Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#111

Post by Zekio »

mulmen wrote: post #62
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

Did you try adjusting price?

you can do this on surprisingly many websites, where they include the price in the url they redirect you to, when going to the payment provider, and even then often it is only protected by an md5 hash if it is verified

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#113

Post by abustamam »

anal_reactor wrote: post #94
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

My insurance company has different frontend password regex on registration page and on login page. My password passed the registration regex but fails the login regex. In order to log in, I need to manually remove the frontend-side password regex check.

This absolutely boggles my mind. My last insurance company let me create a 20 character PW but limited the password field on the login screen to 16 chars. I didn't think to futz around with the code so I just recreated a less secure password. I suspect many other less technical people either did that too or just called support.

There is zero excuse for that though. 16 chars is just way too short for a proper secure pass phrase, but at least make it consistent with password creation!

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#114

Post by abustamam »

jacquesm wrote: post #74
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

What's insane is that there are countries where this is considered hacking, even if all you do is change the URL. somefile-small.jpg -> somefile.jpg

Black hat hacking or white hat hacking? Genuinely curious because a lot of these security write-ups can't happen without "hacking." which may explain why we don't get these security write-ups from folks in those countries.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#115

Post by abustamam »

spockz wrote: post #95
jacquesm wrote: post #83

Earlier quoted context omitted.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

How did the arrest go? For all you know it was the local cop that took him to the station and put him under arrest. Not to necessarily punish but to imprint that even though the action was minimally invasive for a simple bus ticket, it applied on larger systems, could have a significant effect. So more as a simple friendly deterrent rather than arrest and spent some nights in jail.

I don't think you can call any sort of arrest a simple friendly deterrent, or intended not to punish. That shit's traumatizing. Should he have done that? Probably not. But did he deserve arrest for finding a vulnerability? This could have been a conversation that didn't involve police. The kid could have helped them improve their systems instead of spending taxpayer dollars to send cops to the kid to arrest him.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#116

Post by abustamam »

2rsf wrote: post #109
anal_reactor wrote: post #93

Earlier quoted context omitted.

Lesson: instead of being the good guy and reporting shit, just sell it on black market.

(playing the devil's advocate here) But that's not the case- if you find someone's physical keys in the street, will try to open the neighbor's door with it? so why is it ok to use a password that you "found" to log into a site?

Curiosity. I once dropped my keys on the way to my leasing office. I searched the entire complex and office for my keys. Then I saw a guy at the mailboxes trying to open each one, one by one.* I asked if he needed help and he just said he found some keys on the ground and wanted to find out who they belonged to. They were mine. And my mailbox was in the other side of the complex so all bets were off for him anyway.

It costs next to nothing to try out a key in multiple places in the same proximity. Once you start going door to door using a random key you found, that's suspicious.

*it occurs to me now that I write this that this behavior is suspicious as well and probably illegal. He should have turned it into the leasing office.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#117

Post by somehnguy »

2rsf wrote: post #109
anal_reactor wrote: post #93

Earlier quoted context omitted.

Lesson: instead of being the good guy and reporting shit, just sell it on black market.

(playing the devil's advocate here) But that's not the case- if you find someone's physical keys in the street, will try to open the neighbor's door with it? so why is it ok to use a password that you "found" to log into a site?

I don't think the common analogy of "key to a house" makes any sense. For starters, a significant portion of people in existence aren't trying to break into your house 24/7.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#118

Post by daseiner1 »

motorest wrote: post #88
jacquesm wrote: post #83

Earlier quoted context omitted.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

> A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is st…

if the kid could successfully modify the scanned value of physical barcodes a) that would be quite the feat and b) that would absolutely be showing up a bunch of big names

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#119

Post by coldpie »

awesome_dude wrote: post #32

Rule 1. NEVER trust user supplied data. Once that rule was broken, any other rules broken became clear to everyone

Rule 0: Any networked computer should be considered semi-public. Don't store any information you do not want to be public, or give access to controls that you do not want to be publicly accessible, on a networked computer. There are simply too many vulnerabilities to assume otherwise.
Post reply on HN