InfoSec Write-ups is a Medium publication where security researchers and bug bounty hunters post vulnerability reports, exploit techniques, and tool guides.
HN links it for vulnerability write-ups and tooling guides, such as a GDB plugin setup post and a Shopify store access case.
That's rather alarmist and exaggerated. "Every plugin is a disaster". No it isn't.
Shopify isn't immune to vulnerabilities:
https://infosecwriteups.com/how-i-gained-access-to-revenue-and-traffic-data-of-thousands-of-shopify-stores-b6fe360cc369
I wouldn't recommend Shopify. Clunky, slow, overpriced. And business inventory shouldn't be outsourced and hosted on third party platforms.
Self-managed solutions offer more options to scale and add features, customization and generally taking control over the way your business is presented online. This matters, and customers notice the confidence of a business owning its online presence.
Doesn't need to be Wordpress, but even if it is, the option to use something like Snipcart is there if WooCommerce isn't wanted. No need to switch everything over to hosted solutions like Shopify.
> "You can use a screwdriver as a hammer if you try hard enough, but that doesn't make it actually a hammer or the right tool to use."
Not sure why you thought it necessary to expand "right tool, right job" into that longer version, but you're implying Shopify is the hammer. Why? Because it has "shop" in the name? They stack a bunch of technologies together just like everyone else. And with that comes attack surfaces and issues just like anyone else.
The package event-stream was compromised and went unnoticed for 60 days: https://medium.com/intrinsic-blog/compromised-npm-package-event-stream-d47d08605502
The package axios was compromised, and hijacked the author's credentials, so every attempt at a fix was unfixed. https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
The xz utility was backdoored for 2 months: https://gigazine.net/gsc_news/en/20240403-timeline-of-xz-open-source-attack
A student researcher took over Python ctx and PHPass package maintainership, pushing out malicious changes, and that took over 7 days to be detected and fixed: https://infosecwriteups.com/how-i-hacked-ctx-and-phpass-modules-656638c6ec5e
Kaspersky found multiple PyPI packages that had been exploited for more than a year: https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-year-long-pypi-supply-chain-attack-using-ai-chatbot-tools-as-lure
"LoftyLife" packages were exploited for several months: https://securelist.com/lofylife-malicious-npm-packages/107014/
Now that the attack window has changed to 7 days, all new exploits like these will come with time bombs to not trigger until 8 days.
Zoom has long been the most unsecure video/voice application.
Remember how they installed an open web server on people's computers which could be accessed by anyone through the web?
https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
Apple had to step in and patch it for them:
https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/
Or when they sent your chat data to Facebook?
https://www.vice.com/en/article/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account/
How it was discussed on HN: https://news.ycombinator.com/item?id=22703000
Or when Zoom was leaking private information?
https://www.vice.com/en/article/zoom-leaking-email-addresses-photos/
Or do you remember how those geniuses rolled their own crypto?
https://citizenlab.ca/research/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/
Or maybe you remember that Zoom has the ability to listen in in real-time on meetings held on their platform?
https://www.bbc.com/news/world-us-canada-55372493
It is most likely this: https://wicg.github.io/local-network-access/
For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.
One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.
Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.
The "AI" additions to Notepad are not limited to systems with an NPU. Why would they be, it's powered by LLMs running on Azure [0].
These sudden additions also correlated with the first CVE [1] in Notepad since its inception, so maybe their attention isn't where it should be.
I for one very much mind this and many other inclusions including the metastatic takeover off Office. OneDrive also was forced upon and severely worsened functioning software, despite not being "AI", so there is precedent at least.
[0] https://support.microsoft.com/en-us/windows/enhance-your-writing-with-ai-in-notepad-4088b954-c97b-46dc-813f-959be01746d5#:~:text=Notepad%20in%20Windows%20includes%20Rewrite,with%20the%20assistance%20of%20GPT.
[1] https://infosecwriteups.com/the-dumb-editor-that-got-too-smart-when-feature-bloat-leads-to-rce-0fd08d9c62cd?gi=6b82eb598d9c
It took me 4 years from learning to code and getting my first check. My writing from 4 years ago (at 16 yrs old) is extremely cringe but here's a link: https://infosecwriteups.com/how-i-earned-47000-usd-as-a-high-school-student-a9a68896b3a3?gi=489cfc4a8b31
A lot of time has passed since then. There was a lot I didn't realize back then:
- With the money I earned + another bounty I got a year later, I was able to actually move to the UK for uni, something my parents never could've afforded
- Being known for reverse engineering was a huge factor in me getting 2 of my internships
- Having the background knowledge in cybersecurity has helped immensely for me as a software engineer for problem solving
- I am now building a startup in the cybersecurity space as a software engineer. No more relying on the good will of companies for bug bounties