What Happens When You Send a Zero-Day to a Bank? • Hacker News Board

Re: What Happens When You Send a Zero-Day to a Bank?

#11

Post by lisper » Fri, Apr 21, 2017, 5:37 PM UTC

tdalaa wrote: post #5

Wow. Going on with your life as a C-level executive with this knowledge, as if it's just all good, is just insane. I'm sure they're in the clear personally now, but I can certainly see why they would wanna sell their company fast after gaining this knowledge in 2010.

> I'm sure they're in the clear personally now

Don't be so sure. If they didn't disclose this to their buyers they are guilty of fraud. The statute of limitations has probably run out (I don't know which state has jurisdiction here), but delayed discovery rules may apply.

Re: What Happens When You Send a Zero-Day to a Bank?

#12

Post by klapinat0r » Fri, Apr 21, 2017, 5:38 PM UTC

> if somebody sent you an email with that code (even if you never open the email)

What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

Re: What Happens When You Send a Zero-Day to a Bank?

#13

Post by fenwick67 » Fri, Apr 21, 2017, 5:39 PM UTC

mkagenius wrote: post #4

Were cookies shared across sites in 2008? It seems pretty odd..

Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following:

var i = document.createElement('img');

i.src= "http://news.ycombinator.com/y18.gif";

Then look at the cookies sent over the network.

Re: What Happens When You Send a Zero-Day to a Bank?

#14

Post by rpedela » Fri, Apr 21, 2017, 5:39 PM UTC

lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Are you an IP lawyer?

Re: What Happens When You Send a Zero-Day to a Bank?

#15

Post by cyphar » Fri, Apr 21, 2017, 5:40 PM UTC

klapinat0r wrote: post #12

> if somebody sent you an email with that code (even if you never open the email) What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

I know that MS Messenger used to "pre-fetch" URLs in your system's IE session even if you don't open the conversation. I presume there was some similar issue with 2008-era email clients (it's a "useful feature" after all).

Re: What Happens When You Send a Zero-Day to a Bank?

#16

Post by devy » Fri, Apr 21, 2017, 5:41 PM UTC

lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Are you saying NDA without putting a dollar value are unenforceable?

Re: What Happens When You Send a Zero-Day to a Bank?

#17

Post by idbehold » Fri, Apr 21, 2017, 5:41 PM UTC

mkagenius wrote: post #4

Were cookies shared across sites in 2008? It seems pretty odd..

Cookies are still sent for requests in which the response is opaque to the current document/window (e.g. , , , , etc). There's no way for the document/window containing these elements to ever access the actual bytes returned by them.

Re: What Happens When You Send a Zero-Day to a Bank?

#18

Post by beefhash » Fri, Apr 21, 2017, 5:41 PM UTC

lisper wrote: post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

Re: What Happens When You Send a Zero-Day to a Bank?

#19

Post by xyzzy_plugh » Fri, Apr 21, 2017, 5:42 PM UTC

klapinat0r wrote: post #12

> if somebody sent you an email with that code (even if you never open the email) What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?

I'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.

Re: What Happens When You Send a Zero-Day to a Bank?

#20

Post by komali2 » Fri, Apr 21, 2017, 5:42 PM UTC

jacquesm wrote: post #2

That's a lot of errors for one document.

I'm also kinda curious why the author didn't run through a simple spell checker before posting. I'm grateful for the article, it was an interesting read, but really why not just paste into google docs real quick or something?