Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

141–150 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#141

Post by School-Cotton »

jacquesm wrote: post #83
School-Cotton wrote: post #78

Earlier quoted context omitted.

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

> without actually making off with all of the gold

This is the key difference. The comment I was replying to implied that the transaction was actually completed, or at least I thought it did.

If the guy[0] didn't indeed actually benefit from the vulnerability then that is a very different story, and I don't think he should be arrested in that case.

0: not "kid" -- he is 18 which I assume is above the age of criminal responsibility in Hungary.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#142

Post by sebasvisser »

skeezyjefferson wrote: post #125
jacquesm wrote: post #25

That's not just one vulnerability, that's a whole slew of failures. For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that. I hope you got at least free tickets for life out of this.

> For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that. I hate this kind of post-hoc finger pointing people do after security breaches. There are other concerns in life beyond security - youre naive to think differently. Is your house secure or could somebody break past your protectio…

Sure, hate on the person pointing at the fire instead of the people holding the matches.

If you aren’t prepared to face criticism after a failure, you shouldn’t participate in a professional environment. Without people pointing out where it went wrong you’ll never j ow what to improve upon. Because if you knew, and chose not to act..now that would be a whole new level of incompetence.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#143

Post by zalusio »

skeezyjefferson wrote: post #125
jacquesm wrote: post #25

That's not just one vulnerability, that's a whole slew of failures. For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that. I hope you got at least free tickets for life out of this.

> For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that. I hate this kind of post-hoc finger pointing people do after security breaches. There are other concerns in life beyond security - youre naive to think differently. Is your house secure or could somebody break past your protectio…

Security has to be the #1 priority in computing, unlike your house which probably doesn't need to be fortified like a prison. The reason is that unlike your house, a computer system is exposed to 8 billion people at all times, and maybe 7 billion of them will face no consequences if they break in and steal your stuff.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#144

Post by ewoodrich »

anal_reactor wrote: post #94
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

My insurance company has different frontend password regex on registration page and on login page. My password passed the registration regex but fails the login regex. In order to log in, I need to manually remove the frontend-side password regex check.

Variant of this I've hit is the phone number validation rules at signup differs from the actual API call to send 2FA texts (or was changed between the time of original signup and login attempt) so I create an account successfully with a Google Voice number and then when I actually need to receive 2FA the message goes into the aether with no error surfaced at any point.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#145

Post by homakov »

>The JSON HTTP response for updating our own profile contained the "roles" parameter, something that might allow us to escalate privileges if the PUT request was vulnerable to mass assignment. We began looking through the JavaScript for any logic related to this parameter.

Oh, here we go again. JavaScript brings mass assignment back. My efforts went in vein. Strong params, pls!

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#147

Post by 2rsf »

dylan604 wrote: post #137
2rsf wrote: post #109

Earlier quoted context omitted.

(playing the devil's advocate here) But that's not the case- if you find someone's physical keys in the street, will try to open the neighbor's door with it? so why is it ok to use a password that you "found" to log into a site?

If I don't try the keys in my neighbor's door, how will I know which neighbor they belong?

It's even worse, you find a key that you know belonged to your neighbor so you try it out just in case in his door.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#148

Post by array_key_first »

trollbridge wrote: post #104
zozbot234 wrote: post #27

Earlier quoted context omitted.

The kind of probing they did and described in the blogpost, with the attempt to raise their privileges to admin is legally fishy AIUI. Usually this kind of thing would be part of a formal, agreed-to "red teaming" or "penetration testing" exercise, precisely to avoid any kind of legal liability and establish necessary guidelines. Calling an attempted access "ethical" after the fact is not enough.

... so you'd prefer that the only people doing this will be black-hat hackers who then sell the information on the black market?

I think nobody does, but ultimately our laws are stupid. The CFAA in particular can be unfairly weaponized to make examples, and can put people in prison for DECADES for activities that don't warrant such a response.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#149

Post by codethief »

ewoodrich wrote: post #144
anal_reactor wrote: post #94

Earlier quoted context omitted.

My insurance company has different frontend password regex on registration page and on login page. My password passed the registration regex but fails the login regex. In order to log in, I need to manually remove the frontend-side password regex check.

Variant of this I've hit is the phone number validation rules at signup differs from the actual API call to send 2FA texts (or was changed between the time of original signup and login attempt) so I create an account successfully with a Google Voice number and then when I actually need to receive 2FA the message goes into the aether with no error surfaced at any point.

> Variant of this I've hit is the phone number validation rules at signup differs from the actual API call to send 2FA texts

Yeah, this is incredibly annoying, though to be fair, this can be a hard problem to solve. 3rd-party systems often don't tell you what their exact phone number validation rules are or silently update them, and then, to top it off, don't throw errors when validation fails. And more often than not, the 3rd-party system's developers also must have never heard of the Falsehoods programmers believe about phone numbers[0].

Source: I was responsible for adjusting phone number validation for a major ecommerce site in the past.

[0]: https://chromium.googlesource.com/external/libphonenumber/+/...

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#150

Post by skeezyjefferson »

sebasvisser wrote: post #142
skeezyjefferson wrote: post #125

Earlier quoted context omitted.

> For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that. I hate this kind of post-hoc finger pointing people do after security breaches. There are other concerns in life beyond security - youre naive to think differently. Is your house secure or could somebody break past your protectio…

Sure, hate on the person pointing at the fire instead of the people holding the matches. If you aren’t prepared to face criticism after a failure, you shouldn’t participate in a professional environment. Without people pointing out where it went wrong you’ll never j ow what to improve upon. Because if you knew, and chose not to act..now that would be a whole new level of incompetence.

it would be like every time a business gets broken into you berate them for their lack of physical security. nobody does it because that would be inane, and what you are doing is a straight analog to it
Post reply on HN