Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
Kaynak: bobdahacker blog ·
How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later. Nobody has ever responded.
Sıkça Sorulan Sorular
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails nedir?
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails is a makale discovery curated from bobdahacker blog. How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single…
Nasıl erişebilir veya deneyimleyebilirim?
You can experience this content directly on its original host (bobdahacker blog) by clicking the "Open Original" button.
Bu içerik nereden geliyor?
Curated from bobdahacker blog by the OnSuggest team to surface the most interesting and serendipitous content on the web.
Benzer keşifler
Tüm Makale keşifleri →From hakyll to comrak based generator
Tl;DR: I decided to gradually switch from hakyll- based framework for this blog to comrak -based custom generator. I’ll migrate both HTML render of posts and RSS feeds in the following few days. You should not see any changes: all the URLs and UUIDs are the same before and after. Until I missed something crucial. I hope I did not. The one exception will be the style of syntax highlighting in the HTML render of posts (and it will probably keep changing for a while more when I experiment with various backends). Background I used hakyll for about 13 years at least since first commit from 25 Novem
You Paid $50K for a Pentest. You Didn't Get One.
I'm going to tell you something big cybersecurity doesn't want you to hear: the pentest you paid for probably wasn't a pentest. I've lost count of how many times I've disclosed critical vulnerabilities to a company, only to hear: "That's weird, we just had a pentest done and they said we were clean." At this point, hearing that a company recently passed a security assessment is almost a leading indicator that I'm about to find something bad.
The Fix That Wasn't: Why Outsourced Dev Teams Are Your Biggest Security Risk
There's a conversation I have over and over again. A company hires an agency to build their app. The app ships. It works. Everyone is happy. Then someone like me takes a look, and the whole thing falls apart. And you better hope it's someone like me, not someone who wants to exploit it. This isn't about where developers are located. Talented engineers exist everywhere. This is about a business model where agencies are incentivized to ship features fast, security isn't in the contract, and nobody checks the work.
Your Lowest-Paid Employee Can Probably See Everything
Companies spend millions on firewalls, endpoint detection, and perimeter security. Then they give a part-time employee the keys to the kingdom. This is one of the most common patterns I find in my security research, and one of the least talked about. It's not about hackers breaking in from the outside. It's about what's already accessible from the inside, to people who were never supposed to see it.
Your Google Calendar Is Probably Public. Here's Why That's Terrifying.
Google Calendar has a setting that makes your entire calendar visible to anyone with your email address. Not just your availability. Full event details: titles, descriptions, attendees, Zoom links with passwords, and any documents linked in the description. All anyone needs is your email and a URL like calendar.google.com/calendar/u/0/embed?src=you@company.com. No authentication. No notification to the owner. This whole rabbit hole started by accident. I was doing security research on MSCHF, the viral product company behind Big Red Boots and Blur, and ran an employee's email through GHunt, an
Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.