Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

331–340 of 466 posts

Re: I found a vulnerability. they found a lawyer

#331

Post by LtWorf »

svrtknst wrote: post #243
DANmode wrote: post #195

Earlier quoted context omitted.

> You don't need to retrieve other people's data to demonstrate the vulnerability. If you’re reporting to a nontechnical team…which sometimes you are…sometimes you do?

If you flip it, we have a dude here admitting to breaching a large number of accounts and gaining access to PII -- including PII about minors. Are we and the Maltese government just going to trust this guy and assume he has actually deleted everything, with no investigation?

If his goal was to keep the data he wouldn't have reported it?

Re: I found a vulnerability. they found a lawyer

#333

Post by tracker1 »

alright2565 wrote: post #151
tracker1 wrote: post #95

Earlier quoted context omitted.

Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day. My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the futu…

If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm. For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field: import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}") print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}") MD5: 5f4dcc3b5aa765d61d8327d…

It wasn't done wrong.. A contract requirement for a state deployment required a specific hashing algorithm...

Re: I found a vulnerability. they found a lawyer

#334

Post by duskdozer »

ronbenton wrote: post #332

All the disclosure and legal issues aside, it’s sobering to think of how many of these types of trivial bugs exist on random websites that collect sensitive user information. It seems hopeless to try to safeguard one’s own information.

Which is why collecting and storing sensitive user information needs to be more heavily restricted and treated as the unsafe activity that it is.

Re: I found a vulnerability. they found a lawyer

#335

Post by jp1016 »

The part where they blame users for not changing the default password is infuriating but unfortunately very common. I've seen this exact same attitude from companies that issue credentials like "Welcome1!" and then act shocked when accounts get popped.

What really gets me is the legal threat angle. Incremental user IDs + shared default password isn't even a sophisticated attack to discover. A curious user would stumble onto this by accident. Responding to that with criminal liability threats under Maltese computer misuse law is exactly the kind of thing that discourages researchers from reporting anything at all, which means the next person who finds it might not be so well-intentioned.

The fact that minors' data was exposed makes the GDPR Article 34 notification question especially pointed. Would love to know if the Maltese DPA ever followed up on this.

Re: I found a vulnerability. they found a lawyer

#337

Post by sethaurus »

ddtaylor wrote: post #293
bgnn wrote: post #280

Earlier quoted context omitted.

What is CFAA? I couldn't find anything about it in EU or Malta. Is it something in India or China? Or Japan? Hmm, maybe I'm missing another country.. Australia?

Computer Fraud and Abuse Act

For anyone seeking more details on this act, it is embodied as "18 U.S. Code §1030 - Fraud and related activity in connection with computers"[0], and applies specifically to the United States of America, a nation not involved in any way with this incident.

[0]: https://www.law.cornell.edu/uscode/text/18/1030

Re: I found a vulnerability. they found a lawyer

#338

Post by herzzolf »

kwanbix wrote: post #137
Hnrobert42 wrote: post #96

I use a different email address for every service. About 15 years ago, I began getting spam at my diversalertnetwork email address. I emailed DAN to tell them they'd been breached. They responded with an email telling me how to change my password. I guess I should feel lucky they didn't try to have me criminally prosecuted.

Same with me. I started to get spam from the email I used for a Portuguese airline. They didn't even respond.

Same, then later learned about TAP being breached. No disclosure from the company itself though...

Re: I found a vulnerability. they found a lawyer

#339

Post by randlet »

ddtaylor wrote: post #293
bgnn wrote: post #280

Earlier quoted context omitted.

What is CFAA? I couldn't find anything about it in EU or Malta. Is it something in India or China? Or Japan? Hmm, maybe I'm missing another country.. Australia?

Computer Fraud and Abuse Act

Parent is making the point that people from the US often forget that other countries exist and adhere to different rules & regulations and it seems like you're unintentionally emphasizing it for them.
Post reply on HN