ITACS 5211: Introduction to Ethical Hacking

Wade Mackey

Week 01: Overview

Facebook Offers Rewards for Access Token Exposure Flaws

by Leave a Comment

Facebook has announced expansion of its bug bounty program to include third-party apps and websites that let people use their Facebook accounts to log in.  The company has declared that it will pay at least $500 to anyone who reports vulnerabilities that involve “improper exposure of Facebook user access tokens.” Access tokens allow users to log into third – party applications and websites through Facebook. One condition that the company has put forth is that the bug should be discovered by passively viewing data sent to or from a device while the affected application is in use.

https://www.securityweek.com/facebook-offers-rewards-access-token-exposure-flaws

Someone Hijacked MEGA Chrome Extension to Steal Users’ Passwords

by Leave a Comment

The official Chrome extension for the MEGA.nz cloud storage service had been compromised and replaced with a malicious version that can steal users’ credentials for popular websites like Amazon, Microsoft, Github, and Google, as well as private keys for users’ cryptocurrency wallets.

On 4 September at 14:30 UTC, an unknown attacker managed to hack into MEGA’s Google Chrome web store account and upload a malicious version 3.39.4 of an extension to the web store, according to a blog post published by the company.

Four hours after the security breach, the company learned of the incident and updated the extension with a clean MEGA version (3.39.5), auto-updating all the affected installations. Google also removed the MEGA extension from its Chrome Web Store five hours after the breach.

https://thehackernews.com/2018/09/mac-adware-removal-tool.html

No.1 Adware Removal Tool On Apple App Store Caught Spying On Mac Users

by Leave a Comment

A top-tier application in Apple’s Mac App Store that’s designed to protect its users from adware and malware threats has been found surreptitiously stealing their browsing history without their consent, and sending it to a server in China. The researcher then investigated Adware Doctor with ex-NSA staffer Patrick Wardle, who deep dive into the app and today published a blog post, saying that the app sidesteps Apple’s sandbox and covertly collects users’ browser histories and then transfers it to a server in China—which is blatant violations of Apple’s developer guidelines.