Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

101–110 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#101

Post by cheschire »

mulmen wrote: post #62
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

Did you try adjusting price?

I am not malicious or willing to attempt theft. Academically though, in an official testing environment, that would be entertaining to attempt.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#104

Post by trollbridge »

zozbot234 wrote: post #27
intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

The kind of probing they did and described in the blogpost, with the attempt to raise their privileges to admin is legally fishy AIUI. Usually this kind of thing would be part of a formal, agreed-to "red teaming" or "penetration testing" exercise, precisely to avoid any kind of legal liability and establish necessary guidelines. Calling an attempted access "ethical" after the fact is not enough.

... so you'd prefer that the only people doing this will be black-hat hackers who then sell the information on the black market?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#105

Post by braza »

In 2025 I think most of the PII is just a legal liability for 99% of the cases.

I once saw a custom service where you could connect your data, like Mixpanel or some analytics, and the whole motto was that this service did not want any of your PII data, and even the employees and companies that could access all the anonymous data had pseudonyms (e.g., a company named "Ocean's Eleven" with the employees Billy, Reuben, Rusty, Benedict, Linus, Basher, and so on).

Does someone know any architectures or designs of applications (books or references) that take anonymity as default?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#106

Post by achairapart »

motorest wrote: post #97
achairapart wrote: post #92

Earlier quoted context omitted.

Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above: > Did you try adjusting price? And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

> Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even cl…

There was no personal profit. He bought a ticket he never used, just to show to people on twitter how bad the system was. He could have silently taken advantage of his discovery and travel at no cost for a long time peraphs. But no.

Sounds more like vulnerability reasearch than crime to me.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#107

Post by wqaatwt »

LudwigNagasena wrote: post #99
wqaatwt wrote: post #98

Earlier quoted context omitted.

No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill. Then you took their money and gave them the item without saying anything. Would seem like a weird situation but I don’t see how its theft.

I bet that would be most likely classified as shoplifting and/or fraud depending on jurisdiction.

Or a form of negotiation if done in plain sight.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#108

Post by sgarland »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

Somewhere, there is a table with a `frequency` column, storing client-supplied values, and an application happily accepting them as-is.

This is why you normalize your tables and use FK Constraints - you aren’t going to catch all the edge cases in code. Let the DB be the final arbiter of validity, because it’s been tested to hell and back.

Re: Huel, that’s pretty smart. My rate of consumption is fairly consistent (usually 1x/day on weekdays), but occasionally I’ll have one on the weekend, so the given cadences worked for me. I do 2x 12-pack / 4 weeks to hit the free shipping tier.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#109

Post by 2rsf »

anal_reactor wrote: post #93
Kaibu wrote: post #79

Earlier quoted context omitted.

In Germany, the case of a company called "Modern Solution" has gained quite a bit of traction. An IT guy found a password, tried it on the company's phpmyadmin and reported that he could access their data. They sued him and the case went up to the highest German court, which acknowledged the lower court's decision to rule with the company. The IT guy got fined. https://www.heise.de/news/Bundesverfassungsgericht-lehnt…

Lesson: instead of being the good guy and reporting shit, just sell it on black market.

(playing the devil's advocate here) But that's not the case- if you find someone's physical keys in the street, will try to open the neighbor's door with it? so why is it ok to use a password that you "found" to log into a site?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#110

Post by sgarland »

motorest wrote: post #97
achairapart wrote: post #92

Earlier quoted context omitted.

Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above: > Did you try adjusting price? And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

> Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even cl…

IANAL, and furthermore have no idea what Hungary’s legal system is like, but mens rea is a thing. If I break a window by using it as a target for practicing my golf swing (I don’t golf; I have no idea if this is something golfers do) I am culpable. If I break a window because I’m trying to land balls next to the window, I might be culpable. Again, IANAL, so if anyone wants to correct my analogy, please do.
Post reply on HN