Ethical hackers are the good guys in the cybersecurity industry – Here are 5 instances where these hackers have rescued companies from cyberattacks.
We have all heard the tale of Black Hat hackers who exploit the vulnerabilities missed by companies to their own advantages and more often than not, they do it for personal gains or for criminal gains.
However, just like these people with evil intentions, there are also various good guys who work in the shadows to help protect companies from cyber attacks by finding the loopholes in their security system and fixing them accordingly.
These are called White Hat hackers or ethical hackers and here are five instances where these hackers have rescued companies from cyberattacks or brought their attention towards blind spots in their security systems that could have incurred huge losses or harmed the users of that firm.
1. WordPress plugin vulnerability leaked Twitter user data
On 17th January 2019, a French researcher, Baptiste Robert, who goes by the online handle of Elliot Alderson, found a vulnerability in a WordPress plugin called Social Network Tabs that allowed personal details to be exposed by leaking a user’s Twitter account info.
It was given the vulnerability ID- CVE-2018-20555 by MITRE. The plugin was used to allow websites to help users share content on social media sites. Twitter was informed about this vulnerability and revoked the keys, rendering the accounts safe again.
2. Critical Vulnerability in Oracle’s WebLogic Servers
A security firm that goes by the name KnownSec404, identified two vulnerabilities that allowed attackers to take complete control of the system. The vulnerability was a deserialization attack that targeted two Web applications exposed to the internet by default.
The vulnerability was tracked as CVE-2019-2729 and to exploit it, an attacker would simply be required to send an HTTP GET request to the WebLogic management console. However, Oracle issued an out-of-band security update that addressed this issue.
3. Visa contactless card bypass payment limits vulnerability
Two researchers from Positive Technologies, Leigh-Anne Galloway, Cyber Security Resilience Lead, and Tim Yunusov, Head of banking security, found vulnerabilities in the contactless Visa cards that allowed hackers to steal unlimited sums from the accounts and they urged the banks and customers to take precautions.
The researchers confirmed that the attack was tested with “five major UK banks where it successfully bypassed the UK contactless verification limit of £30 on all tested Visa cards, irrespective of the card terminal.”
However, when Visa was contacted about this by Forbes, they were not surprised and explained that “it requires a physically stolen card that has not yet been reported to the card issuer” and that it is not a scalable fraud approach that is typically seen to be employed.
4. Mac Zoom Client vulnerability allowed enabling users’ camera
On 19th July 2019, a security researcher, Jonathan Leitschuh, publicly disclosed a vulnerability that allowed any malicious website to open the camera of Mac users on Zoom and also forcibly make them join a Zoom call without their authority.
This, not only exposed 750,000 companies at risk of security breaches but also millions of people who use Zoom on Mac in their daily lives.
Apple was able to fix the vulnerability on the same day as it was disclosed by Leitschuh on Twitter whereas, Zoom decided that they would patch up the vulnerability only 18 days before the end of the 90-day public disclosure deadline. However, a day before the disclosure deadline, Zoom had only implemented the quick-fix solution suggested by him.
https://twitter.com/mathowie/status/1148391109824921600?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1148391109824921600%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.hackread.com%2Fvulnerability-in-zoom-video-conference-app-lets-macs-camera-hijacking%2F
5. Hacking Canon’s DSLR camera with ransomware using PTP flaw
Eyal Itkin, a vulnerability researcher at Check Point Software Technologies, revealed vulnerabilities in a Canon EOS 80D DSLR and demonstrated how the Picture Transfer Protocol (PTP) allowed him to inject ransomware in the DSLR camera over a vogue Wi-Fi connection.
Itkin uncovered six vulnerabilities in total that could be misused to inject ransomware and lock up the device. He emphasized how this could place the users at risk of being asked to pay ransom to free up their device and picture files.
When Canon was informed about these vulnerabilities, they published a security advisory informing users that, “at this point, there have been no confirmed cases of these vulnerabilities being exploited to cause harm” and asking them to take advised measures to ensure safety.
Did you enjoy reading this article? Don’t forget to like our page on Facebook and follow us on Twitter!