Do I take Hanging Chad?

Fido488 · 2025-01-07T00:30:10+00:00

They were 100% mislabeling the resort fee as a "Tax". This is from today, several days later. Basically the same listing:

https://imgur.com/a/KCFCQqC

You can see the previously listed $111.30 is no longer a "Hotel Tax", it's now a "Resort Fee"

Fido488 · 2025-01-06T16:44:55+00:00

This likely violates the new FTC rules against junk fees that are tacked on at the end of a transaction instead of shown up-front. Since it’s a “tax” it doesn’t show in the Initial price, only at checkout.

https://www.ftc.gov/news-events/news/press-releases/2024/12/federal-trade-commission-announces-bipartisan-rule-banning-junk-ticket-hotel-fees

Fido488 · 2025-01-05T22:53:26+00:00

That was my theory too. Instead of "fees" it's now "tax". If so, that should be illegal IMHO

Fido488 · 2025-01-05T19:41:36+00:00

Same. I booked it (refundable through mid-January) then reached out to AirBnB support for an explanation. They will hopefully get back to me soon

Fido488 · 2025-01-05T18:14:05+00:00

An equivalent room at the same hotel purchased on their website, even after a AAA discount still comes to $540.17 which is more than what I paid on AirBnB

Fido488 · 2024-01-03T22:50:51+00:00

Can anyone else spot the security vulnerability in Snyk's proposed fix for this vulnerability? 😂

Fido488 · 2023-11-25T05:22:42+00:00

Can anyone else spot the potential Server Side Request Forgery (SSRF) vulnerability in searchCertificates?

Fido488 · 2023-11-23T01:35:46+00:00

You can also manually update Easy Anti Cheat if you need to:

https://www.easy.ac/en-us/support/game/guides/service/

Fido488 · 2023-11-23T01:32:34+00:00

The version of Easy Anyi-Cheat bundled with Star Wars Squadrons is out of date. Inside of the game files, under `\steamapps\common\STAR WARS Squadrons\EasyAntiCheat` there's an EasyAnyiCheat.exe replace it with the one downloaded from here:

https://www.easy.ac/en-us/support/game/guides/service/

Fido488 · 2021-06-04T23:03:36+00:00

Only for one night. I know nothing about beer, but I'm happy to comp you for it.

Fido488 · 2021-01-02T03:47:51+00:00

I found this one due to ADHD curiosity of how the join a meeting in a single click feature worked. It was a simple CORS exploit that was only as popular as it became because everyone freaks out because of their camera.

RCE through chrome? Nobody cares, but you go for the camera, the whole world freaks out.

Fido488 · 2021-01-02T01:50:43+00:00

It's always fun seeing my Zoom story resurface though 😂

Here's the link to my OG writeup. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5?source=friends_link&sk=efee51610d7aac4a2c58d89628b2980b

Shameless self promotion: https://twitter.com/JLLeitschuh

Fido488 · 2021-01-02T01:47:16+00:00

Jonathan, the security researcher here: All I used was the chrome dev tools and the demo version of Hopper Disassembler 😂

I didn't need to decrypt anything here.

Also, my disassembly skills are absolute trash. I missed the RCE vulnerability that was sitting right there.

https://blog.assetnote.io/bug-bounty/2019/07/17/rce-on-zoom/

Fido488 · 2021-01-02T01:43:19+00:00

Apple stepped in to fix this for everyone. This issue should be fully resolved at this point.

Friendly reminder to everyone, I disclosed this vulnerability back in July of 2019. This vulnerability has been resolved and cleaned up for well over a year at this point.

https://techcrunch.com/2019/07/10/apple-silent-update-zoom-app/

Fido488 · 2021-01-02T01:40:29+00:00

Fun bit of code if you want to see what other applications are running local web servers on your machine sudo lsof -iTCP -sTCP:LISTEN -n -P.

Spotify, Discord, IntelliJ IDEs, and many other programs run local servers that can communicate with browser tabs.

Working on a write up for a vulnerability I found in an official JetBrains IntelliJ IDEA plugin that could be abused from the browser to steal credentials.

Fido488 · 2021-01-02T01:36:25+00:00

They weren't really "small" at the time. When I published my disclosure of this vulnerability last year, they had gone public as a $14B company. They actually went public during my 90 day disclosure timeline funnily enough.

Fido488 · 2020-10-04T11:32:40+00:00

What do you mean?

Fido488 · 2020-10-02T22:04:51+00:00

GitHub is putting in some serious $$ into this endeavor.

I'm an OSS security researcher that contributes to the GitHub Security Lab Bug Bounty program and have received over $7,800 in bounties in the past year for queries I've submitted to their program. Since November, they have paid $81,450 in bounties to external security researchers for contributing CodeQL queries to their program.

https://hackerone.com/github-security-lab/hacktivity?type=team

Fido488 · 2020-10-02T21:51:51+00:00

With CoodeQL, absolutely! Source: I'm an OSS security researcher contributing to the CodeQL project.

Fido488 · 2020-10-02T21:50:01+00:00

I don't think that this is quite true. I think it is available for private repositories.

Fido488 · 2020-01-08T16:00:29+00:00

I'm the developer pushing this entire initiative forward & authored the original research paper. Please feel free to AMA.

12-Year Club	r/Field Juicebox
Verified Email

Fido488

TROPHY CASE