Clik here to view.
Calling Earth Networks
I’m looking for a technical contact at Earth Networks due to a reflected Cross-site Scripting bug in Weatherbug. I have tried to contact the CTO (Mr. Sloop) and Marketing & Advertising departments...
View ArticleClik here to view.
Looking for JobsDB technical contact
According to my tests, JobsDB.com is vulnerable to reflected Cross-site Scripting attacks. I would like to send my report to appropriate technical contact person(s). I have sent the vulnerability...
View ArticleClik here to view.
Testing Tumblr worm root cause
Yesterday Tumblr was hit by a “worm” that posted racist message using JavaScript. Sophos analyst Graham Cluley posted the first technical analysis that I noticed on Naked Security blog. It looked like...
View ArticleClik here to view.
Testing Tumblr XSS
According to my new tests, Tumblr is still vulnerable to stored Cross-site Scripting. I have reported the findings to Tumblr development team although they should already know: the reblog attack on 3rd...
View ArticleClik here to view.
XSS in multiple Condé Nast magazines
I reported a bunch of reflected Cross-site Scripting vulnerabilities to Condé Nast in August. Some of them have been fixed: Ars Technica Bonappetit Golf Digest Vogue & Teen Vogue Self.com...
View ArticleWrapping up January
I decided to collect a list of good news from January. Quite many issues have been fixed. I also reported eight suspected or confirmed SQL injection issues. On the negative side: for each site listed...
View ArticleTesting basic XSS
Yesterday evening I tested six premium WordPress templates. In about 10 minutes I found three templates that are vulnerable to Cross-site Scripting. This is quite typical: when searching for vulnerable...
View ArticleClik here to view.
Can’t Touch This?
Diet spammers are not running out of new tricks. Background information about this spam campaign can be found from my other blog. Today I spotted some suspicious tweets pointing to a Game Informer...
View ArticleClik here to view.
Finding spammers
I know it is not easy to identify spammers. But they do leave some traces: when you register a domain, you must use a valid e-mail address. Unfortunately it is not difficult to register a domain using...
View ArticleClik here to view.
Pinterest browser trojan
Today while I was scanning diet spam on Pinterest, I followed one link which redirected to pinteresf.org offering a “Pinterest Tool”: If you see anything like this popping up suddenly, just close the...
View ArticleMalicious website status
Here is a short status update concerning websites related to both “Pinterest tool” – malware and diet spam on Twitter. The following IP addresses and websites are currently offline: 198.58.104.37...
View ArticleClik here to view.
Fruity browser survey
I searched for diet spam tweets on Twitter and found one link that looked promising: ongarciniacambogia.com: Quick check on Pinterest using the /source/ – parameter – lots of fruity images: I had to...
View ArticleClik here to view.
Twitter account hack warning
Warning: attackers are trying to hijack your Twitter account Last night I learned about one attack targeting Twitter users. Attackers have a simple goal: they want to hack your Twitter account. The...
View ArticleCase report: Professional Designer
UAEpd aka “Professional Designer” (uaepd.net) is a company based in United Arab Emirates. Description: “Professional designer company is specialized in information technology and development, hosting...
View ArticleClik here to view.
Stealth attraction scam
Yesterday I spotted an interesting Twitter scam/spam campaign. I have reported this incident to Twitter. Most of the malicious links are already blocked. Key elements: Compromised Twitter accounts...
View ArticleClik here to view.
Analysis of a phishing attack
I spotted and reported a Twitter phishing attack on 14th of July. It was quite similar to many previous ones, but the attackers did one mistake. The collected usernames and passwords were visible to...
View ArticleClik here to view.
Phishing with hacked sites
Yesterday I spotted a new Twitter phishing campaign. The attack is quite common: attackers use compromised Twitter accounts to spread phishing links. Examples: There’s nothing awesome or funny behind...
View ArticleClik here to view.
Checking email from Apple
This morning I received an e-mail claiming to be from Apple. The e-mail said that my Apple ID has been suspended. This is obviously a scam, but I wanted to check it more thoroughly. Screenshot of the...
View ArticleClik here to view.
Orlando Nightclub Phishing Attack
Scammers are the scum of the earth especially when they exploit tragic events such as the Orlando nightclub shooting. This is not the first time similar things have happened so you should be cautious....
View ArticleClik here to view.
Find out who visits your Twitter profile
Many Twitter and Facebook users would like to see who have visited their profile. That is not possible. If you see a post like this – even if it comes from a user you know – be careful: It is a scam....
View Article
