September 2021 Summaries

Eva Galperin, a prominent figure in cybersecurity and Director at the Electronic Frontier Foundation (EFF), is renowned for her advocacy against stalkerware and her efforts to protect vulnerable groups from online threats. With a background in political science, Galperin initially aimed to specialize in human rights and tech law but found her calling in cybersecurity and activism, focusing on Internet censorship and the protection of activists and journalists. Her work includes tracking advanced persistent threats (APTs), leading campaigns to enhance online privacy, and co-founding the Coalition Against Stalkerware. Galperin emphasizes the importance of ethical hacking, advocating for the protection of those often overlooked in cybersecurity discussions. Her approach combines technical skills with a deep commitment to social justice, and she encourages other security professionals to provide accessible advice and make ethical choices in their work. A notable highlight of her career includes her proactive measures against the Vietnamese government's attempts to target her with malware, showcasing her dedication to using her skills for the greater good. Outside of her professional life, Galperin engages in aerial circus arts, which offers her a physical and mental escape from the cerebral demands of cybersecurity.

Detectify views ethical hackers as allies in enhancing internet safety by responsibly disclosing security vulnerabilities and sharing knowledge. The company has launched a content series to celebrate hacker heroes, starting with Luke Stephens, known as hakluke, who is part of the Detectify Crowdsource community. Stephens, who was inspired to hack after watching "The Matrix" and has a background in IT and penetration testing, recently started his consultancy, Haksec. He emphasizes persistence as his hacker superpower and admires Jason Haddix for his skills and community positivity. Detectify's Crowdsource network collaborates with ethical hackers to provide up-to-date security research, aiming to protect end users by securing web applications.

In February 2021, Frans Rosén, co-founder of Detectify and a Crowdsource hacker, discovered security vulnerabilities in Apple's CloudKit framework, which hosts public databases for many Apple apps. These misconfigurations allowed unauthorized access to modify and erase data in specific apps like iCrowd+ and Apple News, as well as unintentionally disrupting the Shortcuts app by deleting its default zone. This led to widespread issues with shared shortcuts across Apple devices, prompting immediate attention from Apple Security, who quickly remediated the vulnerabilities. Rosén responsibly disclosed these findings to Apple, leading to a public acknowledgment of the issue and his reward of $28,000. His exploration revealed how Apple's apps connect to CloudKit through various APIs, with different scopes defining access levels, and highlighted the importance of proper configuration to secure public and private data.