A Hilarious ESET Broken Authentication Vulnerability

[FireShootSK]

Content source

http://egyptiangeeks.com/information-security/eset-broken-authentication-vulnerability/

Mohamed A. Baset founded broken authentication on ESET NOD32 activation page.

Here are methods:

• Direct page request
• Parameter modification
• Session ID prediction
• SQL injection

He share video too.




Full article...

 

[LabZero]

Vulnerability generates unlimited usernames and passwords for free...

 

[Pandy]

I love what they offered to him tho for reporting it

 

[Jack]

Marek from ESET has contacted MalwareTips, and has given this statement:

“We have taken the report sent to us very seriously and have immediately started our own investigation. The mentioned vulnerability in the ESET activation system doesn’t exist. The vulnerability was found on a fake website that is not owned by ESET or by any ESET partner. That site cannot generate new licenses. The site is currently blocked by the ESET products as a phishing website because it is misleading users and misusing the ESET brand.

We don’t recommend accessing the mentioned website and ESET is currently working on shutting it down.”

 

[Nico@FMA]

Marek from ESET has contacted MalwareTips, and has given this statement:

Clear as a bell.

 

[FireShootSK]

Marek from ESET has contacted MalwareTips, and has given this statement:

Sorry for false report. I only re-share tweet from The Hacker News

 

[Pandy]

Oh yea, it is "eu-eset .com"
plot twist

 

[jamescv7]

That's really a clever part; you may not the victim of that site but sharing the information without knowing its already misleading which take you on another round of being a victim.

 

[Mohamed A. Baset]

[**Update**]

ESET accused my report as an invalid report “after being accepted and rewarded #badass_logic” as this reported backend “eu-eset.com” is a phishing website.

The below screenshot reflects how confusion that ESET’s experts are suffering from during the report.

So if that’s really true and let’s argue on that this is true, Then:
1. Kudos to me that I have discovered a vulnerability in a website was built by a people was a good in “something” arguably “phishing” and still kick ESET’s ass by generating a valid Licenses.
2. More shame on ESET, they were being #####ed by this “phishing website” till the moment I reported them because that “phishing website” is generating “by my bypass” an actual paid valid license of their “award-winning product” for free, Here’s another proof on what I’m saying here:

 

[Mohamed A. Baset]

Marek from ESET has contacted MalwareTips, and has given this statement:

"That site cannot generate new licenses"

Here is a Proof: