While doing a basic code review for a client’s web portal (bridging customers and service) we came across potential vulnerabilities which could compromise the system and recommended a proper ethical hack to screen the system. Our team managed to find 25 vulnerabilities including several SQL and XSS injections. We also uncovered an exciting Reflected/Stored XSS […]

Around 8 months back we conducted a non-intrusive security audit for an accounting backend application which involved us going through their system and making data classification matrix, supplier/processor list, data flow, network diagrams and conducting fact finding in various areas like application security, data security, infrastructure, access management, monitoring/logging, and organisational policy. At the end […]

The Information Commissioner’s Office (the UK’s privacy watchdog) announced its plan to slap British Airways with a record £183 million (238 million €). In September 2018 BA disclosed a breach which affected 500,000 people where visitors on its website were diverted to a fraudulent website and personal/sensitive details including name, billing address, email address and […]

Facebook used to ask new users for their email password as a method of verification. Additionally, it offered to upload their email contact list (e.g. from google contacts). In May 2016, Facebook removed the message that explained the feature to upload contacts, however the underlying feature still remained, which means contact list uploads were automatically […]

A situation any company should avoid. Sole members having access to information which if lost causes irreparable damage (financial or reputation) to the company. Shared knowledge and information security usually contradict each other when it comes to sensitive data, but having a fail-over method ready is key for a compromise in between. Over $190 million […]