How Vine’s Entire Source Code Was Online for Anyone to See

How Vine's Entire Source Code Was Online for Anyone to See

HIGHLIGHTS

  • The ethical hacker was taking part in Twitter’s HackerOne programme
  • The hacker gained access to source code through a Docker image
  • The bug was fixed by website within 5 minutes of flaw’s demonstration

Hackers are known to be notorious. They like to find out all the vulnerabilities that various sites possess and depending on their intention, they use this knowledge to either create nuisance for the website owners or inform them about the loopholes to help make the site safer.

The makers of video-clip sharing site Vine, currently owned by Twitter, should be grateful that ethical hacker known by the name ‘avicoder’ chose to be the latter sort when he found a way to download Vine’s entire source code.

For those who are unaware about the subject, a source code for website usually contains confidential information and access to it can leave the site extremely vulnerable to attacks that can potentially even destroy it.

In this case, ‘avicoder’ was just looking at the potential security flaws without any ill intentions and in his blog post, he explained the entire flaw and how he gained the access to the site’s source code through its Docker image, which should ideally have been private but was publicly available. With the image, he was able to run the service locally on his machine.

“I was able to see the entire source code of vine, its API keys and third party keys and secrets. Even running the image without any parameter, was letting me host a replica of VINE locally,” the hacker said in his blog post.

On March 31, avicoder demonstrated a full exploitation of the security flaw to Twitter as part of its HackerOne bounty programme and the site then fixed the bug in around 5 minutes. The hacker was rewarded a bounty of $10,080(roughly Rs. 6,73,000) for informing the site about this flaw.

Tags: Ethical Hacker, Twitter HackerOne, Vine Security Flaw, Vine Source Code

 

[“Source-Gadgets”]

This Was Google’s Top Search for 2014

This Was Google's Top Search for 2014

SAN FRANCISCO: 

Robin Williams’s death had people worldwide scouring the Internet for insights into the famed comic’s life, making him the hottest search trend of the year on Google, the web giant said today.

“The passing of beloved comedian and actor Robin Williams shook the world, bringing many people online to search for more information and to remember, and putting Williams in the #1 spot on our global trends charts,” said Google’s vice president of search, Amit Singhal, in a blog post.

“There was even an uptick in searches related to depression tests and mental health in the days following his death.”

Williams, known for high-energy, rapid-fire improvisation and clowning, was found dead on August 11 at his home in Marin County, north of San Francisco.

He hanged himself, according to coroners.

There were signs that the 63-year-old comic actor — who had recently been diagnosed with Parkinson’s Disease — had tried to cut his left wrist, according to an autopsy report.

Williams, an Oscar-winner and veteran of movies, stand-up shows and hit television series, was one of Hollywood’s most popular entertainers and his death triggered an outpouring of emotion the world over.

World Cup, Ebola top searches

World Cup fever was the second hottest search trend at Google.

“The World Cup in Brazil had its fair share of unforgettable moments and had everyone glued to their TVs and mobile devices all summer,” Google said.

“From Luis Suarez’s bite heard around the world, to Tim Howard’s superman performance vs. Belgium, to Germany’s incredible run to their fourth title, the competition certainly lived up to its reputation and topped the charts.”

The deadly Ebola virus and tragedy-struck Malaysia Airlines were the third and fourth fierce search topics, respectively, followed by the “ALS Ice Bucket Challenge” fad of dousing oneself in icy water to raise money to battle Lou Gehrig’s Disease.

The remainder of the Top 10 search trends for this year were mobile game Flappy Bird, drag queen performer Conchita Wurst, the Islamic State group, hit animated film “Frozen” and the Sochi Olympics.

“It was a year in which we were struck by the death of a beloved comedian, and watched news unfold about a horrific plane crash and a terrifying disease,” Singhal said.

“We were captivated by sporting events, and had our fun with birds, a bucket of ice and a frozen princess.”

Apple’s new iPhone 6 was the top consumer electronics gadget search trend, while “Hunger Games” film star Jennifer Lawrence was the top query trend focused on a person, according to Google.

Nude photos of the Oscar-winning actress and a trove of other stars were hacked and posted online in September, and several threatened to sue Google for failing to take down the leaks.

[“source-ndtv”]

Norms Changed Where Spectrum Was Allotted, Not Auctioned: Prasad

Norms Changed Where Spectrum Was Allotted, Not Auctioned: Prasad

India on Wednesday approved changes in policy where telecom spectrum or airwaves were allotted administratively rather than auctioned, to arrive at the market-determined price for the scarce resource. This is to facilitate sharing and trading of spectrum by players.

“The most recent recommended reserve price will be taken as the provisional price, where auction-determined price is not available,” Communications and IT Minister Ravi Shankar Prasad said after a meeting of the cabinet, presided over by Prime Minister Narendra Modi.

“Subsequent to the completion of ensuing auction and with the availability of auction-determined price, the provisional price already charged will be adjusted with the auction-determined price with effect from the date of liberalisation on a pro-rata basis,” he said.

The cabinet decision is based on the recommendations of industry watchdog, the Telecom Regulatory Authority of India (Trai), and will facilitate optimal utilisation of spectrum by introducing new technologies, sharing and trading, the minister said.

“A sum of Rs. 1,300 crores is likely to accrue to the exchequer by this process.”

The government had already specified the norms for administratively allotted spectrum in 800MHz and 1,800MHz bands, and the watchdog was approached for the same on similar spectrum in the 900MHz band.

In 800MHz, four circles had been left out. But this, too, was done end-February.

