koto

security ninja wannabe
Mastodon: @[email protected]

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥

The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇

https://t.co/SgsSyxoEMR

1/4

[koto @kkotowicz]

@NahamSec @neophyte2k @Google I'll make sure we send the rationale today. We should have done it inline with the decision, I don't have any excuse why we didn't. It commonly happens that the VRP reward is smaller than expected or 0, but of course we need to explain why this is the case.

[Eduardo Vela @sirdarckcat]

https://t.co/lyZNuUftQt

[Google VRP (Google Bug Hunters) @GoogleVRP]

We're sending a HUGE thank you to our incredible community of bughunters ! 🙏 Your passion for finding vulnerabilities keeps our users safe 🔒 To show our appreciation, we awarded over $380,000 in bounties this week, including the largest reward ever given in Google VRP history!

[ZaufanaTrzeciaStrona @zaufanatrzeciastrona@infosec @Zaufana3Strona]

Co do jasnej cholery żeby nie napisać dosadniej.

[Google VRP (Google Bug Hunters) @GoogleVRP]

Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspiration? Check the video below in which @kkotowicz and @SecurityMB talk about Google VRPs!

https://t.co/RrVGOHM1TE

[koto @kkotowicz]

Pretty cool exploit chain with the redirects. The writeup is also excellent, and the "screenshots" being actually interactive? 🤯

Thanks a lot for the research, @rebane2001!

[James Kettle @albinowax]

Love a good client-side exploit chain! This crazy cross-product chain targeting Google by @rebane2001 is a great example of the type of exploit that gets easier the longer you spend targeting a single company
https://t.co/mxhH2N7teW

[Gynvael Coldwind @gynvael]

If anyone is following the NEWAG vs Dragon Sector case, this article (in PL, but, well, 2024, google translate) is a really good read about the actual lawsuit and the first day of trial.
Second day of trial will be on Jan 15, so there's some time for sides to file more stuff.

[koto @kkotowicz]

XSS in Gmail is now $20k (or 50% more for exceptional quality report). Good thing we don't have XSSes anymore.... Or do we? :)

[Google VRP (Google Bug Hunters) @GoogleVRP]

🚨💰 Google VRP Reward Update 💰🚨 Good news, we are significantly increasing the reward amounts offered by the Google VRP! Look out for up to 5x higher payouts and a maximum reward of $151,515! Details here:

https://t.co/gYRql7IRST

[Michał Kowalczyk 🇺🇦 @dsredford]

It's finally happened! NEWAG IP Management just sued us for copyright infringement and unfair competition.

Here's a symbolic picture of the lawsuit as a whole: Newag quoting q3k's own code as supposedly their IP :)

More: https://t.co/8rS20yv06O

[Gynvael Coldwind @gynvael]

So NEWAG (context: https://t.co/PV0gaKc4nx) finally filed a lawsuit against members of @DragonSectorCTF / SPS. It took them a few months from when they said they'll do it, and apparently there were some snafus with addresses, but here we are.
1/n🧵

[Lukas Weichselbaum @we1x]

@LinkedIn says no to DOM XSS by enforcing Trusted Types! Congratulations to @shafigullin for this achievement 🎉

[Michał Gołębiowski-Owczarek (@[email protected]) @m_gol]

@kkotowicz It took us a while but jQuery 4.0.0 beta is out now: https://t.co/aaV38BpRjr

[Google VRP (Google Bug Hunters) @GoogleVRP]

Ever wondered how to increase your bug bounties 💸 ? Our latest blog post introduces our domain tiers security concept and how it is applied at Google, and includes a list of Google's highest sensitivity domains.

https://t.co/6zy8qCYK42

[koto @kkotowicz]

See how Google's security engineering team handles rollouts at scale, so we can safely enforce Strict CSP, Trusted Types and other security features on 100s new services yearly.
https://t.co/pMcX7UZRAg

[The Register @TheRegister]

Mozilla decides Trusted Types is a worthy security feature https://t.co/78oA6eiG0U

[Lukas Weichselbaum @we1x]

Mozilla has changed their standards position on Trusted Types to positive 🎉
2024 will be a bad year for DOM-based XSS.

https://t.co/My2EgTnVUS

[Jun Kokatsu @shhnjk]

A few deprecations shipped in Chrome 120.

Data URLs in SVG <use> is now blocked.
https://t.co/IuGEdL6C5A

CSP Embedded Enforcement's implicit opt-in for same-origin iframes is gone.
https://t.co/1kp0q62pmx

[koto @kkotowicz]

@jasvir @cramforce After some digging, this seems to be article 33 of https://t.co/wGeiaelAIz

[koto @kkotowicz]

@jasvir @cramforce Criteria are listed in the article, e.g. > 45M monthly active end users from EU etc.