Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap

guest · Aug 9, 2018

Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap
DNS leak flaws are outside of bug-bounty scope
August 09, 2018
https://www.theregister.co.uk/2018/08/09/kaspersky_vpn_dns_leak_bug_bounty/

Kaspersky's Android VPN app whispered the names of websites its 1,000,000-plus users visited along with their public IP addresses to the world's DNS servers, it is claimed.

Whenever you would visit a website, say, supercyberotters.org, from your device with Kaspersky's VPN enabled, and your browser needed to look up the IP address of the domain name, it would reach out to a DNS server, such as one provided by your Wi-Fi, your cellular network, or yourself. That lookup would not be run through the VPN tunnel, it was reported, so the DNS service would be able to log the domain names of the sites you were visiting, and when, against your public IP address.

Dhiraj Mishra, who reported the flaw in April, via Kaspersky's HackerOne-hosted bounty program, claims he still has not received a dime.
Click to expand...

Log in or Sign up

Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap

guest Guest

Log in or Sign up

Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap

guest Guest

Useful Searches