Podcasts Technology Day[0] [bounty] Baby Monitor Bugs, Grafana, and Twitter De-anonymization

[bounty] Baby Monitor Bugs, Grafana, and Twitter De-anonymization

Published: Feb. 16, 2022, 1 a.m.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/baby-monitor-bugs-grafana-and-twitter-de-anonymization.html

\n

CSRF lives again in the form of CORF, Cross-Origin Request Forgery with an attack against Grafana. We also take a look at some baby monitor issues and a de-anonymization attack against Twitter.

\n

[00:00:28] Cross-origin request forgery against Grafana [CVE-2022-21703]
\n

\n

[00:17:50] Vulnerabilities Identified in Nooie Baby Monitor
\n

\n

[00:26:47] [Twitter] Discoverability by phone number/email restriction bypass
\n

\n

[00:32:40] EarnHub Exploit - Post mortem
\n

\n

The DAY[0] Podcast episodes are streamed live on Twitch (@dayzerosec) twice a week:

\n
    \n
  • Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
    • \n
  • Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.
    • \n
\n

The Video archive can be found on our Youtube channel: https://www.youtube.com/c/dayzerosec

\n

You can also join our discord: https://discord.gg/daTxTK9

\n

Or follow us on Twitter (@dayzerosec) to know when new releases are coming.