homakov

57 ms·

631.
Ruby's open-uri is one step away from RCE(sakurity.com)
5 points by homakov 12y ago|0 comments
632.
Using open-uri? Check your code – you're playing with fire(sakurity.com)
5 points by homakov 12y ago|0 comments
633.
by homakov 12y ago
There is no AI and other stuff this article talks about. It's just google cookies and nothing interesting about it http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...
634.
by homakov 12y ago
So what? Kind of useless article, nothing new.
635.
by homakov 12y ago
Start with simple concept like SQL injection or XSS. And keep thinking about how you can use your code in a bad way. Check my blog too - homakov.blogspot.com
636.
by homakov 12y ago
I can call myself a hacker maybe - start from reading some blogs and articles, maybe books too, but you have to be a good programmer first.
637.
Hire me for on-site security consulting in San Francisco Bay Area(sakurity.com)
3 points by homakov 12y ago|0 comments
638.
by homakov 12y ago
OTP passwords dont fight client side malware lol.
639.
by homakov 12y ago
> this is pretty much a list of implementation flaws, not protocol flaws I can agree with that but problems outlined are very common so it doesn't really matter. Say, Facebook is major oauth2 provider and doesn't follow most of
640.
by homakov 12y ago
Check oauthsecurity.com
641.
by homakov 12y ago
This is relevant oauthsecurity.com
642.
Public Security Report for Peatio Exchange(sakurity.com)
1 points by homakov 12y ago|0 comments
643.
Can we hack a device that only reads QR codes?(sakurity.com)
2 points by homakov 12y ago|0 comments
644.
The most paranoid way to transfer data – QR Channel(sakurity.com)
4 points by homakov 12y ago|0 comments
645.
by homakov 12y ago
Simply have a blog, post cool stuff, and clients find you not the other way around.
646.
by homakov 12y ago
How one can be that stupid to use params[:username] instead of secure session cookie? It's like sending -100 dollars with paypal
647.
by homakov 12y ago
I agree that highlighted properties are interesting, but if we're talking about practical usage of these techniques it makes almost no sense (benefits to efforts ratio is too low)
648.
by homakov 12y ago
These techniques are extremely easy to bypass. It's like confirm('are you bot?') for CAPTCHA protection. It will detect headless browsers until someone decides to bypass it with proper headless webkit or something else. &quot
649.
How a crypto exchange can be hacked in 3 steps(sakurity.com)
4 points by homakov 12y ago|0 comments
650.
Hacking an exchange with OAuth and bypassing 2FA(sakurity.com)
6 points by homakov 12y ago|0 comments
651.
Hacking a Bitcoin exchange powered by Rails(sakurity.com)
8 points by homakov 12y ago|0 comments
652.
by homakov 12y ago
And websites too. Be careful about all your dependencies.
653.
Hacking a Bitcoin exchange – the hard way(sakurity.com)
14 points by homakov 12y ago|3 comments
654.
by homakov 12y ago
Isn't there protocol to call to another bank and ask them to send it back? Or at least get info about the account?
655.
by homakov 12y ago
Yes, I don't know how it works with banks but here it's essential to loosely couple your services. The main app shouldn't controll the funds/transactions app
656.
by homakov 12y ago
The hot wallet can be refilled every hour. If you are trying to withdraw <1 BTC but hot wallet is empty it goes to warm wallet to be accepted manually. Yes it's inconvenient . But between inconvenience and losing $5,000,000 If atta
657.
by homakov 12y ago
The post is not about amateur developers, everyone makes mistakes. The point is amateur developers make bitcoin apps a low hanging fruit. And that's why you have to be prepared to be hacked right now. Also I wanted to recommend manual
658.
Bitstamp problem and warm wallets(homakov.blogspot.com)
42 points by homakov 12y ago|20 comments
659.
by homakov 12y ago
> quite a few bypasses the longer it exists the less bypasses left. it is really good at preventing simple reflective xss. > talking about web apps that customers had. Remark - we are talking about interface-based xss only, not all of
660.
by homakov 12y ago
That's a very good question. Yes if you are able to inject a script it will be executed in the virtual browser and it will bypass it (not completely, you still have XHR and cannot exploit heartbleed like bugs). First - default xss audi

More ›