How I pwned a major New Zealand service provider
1–10 of 49 posts
Re: How I pwned a major New Zealand service provider
#2That reminds me of all the SQL injection vulns that we used to blame on PHP. As PHP becomes less popular, and the same/similar vulnerabilities remain, I realise it's more just bad practices (though ~2000-early 2010s PHP really was pretty rough when it came to creating those holes, but that might just be a function of how popular it was!)
Nice work on finding it :)
Re: How I pwned a major New Zealand service provider
#3Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
Re: How I pwned a major New Zealand service provider
#4Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
No, they did not in any way break the law. As they wrote themselves:
> I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
Re: How I pwned a major New Zealand service provider
#5Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop
Re: How I pwned a major New Zealand service provider
#6Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
>I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
Looks like he did some research before.
On the other hand
>On day 2 I awoke and began by finding some form of contact details, information was somewhat sparse but I managed to find a phone number.
Doesn't a responsible disclosure policy contain contact infos on where to report usually?
Re: How I pwned a major New Zealand service provider
#7Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop
That is neither standard nor normal.
Re: How I pwned a major New Zealand service provider
#8Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
No, they did not in any way break the law. As they wrote themselves: > I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
Under New Zealand's Crimes Act, all unauthorised access is illegal. This has been used in court to cover places where someone was not pre-approved, rather than just a policy that gives an implied acceptance. It has also been used where someone has accidentally gained access via insecured systems.
I would not be so confident in stating that they did not break the law.
Re: How I pwned a major New Zealand service provider
#9Hmm. Notably Farmers NZ recently had an extended unplanned outage, and has a 4 star app
Re: How I pwned a major New Zealand service provider
#10by default, make the thing return a 400 Invalid Request for any request that did not fit exactly what you are expecting. That at least lets you focus on ensuring the data that you are expecting is sane/valid/safe. Undocumented features will eventually bite you, and are loaded footguns, especially if your QA team doesn't know about the undocumented features.