Rafay Baloch

Rafay Baloch (born 5 February 1993) is a Pakistani ethical hacker and security researcher.

On 23 March 2022, ISPR recognized Rafay Baloch's contribution in the field of Cyber Security with Pride for Pakistan award. In 2021, Islamabad High court designated Baloch as an amicus curia for a case concerning social media regulations. Rafay Baloch has been featured in several international publications for his work in cybersecurity and digital privacy issues.

Personal life Rafay Baloch was born in 1993 in Karachi. He attended Bahria University from which he obtained a bachelor's degree in computer science.

Career Baloch began his hacking career while he was still doing his bachelor's. He has been active into bug bounty programs and has reported several critical vulnerabilities in several open-source web applications as well as in bug bounty programs. Baloch found critical vulnerabilities in PayPal in 2012: he hacked into PayPal servers by exploiting a remote code execution vulnerability. He was rewarded $10,000 and a job offer to work for them as a Security Researcher that he refused as he was still doing his bachelor's at that time. Baloch has also been awarded $5000 by Google and Firefox for baring the vulnerability in their browsers. In 2014, he has been recognized as one of the world’s top five ethical hacker by Checkmarx.

Security research

Baloch has actively reported several critical vulnerabilities in browsers. He started by finding Same Origin Policy (SOP) bypass in Android Stock browser which was initially rejected by Google; however, this was later verified by Google after researchers from Rapid7 verified it. This was coined as . Baloch followed by reporting several other SOP bypasses. Researchers at Trend Micro found this bug to be more widespread. It was later reported that hackers had been actively using Baloch's SOP bypass exploits for hacking into Facebook accounts. The SOP bypass bug was elevated by Rapid7 researcher Joe Vennix for conducting a remote code execution. Baloch also found several vulnerabilities affecting WebView which allowed an attacker to read local files as well as steal cookies from the user device. In October 2020, Baloch unveiled several address bar spoofing vulnerabilities affecting Apple Safari, Yandex, Opera Mini, UC Browser, Opera Touch, Bolt Browser and RITS browser. The vulnerability disclosure was coordinated by Rapid7 who gave 60 days' timeline for patching vulnerabilities. Upon completion of 60 days, Baloch released the POC exploits of the affected browsers. Rafay, along with another researcher, discovered numerous security vulnerabilities that impact PureVPN's Linux desktop client.

Apple Safari address bar spoofing controversy In 2018, Baloch unveiled a crack in both Safari and Microsoft's Edge browser that paved the way for the URL of a safe website to be shown in the address bar while users were actually being taken to a different, and possibly malicious, website. Rafay Baloch identified the security issue and informed Apple and Microsoft in early June 2018. Microsoft fixed the issue within two months but Apple didn’t respond to Baloch's report despite the deadline given of 90 days grace period so he made the details public. Rafay Baloch wrote in his article that an address bar can be used to easily breach someone’s privacy without them noticing it. The reason this is possible is because an address bar is the only reliable indicator for security in new browsers, as it displays the site’s URL and other details related to the webpage one is on.

Google no-patch policy discovery In 2014, after Rafay Baloch and Joe Vennix reported Google about a bug that could allow hackers to dodge the Android Open Source Platform (AOSP) browser’s Same-Origin Policy (SOP), they discovered that Google had already terminated its support for WebView on Android devices running Android 4.3 or older versions, while putting the onus on OEMs and the open source security community to provide patches to users at the same time. Whereas Google’s official stance on WebView for older pre-Android 4.4 devices was as follows: “If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration. Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch.” Unfortunately, older versions of Android having unpatched WebView bugs were mainly due to their poor upgraded path, leaving users exposed.

Google then released WebView as a stand-alone application that could be updated separately from the Android version of a device. Simply put, the re-architecting of the WebView would benefit the latest versions of Android, Lollipop 5.0 and Marshmallow 6.0.

Writing He is the author of Ethical Hacking Penetration Testing Guide and Web Hacking Arsenal: A Practical Guide to Modern Web Pentesting.