'echo {} && truffleHog --entropy false {}' | tee output.txt
I think @ericsyuan response to @zoom_us security concerns is great so far. Let's not forget security is tough and evolves over time. https://t.co/mZCFU2ojZz
Reposting my reply bc I think it was misleading. zoomAutenticationTool will run whatever script you give it, and ask you to authenticate as System. It's like they wrote their own sudo tool.. Don't think you can weaponize but weird practice.
Ever wondered how the @zoom_us macOS installer does it’s job without you ever clicking install? Turns out they (ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed).
And it does still pop up and ask you to authenticate. It’s like they wrote their own sudo tool. I don’t want people to get confused and think this is worse than it is. Just a really weird observation and questionable dev choice lol.
Just to be clear everyone I didn’t prove this as an actual gatekeeper bypass but it’s just a really weird bad sketchy practice. Actually delivering this as malware payload would be kinda tricky. Still. It weirds me out.
@dchest Yes I agree. it just still seems really weird their own sudo tool basically. I didn’t prove this as actual gatekeeper bypass delivery for malware would be tricky. But some OSX malware uses similar patterns.