B'ad Samurai 
#security #automation #soar #iac and #tay
I love the PacNW / BC. When I'm not doing security shenanigans, you'll find me on a glacier, volcano, ski lot or sketching mushrooms on the trail.
I believe the outdoors heal and are for EVERYONE.
Keyoxide: aspe:keyoxide.org:6FO76WXKQECSKSK6X7QD5VSZ2A
A Look at New ASNs
🍝 New Blog Post: tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
tl;dv's Firestore database has zero tenant isolation on their meetings collection. Any free-tier user can query every meeting on the platform. 181,874 meetings. 84,312 users. 35,003 domains.
What's exposed:
- Creator emails, conference IDs, recording status, timestamps
- Live calls you can join uninvited (I joined 2, including one with the Malaysian Ministry of Education)
- Government meetings from 23 countries
- Corporate meetings from thousands of companies
Reported January 28th. Six months later, still not fixed. CTO never responded. Their Firestore database has better uptime than their inbox.
Full writeup: https://bobdahacker.com/blog/tldv-hack
#InfoSec #BugBounty #ResponsibleDisclosure #Firebase #Security #CyberSecurity #Privacy #DataExposure #APISecurity #tldv #MeetingPrivacy


