Google wants to bring new blood into the security bug hunter community with a game launched to test developers' knowledge of cross site scripting (XSS) vulnerabilities. The XSS Game put devs through six games of increasing complexity that required successful attacks against mock vulnerable web applications. "The game is …

COMMENTS

House rules Send corrections

This topic is closed for new posts.

Friday 30th May 2014 04:32 GMT Scott Earle

The cake is a lie

0 0
Friday 30th May 2014 16:38 GMT Stevie

Bah!

That spells "seleeto" to my eyes. Palpable gibberish.

0 0
Friday 30th May 2014 17:15 GMT MouseAnony

Don't try to decode "hacker speak" if you can't.

It spells "elite" (eleet to be exact), note leet.

1 0
1. Wednesday 4th June 2014 15:19 GMT Stevie
  
  Bah!
  
  Did someone forget to turn on their 1r0n7 D3t3ct0r before responding?
  
  And I believe that should be "haxxor speek".
  
  0 0

This topic is closed for new posts.

Other stories you might like

DMCA-dot-com XSS vuln reported in 2020 still live today and firm has shrugged it off

Researcher tells world after being stonewalled

Gareth Corfield Wed 2 Feb 2022 // 10:15 UTC

There is a live cross-site scripting (XSS) vulnerability in takedowns website DMCA-dot-com's user interface. It's existed for more than a year and the site's operators don't appear to be interested in fixing it.
Infosec researcher Joel Ossi, founder of Dutch security firm Websec, announced his findings after spending more than a year trying and failing to get DMCA-dot-com to take the XSS seriously.
"I registered at DMCA at first with an intention to protect my own website," he blogged, explaining that he found unescaped free-text entry boxes in the DMCA user interface allowed him to create an XSS.

Continue reading
App, security teams need closer bond to fend off cyberattacks

Enterprises should shift left to protect themselves, says Immersive Labs

Jeff Burt Wed 9 Mar 2022 // 19:00 UTC

Enterprises need to create a more strategic alliance between their application security and cybersecurity teams if they are going to better protect themselves against cyberthreats.
Organizations can no longer wait for attacks to happen and then respond, according to Sean Wright, principal application security SME at Immersive Labs, creators of an enterprise platform that measures the cyber capabilities of their workforce. Instead, they need to embrace the shift-left mantra that calls for more security-related tasks – with testing being a big one – being performed earlier in the software development process, essentially weeding out potential flaws and vulnerabilities before they're compromised by attackers.
The end result should be to reduce the risk to the organization, Wright told The Register.

Continue reading
Infosec chap: I found a way to hijack your web accounts, turn on your webcam from Safari – and Apple gave me $100k

Now you see a harmless PNG. Now it's a malicious payload. Look into my eyes

Gareth Corfield Wed 26 Jan 2022 // 08:32 UTC

A security bod scored a $100,500 bug bounty from Apple after discovering a vulnerability in Safari on macOS that could have been exploited by a malicious website to potentially access victims' logged-in online accounts – and even their webcams.
Ryan Pickren, last seen on The Register after scooping $75k from Cupertino's coffers for finding an earlier webcam-snooping flaw, said the universal cross-site scripting (UXSS) bug in Safari could have been abused by a webpage to hijack a web account the user is logged into, which would be bad. It was also possible to activate the webcam.
Pickren told El Reg the flaw granted "full access to every website you've visited in Safari, meaning that if you're visiting my evil website on one tab, and then your other tab, you have Twitter open, I can jump into that tab and do everything you can from that screen. So it does allow me to fully perform an account takeover on every website you visited in Safari."

Continue reading
Unpatched flaw 'weaponises' Apple AirTags to turn them into the phisherman's friend

XSS vulnerability allows miscreants to hijack phone number field on website

Gareth Halfacree Wed 29 Sep 2021 // 19:24 UTC

Apple has been accused of ignoring a vulnerability in the Lost Mode functionality of its AirTags location-tracking accessories which would allow an attacker to seed "weaponised AirTags" for harvesting the iCloud credentials of anyone who find them.
Launched back in April, AirTags are compact battery-powered devices you stick to your belongings in order to locate them when misplaced. Apple chief compliance officer Kyle Andeer was very clear that AirTags are in no way a copy of Tile's popular compact battery-powered devices you stick to your belongings in order to locate them when misplaced.
Should your AirTag-equipped thing not be where you thought it was, you can enable Lost Mode. When in Lost Mode, an AirTag scanned via NFC provides a unique URL which lets the finder get in contact with the loser – and it's this page where security researcher Bobby Rauch discovered a concerning vulnerability.

Continue reading