Interesting Vulnerabilities from Public Pentest Reports

The talk looks at security flaws found in public penetration test reports, which are free to read and often cover projects used by people at risk. It opens with mobile findings from a Hong Kong COVID-19 contact tracing app. These include an Android task hijacking flaw, vaccination records saved to a removable SD card, a settings toggle that could be switched off without re-authentication, and a TLS hostname check that was bypassed for the health system's domain, allowing traffic interception. A cleartext messaging protocol in a Bluetooth chat project is also covered, along with the Android and iOS settings developers must change to allow it.

The middle section moves to web, backend and cloud issues. A Python web application accepted a user ID in the request body, letting an attacker modify another account and take it over through password reset. An open-source project shipped a default JWT signing secret, so anyone could forge admin tokens. A compressed payload sent to an OpenTelemetry collector exhausted server memory, and a single spoofed UDP packet disrupted a VPN meant to help users in restrictive countries. Overly broad AWS administrator permissions also spread across accounts. The talk ends with an Electron prototype pollution demo that defeated a link safety check.

The takeaways are practical: grant the minimum permissions needed, never trust identifiers or roles supplied by the client, generate secrets per installation, limit decompression sizes, and handle malformed network input without crashing. The speaker also stresses that business logic flaws like these are usually missed by automated scanners and need manual review.