Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I pwned a major New Zealand service provider

mrbruh.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: How I pwned a major New Zealand service provider

#31

Post by no_carrier »

mvdtnz wrote: post #15
ngonch wrote: post #13

Earlier quoted context omitted.

Hotels always ask to physically take my credit card, random maintenance guys ask to access my apartment without a heads-up from the landlord. It's seen as normal, but in my book it's a bit careless.

Of course hotels take your CC, how else are they supposed to charge it? And maintenance men accessing your home without a heads-up is very much illegal and not commonplace.

They're not supposed to write the details down, which is what this person was referring to.

In Asia, they quite often take your CC details and enter it into a text field in their own system in case they need to process it later, including the CVV. Sometimes they're writing it down on paper.

They're not entering it into a PCI compliant system where the digits are masked.

Re: How I pwned a major New Zealand service provider

#32

Post by no_carrier »

bell-cot wrote: post #12
apimade wrote: post #7

Earlier quoted context omitted.

That is neither standard nor normal.

Perhaps. From a distance (physical, social, or both) local norms of behavior are often non-standard and abnormal.

It's certainly not the norm in Australia, nor have I come across that in probably the last 15 or so years. Running your credit card through the terminal to place a hold on funds is done pretty much everywhere. I'm sure there's a few crusty old operators out there doing things the old way.

Re: How I pwned a major New Zealand service provider

#33

Post by OptionOfT »

ngonch wrote: post #5

Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop

I can't imagine how that would work with an Apple card? There's nothing printed on them.

Re: How I pwned a major New Zealand service provider

#34

Post by pikelet »

xupybd wrote: post #19
davesmylie wrote: post #9

Hmm. Notably Farmers NZ recently had an extended unplanned outage, and has a 4 star app

Kiwi bank is the most likely IMO. Almost 4 star and the kind of think GPT would do is leave in the Kiwi part.

I don't think so. The data returned talks about loyalty, rewards, and gift cards.

Re: How I pwned a major New Zealand service provider

#35

Post by pikelet »

svarrall wrote: post #25
davesmylie wrote: post #9

Hmm. Notably Farmers NZ recently had an extended unplanned outage, and has a 4 star app

They mentioned the name of the app in the article “KiwiServices”

They mentioned at the top of the article that this is not the real name.

Re: How I pwned a major New Zealand service provider

#37

Post by gtm1260 »

OptionOfT wrote: post #33
ngonch wrote: post #5

Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop

I can't imagine how that would work with an Apple card? There's nothing printed on them.

on apple card you can always pull up the real card info on the app.

Re: How I pwned a major New Zealand service provider

#38

Post by taitems »

At least they cared. I found an enumeration attack on an Australian referral service where phone numbers were keys and it returned way too much personal information. Responsibly disclosed numerous times, LinkedIn contacted employees. Not even acknowledged and at last check, still open vulnerability.

Re: How I pwned a major New Zealand service provider

#39

Post by allset_ »

rsch wrote: post #21
girvo wrote: post #2

That reminds me of all the SQL injection vulns that we used to blame on PHP. As PHP becomes less popular, and the same/similar vulnerabilities remain, I realise it's more just bad practices (though ~2000-early 2010s PHP really was pretty rough when it came to creating those holes, but that might just be a function of how popular it was!) Nice work on finding it :)

PHP was blamed for a good reason: for a long time it did not by default support prepared SQL statements. You could install the mysqli extension to gain such support but that was almost never available on shared web hosts.

And every tutorial you could find on how to use PHP with a database was a tutorial on how to add SQL injection to your site.

Re: How I pwned a major New Zealand service provider

#40

Post by StrauXX »

shakna wrote: post #8
StrauXX wrote: post #4

Earlier quoted context omitted.

No, they did not in any way break the law. As they wrote themselves: > I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.

Under New Zealand's Crimes Act, all unauthorised access is illegal. This has been used in court to cover places where someone was not pre-approved, rather than just a policy that gives an implied acceptance. It has also been used where someone has accidentally gained access via insecured systems. I would not be so confident in stating that they did not break the law.

Any half-decent VDP will have a safe harbour clause. Otherwise ot isn't a true VDP but rather just contact details.
Post reply on HN