During consultations, the watchdog wanted to know from the stakeholders if the liberalisation of administratively-allotted spectrum in 900MHz band should be similar to what has been spelt out by theDoT for 800MHz and 1800MHz band, and if such reform should be made mandatory.

Download the Gadgets 360 app for Android and iOS to stay up to date with the latest tech news, product reviews, and exclusive deals on the popular mobiles.

Tags: DoT, India, Spectrum, Telecom, Trai
[“Source-Gadgets”]

The Daily Fix: Akbar Owaisi was jailed for hate speech. Why not apply same standard to Baba Ramdev?

The Latest: Top stories of the day
1. Honour killing: Dad, uncles killed Mandya girl for affair with Dalit boy.
2. 3 Dalit teens stripped and beaten for stealing bike in Chittor.
3. A 31-year-old Dalit, working as a clerk in an Ahmedabad court,committed suicide at his home alleging casteist discrimination and harassment at his workplace.
4. A Spanish couple have been attacked in Pushkar, Rajasthan and the woman’s clothes torn off.
5. Pilibhit fake encounter case: CBI court sentences 47 policemen to life for killing 10 Sikh pilgrims after branding them Khalistani terrorists.
6. The Bharatiya Janata Party has filed a police complaint against a journalist whose tweet mocked Modi’s trip to Saudi Arabia.
7. The price of petrol has been hiked by Rs 2.19 a litre and diesel by 98 paise per litre.
8. Virat Kohli has been named captain of World Twenty20 XI, but there’s no Indian in women’s team of the tournament.

The Big Story: Mass murder as mundane

On Sunday, yoga guru Baba Ramdev addressed a sadbhavana, peace and understanding rally organised by the Rashtriya Swayamsevak Sangh in Haryana. The aim of the function was to bring back peace after the brutal Jat reservation riots in February. But Ramdev doesn’t seem to have got the full memo.

Instead of focussing on peace, he seemed to hint at mass murder and the decapitation of lakhs of people who refuse to say “Bharat Mata ki jai”.

“Some person wears a cap and stands up,” began Ramdev referring to Muslims. “He says I will not say ‘Bharat Mata ki jai’ even if you decapitate me. This country has a law, otherwise let alone one, we can behead lakhs. But we respect this country’s law. If somebody stands up and speaks like this, that gives strength to hooligans. We respect this country’s law and Constitution. Otherwise if anybody disrespects Bharat Mata, we have the capability of beheading not one but thousands and lakhs.”

Muslims and other minority groups that believe in monotheism have pointed out that they can be nationalistic without invoking India as a goddess.

Ramdev’s comments came just a day after Maharashtra Chief Minister Devendra Fadnavais demanded Indians who woudn’t say “Bharat Mata ki jai” to be expelled from the country.

In both cases, the religious nationalism of the demand that all Indian chant “Bharat Mata ki jai” as a proof of their patriotism is a convenient smokescreen to hide behind given the BJP’s massive failures in governance. Ramdev’s call to turn Haryana’s attention to Muslims who refuse to chant a slogan is a poor cover for the BJP’s complete faiure to control the terrible violence during the recent agitation for reservations by Jats. So scandalous was the official response that the Bharatiya Janata Party government in Haryana – apprehensive of more riots – meekly agreed to be arm-twisted into actually awarding the quota. In Maharashtra, Fadnavis’s rhetoric is a cynical attempt to distract attention from the crushing drought in the state.

In 2013, Majlis-e-Ittehadul Muslimeen legislator Akbaruddin Owaisi was arrested for hate speech. Were the same standards applied to Baba Ramdev, the police would be pursuing him with equal vigour. But given the climate of majoritarianism today, that seems an unlikely prospect.

The Big Scroll
Watch the video of Ramdev admitting that India’s laws prevent him from beheading the “lakhs” of people who refuse to say Bharat Mata ki Jai. How Bharat Mata” became the code word for a theocratic Hindu state. And historian DN Jha points out that it’s only from the late 19th century that the idea of Bharat as mother found its way into thepopular vocabulary.

Politicking & Policying
1. I spent the most important years without my father: Saibaba’s daughter.
2. Row in Bihar over the inclusion of strongman Shahabuddin in the Rashtriya Janata Dal’s newly constituted national executive committee.
3. Congress government in Meghalaya may collapse on its own, claimsthe Bharatiya Janata Party.

Punditry

1. India should have close ties with the Gulf countries and with Iran,argues Kanwal Sibal in the Telegraph.
2. VP Ansari’s remarks on the need to protect minority rights have been made before. But they bear repeating, says Fali S Nariman in theIndian Express.
3. Ajit Balakrishnan in the Business Standard asks that if we can come up with ways of sharing property rights on the internet, why not do something similar in urban spaces?

Don’t Miss
Raksha Kumar explains why two adivasi women and an activist refused to ask for bail in Chhattisgarh

The district of Raigarh is protected under the Fifth Schedule of India’s Constitution, with special safeguards around the transfer of indigenous lands.

Chhattisgarh’s rehabilitation guidelines state that families, especially those living in districts covered in Fifth Scheduled areas, are eligible for the allocation of alternate land or housing, preferably in the area where they already reside.

The protesting villagers of Bankhet are yet to get alternate land or housing. The state revenue department officials claim an eviction notice was issued to the three households on March 22, asking them to vacate their homes by March 30. However, according to the residents, the notice reached them only on the morning of April 1, the day the bulldozers arrived with the police.

[“source-Scroll”]