tl;dr: Vulnerability in VK bookmarks allowed attackers to get direct links to images from messages, private albums of users/communities. I wrote an exploit that bruteforces photos ids uploaded for a certain period and then using this vulnerability I could get direct links to images. In short: I could get all yours yesterday’s photos in 1 minute, in 7 minutes - all photos that were uploaded last…
About Vulnerability Research Grants Few months ago Google announced a new experimental program called Vulnerability Research Grants. It’s a definitely good idea, thanks Google for inventing and trying such cool things! How it works: Google’s Security team choses regular reporters and send them such emails: Researcher selects product/service from the list and looks into the security of it. The goal…
HipChat is a popular web service for private chat and instant messaging. It features a lot of things, one of that is ability to view chat history via browser and search through it. In this write-up I want to tell you about vulnerability in that page which could be used to compromise user’s account, steal credentials or other sensitive data. Once during communication with colleagues I discovered…