Security

It is a known fact that civilians often fall prey to SMS phishing scams. Hackers try to take advantage of unsuspecting people, especially during the busy holiday season when message volumes grow significantly. My investigation got underway when someone posted a fake text message from an anonymous sender on a…

If you work in banking or fintech, you know how crucial security is. One important concept is called zero trust security. It’s a way of thinking that says we shouldn’t automatically trust anyone or any system making call to our service, no matter where they are or what network they’re…

Introduction In this article, we will examine the security aspects of widely used Liquid Staking Derivatives (LSD) protocols. We will explore the fundamental principles of LSD and delve into their architecture and functionality in detail. Furthermore, we will analyze common vulnerabilities that have been identified during audits and real hacks. …

Content Part 1: Understanding OAuth 1.0 In this section, we will explore the principles and mechanisms behind OAuth 1.0. To get a solid understanding of how OAuth 1.0 works, we will cover its key components, such as parameters, signature methods, timestamps, and versioning. Part 2: Implementing the OAuth 1.0 Library in…

Hello to all security researchers and esteemed bounty hunters. Welcome to my second write-up. I hope you find it enjoyable. As you can see in the title, the vulnerability I discovered relates to bypassing Rate Limit, which leads to account takeover. The vulnerability I discovered involves the unauthorized takeover of…

Yet another post on Tornado Cash’s incident, but the problem is much bigger. In DeFi, we keep learning our lessons the hard way. That is, losing assets to a properly crafted scam, exploit or trick. The most recent event that highlights that even technical folks are being tricked into trusting is the Tornado Cash governance incident. On the 20th of May, a new…

Securing a website is often compared to installing a lock on a door. In reality, that is a poor analogy. A more apt analogy would be fortifying a castle. When a castle is besieged, a locked gate alone offers little protection. …

What Is intruder.io? intruder.io is an online SaaS vulnerability scanning platform that scans and detects security weaknesses in your infrastructure. It boasts a wide array of scanning tools, but the one we’ll be focusing on is its External Vulnerability Scanning, which uses Tenable Nessus under the hood. This is designed to scan any…

Attention white Hats! A new challenge awaits you. Raft Finance has just launched a bug bounty program on Hats! This means that security researchers can earn generous rewards from a 2.5M $TEMP pool for their valuable efforts in the security space. With our scalable and permissionless framework, bug bounty rewards…