Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I pwned a major New Zealand service provider

mrbruh.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: How I pwned a major New Zealand service provider

#21

Post by rsch »

girvo wrote: post #2

That reminds me of all the SQL injection vulns that we used to blame on PHP. As PHP becomes less popular, and the same/similar vulnerabilities remain, I realise it's more just bad practices (though ~2000-early 2010s PHP really was pretty rough when it came to creating those holes, but that might just be a function of how popular it was!) Nice work on finding it :)

PHP was blamed for a good reason: for a long time it did not by default support prepared SQL statements. You could install the mysqli extension to gain such support but that was almost never available on shared web hosts.

Re: How I pwned a major New Zealand service provider

#22

Post by alp1n3_eth »

bauruine wrote: post #6
hsbauauvhabzb wrote: post #3

Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.

>I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth. Looks like he did some research before. On the other hand >On day 2 I awoke and began by finding some form of contact details, information was somewhat sparse but I managed to find a phone number. Doesn't a responsible disclosure policy contain contact infos on where to repor…

Weirdly enough... not always.

When it comes to random companies running their own VDP vs. hiring it out, it can be less than standard despite there being lots of resources on setting it up. I've seen ones that only include a phone number, the email address listed doesn't exist anymore, etc.

Others have had to even get to the point of contacting an executive via LinkedIn despite there being a VDP page / security.txt.

Re: How I pwned a major New Zealand service provider

#23

Post by adamhartenz »

ngonch wrote: post #5

Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop

This is the same vibes as "That's how they measure pants!"

Re: How I pwned a major New Zealand service provider

#24

Post by greenmartian »

technion wrote: post #18
ngonch wrote: post #13

Earlier quoted context omitted.

Hotels always ask to physically take my credit card, random maintenance guys ask to access my apartment without a heads-up from the landlord. It's seen as normal, but in my book it's a bit careless.

I agree that Australia could improve a lot but hotels will take a credit card scan at every country I've been to. In many other countries they also take your passport away and you wait a while to get it back.

> .. Australia could improve a lot but hotels will take a credit card scan

I've not had this done to me in Australia since late 90s early 00s. These days all it takes is a simple tap (or chip swipe) to put a temporary Hold[0] that's released on check-out (or next day).

[0]https://en.wikipedia.org/wiki/Authorization_hold

Re: How I pwned a major New Zealand service provider

#26

Post by pjsg »

Does this api allow me to enumerate the users (by phone number) using the service? That would seem to be bad as well. I. guess that it depends on what their fix was.

If this really was the first api request made by the app, and it has a serious vulnerability, then the omens are not great for the rest of the api calls either.

Re: How I pwned a major New Zealand service provider

#28

Post by protocolture »

ngonch wrote: post #5

Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop

Everyone dogpiling on you is incorrect. This has been my experience as well.

I swear half my job these days is helping australian businesses retroactively purge themselves of plaintext card data.

I have seen some shit man.

Re: How I pwned a major New Zealand service provider

#30

Post by kupopuffs »

ngonch wrote: post #5

Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop

how can you care when all your stress is aimed towards staying alive
Post reply on HN