On June 15th, 2021 our COO David Sopas presented at C- DAYS 2021 “Taking Over Your Subdomain 101”, which you can watch on YouTube. In his talk, David explains with great detail what subdomain takeover is, how to exploit and prevent it, as well as several recent Char49 findings. In this article...
C-DAYS is a conference organized annually by the National Cybersecurity Center (CNCS), the Portuguese authority on cybersecurity and aims to promote and debate this topic. This is the year of the 7th edition of the event, where professionals, academics, decision-makers and interested parties in gen...
Early 2019 we, at Char49, were challenged to research the most common API security issues. At that time API security was not exactly on the news, but APIs were becoming a fast-paced critical piece of modern applications architecture. We followed this technological change since its early days either due to our penetration testing services or responsible disclosure programs. That had given us a great understanding and experience on the API security scene, but we’ve dug deeper into API-related publicly available security incidents data. Our contribution was released later that year as part of the OWASP API Security Top 10 2019.
PHDays (Positive Hack Days) brings the world's cutting edge in digital security to Moscow every year since 2011. Organized by Positive Technologies, this year's edition hosts more than 100 talks by more than 130 developers, security experts, and hackers from all over the world. Roundtables, both pu...
For almost 30 years, the RSA Conference has been an important meeting point in the cybersecurity community to share, learn and growth. A space for innovation and partnerships where, from the 17th to the 20th of May 2021, another edition takes place with the presence of specialists in cybersecurity from all over the world.
In this year's edition, the conference will be attended by two Char49 specialists, David Sopas (COO) and Pedro Umbelino (Senior Security Researcher), this in partnership with Erez Yalon (Director of Security Research, Checkmarx), Luis Gomes (Global Head of Information Security, OLX Group) and Tanya Janca (Founder & CEO, We Hack Purple Academy, Community and Podcast).
During our research on the Segways’ domain space, we found a subdomain pointing to a third-party domain “pending for deletion” by its owner. Using a domain monitoring and backorder service, as soon as the third-party domain became available we got control over Segway’s subdomain.
According to responsible disclosure best practices, we provided Segway a detailed security advisory. This article is published after the security issue has been (silently) fixed by Segway.
