Hacker scores $5,000 payday for finding address bar flaw in Chrome and Firefox

cash

Photo via reynermedia (CC-BY)

Developers can't find every bug themselves, so they use bug bounties to encourage hackers to help them keep programs secure.

While developers do their best to ensure the programs and apps they make are secure when they’re released, it’s often impossible for a team to find every bug. That’s why bug bounties exist, as a way to reward users who help developers find security flaws in the programs we use every day. It’s also why Rafay Baloch is currently $5,000 richer.

Baloch recently discovered a vulnerability in the way Chrome and Firefox render website addresses, which allowed attackers to send users to spoof websites that appear to be real but are actually elaborate frauds. The vulnerability was caused by the browser’s flipping of web addresses that are written right-to-left, since that’s how some languages, such as Arabic, are read.

According to Baloch’s example, if a user were to input 127.0.0.1/I/http://example.com, the browser would display it as simply http://example.com/i/127.0.0.1, while still sending the user to 127.0.0.1/i/http://example.com. This allowed scam artists to trick users to visiting spoof sites that use the guise of official domains.

According to Baloch the issue will be resolved when Chrome 53 and Firefox 48 are released. In the meantime let Baloch’s windfall be your inspiration. If you’ve got the skill to discover a bug it could pay off in more than just a pat on the back for making the world a better place. It could land you cold hard cash.

H/T ZDNet

Promoted Stories Powered by Sharethrough
Debug
Browsing the web on Android could hand hackers your credit card info
Just browsing the internet on your Android device could hand hackers your credit card information.
From Our VICE Partners
Group

Pure, uncut internet. Straight to your inbox.

Thanks for subscribing to our newsletter!