More vulnerabilty fun, Halloween edition

[rlyons]

Flaw in OAuth implementation for Grammerly and others; allows full account takeover.
https://www.darkreading.com/remote-workforce/oauth-log-in-full-account-takeover-millions

iPhone MAC address randomization hasn't ever worked. Turns out that while it was creating a random MAC for each WiFi network; it was also broadcasting the legit hardware MAC over port 5353/UDP. Verified an issue since the feature launched three years ago.
https://arstechnica.com/security/2023/10/iphone-privacy-feature-hiding-wi-fi-macs-has-failed-to-work...

[urvashi]