Top all-time · #5540
blog.shubh.am
Personal blog · blog.shubh.amsecurityweb
blog.shubh.am is a personal blog at blog.shubh.am about security and web. Since 2013, 14 different Hacker News readers have linked it 16 times, most often “Coinbase design allows for mass, targeted phishing of its users”. No feed was found, so read it on the site itself.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
A security researcher's posts on disclosing bugs: a Coinbase user-enumeration issue with a proof of concept, and a Prezi bug bounty dispute. HN commenters link them as the primary account of each.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Coinbase design allows for mass, targeted phishing of its users4 people · 4 mentions · first linked 2014-03-31
- I found Prezi's source code3 people · 4 mentions · first linked 2013-12-03
What Hacker News says?
The original disclosure never claimed that emails were leaked. They were found somewhere else: http://blog.shubh.am/full-disclosure-coinbase-security/#poc Their official response confirms this: http://blog.coinbase.com/post/81407694500/update-on-coinbase...
Comment linking /full-disclosure-coinbase-security/
on “Coinbase user emails and full names leaked”Submitted I found Prezi's source code as a story · 712 points
HN discussionhttp://blog.shubh.am/full-disclosure-coinbase-security/ According to the original researcher, he mailed them and got no response, and got no response at all from several other attempts at contact,. I wouldn't be surprised one bit to find that the inbox for that address is full of spam and crackpots, but, like 'tptacek said, if you're going to have the list you had better dedicate resources to reading it.
Comment linking /full-disclosure-coinbase-security/
on “Coinbase user emails and full names leaked”Submitted Coinbase design allows for mass, targeted phishing of its users as a story · 152 points
HN discussionHere is the reporter finally resorting to full disclosure after having tried repeatedly to reach out to Coinbase without getting any response at all: http://blog.shubh.am/full-disclosure-coinbase-security/
Comment linking /full-disclosure-coinbase-security/
on “Coinbase user emails and full names leaked”Submitted CaptchaJacking – An Approach to Bypassing the Captcha as a story · 2 points
HN discussionHow do you know it was an attempt of misleading and not a simple parsing or sorting/fitlering issue in bash or whatever he used to get emails? Maybe the file was written to via different threads using cross linked dictionary? Do you know? No, you are speculating someone would double the size of a list as if nobody would ever figure that one out. The bug that was filled was not even open for weeks. Again you are spec…
Comment linking /full-disclosure-coinbase-security/
on “Update on Coinbase Data Security”Submitted Demonstrating the critical nature of SSRF as a story · 2 points
HN discussionI don't think you understand, the PoC is not supposed to be a PoC for phishing but rather a PoC for their lack of rate limiting [1] , and user enumeration. I have showed the first name and last name [2], but have accordingly blurred them out [3] as I felt it was only appropriate. In the technical section, I demonstrate where the first and last name would show up in the response from Coinbase. If you still think it's…
Comment linking /full-disclosure-coinbase-security/
on “Coinbase design allows for mass, targeted phishing of its users”Submitted XSS allowed on eBay members pages as a story · 1 points
HN discussionThe actual bug report is the technical section of my blog post: http://blog.shubh.am/full-disclosure-coinbase-security/#tech... You're reading the Proof of Concept, which is meant to be a practical demonstration of how once could use the bug to their advantage. I didn't document the proof of concept in detail, to ensure that others couldn't easily use the blog post as a guide to harvesting Coinbase emails. If you wa…
Comment linking /full-disclosure-coinbase-security/
on “Coinbase design allows for mass, targeted phishing of its users”Submitted CatpchaJacking: A new approach on bypassing the Captcha. as a story · 1 points
HN discussionThey are actually paying to Shubham. The original post by Shubham was updated: http://blog.shubh.am/prezi-bug-bounty/
Comment linking /prezi-bug-bounty/
on “A Bug in the Bug Bounty”They are paying to Shubham. The original post is updated with the emails regarding that. http://blog.shubh.am/prezi-bug-bounty/
Comment linking /prezi-bug-bounty/
on “A Bug in the Bug Bounty”I think that's a bit harsh. I read the full email exchange he posted at the end of his article[1], and they went to some length to explain their position at the end of that exchange, and while I and many other wish it was different, I find their position understandable . With any number of past security submissions already deemed inadmissible for a bounty based on being out of bounds, how do they justify doing it in…
Comment linking /wp-content/uploads/2013/12/LetterLog_Prezi.pdf
on “A Bug in the Bug Bounty”Prezi's apparently trying to cover their posteriors in the wake of Shubham's disclosure and subsequent snub ( http://blog.shubh.am/prezi-bug-bounty/ ). "We greatly value this feedback." Weak sauce. Shubham's disclosure saved Prezi from a future nightmare. If they're not going to pay him from the bug bounty coffers, they should at least try and sound more like grateful humans rather than a pissy HR department trying…
Comment linking /prezi-bug-bounty/
on “A Bug in the Bug Bounty”
