291–300 of 329 posts
All I want to say is something off topic,but the only vacation I've had away fro m the kids and with my wife was a week in Budapest, and I miss it. Such a beautiful city, so romantic...and I rode the metro everywhere. ahh Budapest. :-)
Earlier quoted context omitted.
Why didn't you report it? Seems somewhat negligent - at the very least from a Good Samaritan™ point of view
If he reported it, he runs the risk of the company turning on him (as was the case in the article above). If he doesn't report it, nothing happens. It's a choice between the certainty of no loss vs the possibility of great loss.
Two takeaways, one from this and one from my other past experience. First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away. Second, if you're…
3rd takeaway - don't do this in turkey unless you want to end up in a literal Turkish prison.
Earlier quoted context omitted.
Well obviously if you do that you wouldn't be testing the SQL injection for your main connection to begin with. I'm not arguing against paying the debt - I would pay it in either case. However leaving such a vulnerability exposed is so bad they deserve to get their entire database dropped (and in this case I hope they don't have backups).
> However leaving such a vulnerability exposed is so bad they deserve to get their entire database dropped (and in this case I hope they don't have backups). I understand the feeling here, but no, they don't deserve to get their assets destroyed because of a lack of care.`
Earlier quoted context omitted.
You're replying to a comment about news of someone being arrested for a similar thing.
There's such a thing as anonymous reporting
Earlier quoted context omitted.
In case anyone feels like doing something like that, this talk is worth a listen: https://www.youtube.com/watch?v=eQ2OZKitRwc A talk on how Tor users got caught. In a nutshell: it wasn't Tor's fault, but bad OPSEC on the part of the users.
Also, it is worth considering that debt collection agencies are very good at finding people, and very bad at upholding ethical standards. Going to prison is not the worst case scenario.
Two takeaways, one from this and one from my other past experience. First, when testing whether you can change a price and have a transaction go through successfully, RAISE THE PRICE. If you lower the price the affected entity may come back and say "See??? He's STEALING from us! Lock him up!" If you've overpaid for something through their web interface that complaint and issue goes completely away. Second, if you're…
Or it doesn't, because you have still "hacked them". Doing it in a seemingly bizarre way may only raise more suspicions; obviously you must have maliciously cheated them, since who would give them money?
Please don't put people at risk by giving such "advice".
I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…
I have read some advice in the past that one should report vulnerabilties via officially known independent security related group (white hat) or via a journalist. The point is to get some legal backing just in case. Does anybody have an experience with such way?
Earlier quoted context omitted.
I'm the sheriff! But all kidding aside, It sounds like the sheriff is the hacker. Who has discovered every lock is the exact same through investigation. That said, a hacker isn't elected to protect people, they are doing it out of the "kindness" of their heart. What a lot of people get in trouble for is hacking first and asking for permission after. If you go up to a company with a statement like: "I think you may ha…
That seems unreasonable. If I logged in to a service and saw an URL like http://example.com/1234/secret_data , calling them with a report of potential vulnerability would be a waste of their and my time 98% of the time. And there's infinite number of such "potential vulnerabilities" to report, too. Like on HN, I see I can edit my profile description over at https://news.ycombinator.com/user?id=TeMPOraL . I wonder wha…