If you are looking for a date, Tinder is pretty neat. If you are concerned about your privacy, it is less than ideal. We discovered that Tinder’s Groups feature allows users to track their Facebook friends. To shed light on this privacy issue and show why it is problematic, we built a Chrome plugin to stalk our friends and pinpoint their location.
TL;DR The Facebook malware that spread last week was dissected in a collaboration with Kaspersky Labs and Detectify. We were able to get help from the involved companies and cloud services to quickly shut down parts of the attack to mitigate it as fast as possible.
It turned out that the extension corruption issue was reported in a separate report and by the time I reported the combination of the two issues, the fix for the corruption issue was already out in Chrome Beta! Both issues are now fixed in the latest stable version.
A couple of weeks ago I put up a small challenge for a specific XSS problem, called Twins of Ten. The idea was to find a payload that was limited to ten characters, these characters would repeat once and you could expand it to how many pairs you wanted. The challenge was to both find the shortest payload but also find a way around the XSS Auditor inside Chrome / Safari.
The Chrome XSS Protection (also known as XSS auditor) checks whether a script that’s about to run on a web page is also present in the request that fetched that web page. If the script is present in the request, that’s a strong indication that the web server might have been tricked into reflecting the script. So in short, it blocks reflected XSS attacks. A couple of months ago I discovered that the Chrome XSS Protection could be bypassed in Rails. Later, when I saw the issue brought up on twitter by homakov, I figured I’d write something about it as well.