21–30 of 49 posts
I don’t think HN should be a place for “company shaming”… unless the author contacted the company and they denied/rejected/threaten him instead of fixing the issues. I guess it did not happen. I see HN as a place for collective learning. I don’t see what we can learn from this post.
Earlier quoted context omitted.
Firing employees for not knowing proper security practices is like being a teacher and firing your student for not knowing the answers on a test. The employer should be performing proper audits and password rotations and/or educating their employees. It should never be "stupid users", but "stupid me".
Not parent, but I reckon that a company might see "oh this employee didn't follow our clearly signposted security guidelines, let's just fire them and get on with our lives" as an easier way out than "we have to actually start to invest into security". I'm not saying that's good, but I could definitely see it happening.
How legal is what this guy did in Spain?
"I thought about writing an email to these people, let them know about the vulnerabilities in their code, and the bad practices they have, but I didn’t at this point. I felt like I was able to find more things regarding this company." Oof, that's bad behavior. I wouldn't be proudly blogging about this.
On the other hand if he had stopped at this point, the company would have no idea about the weak admin credentials that could lead to real data breach and internal compromise at a later date.
I don’t think HN should be a place for “company shaming”… unless the author contacted the company and they denied/rejected/threaten him instead of fixing the issues. I guess it did not happen. I see HN as a place for collective learning. I don’t see what we can learn from this post.
Which company is shamed in this post?
The best part of the post is certainly the Spanish author using target.com as a generic placeholder to explain the attack, when target is an actual chain with more than 300 stores :D
If anyone is curious about the SQL "time based attack" the author said to Google for, here's some info: https://www.sqlinjection.net/time-based/
https://hackernoon.com/timing-based-blind-sql-attacks-bd276d...
Timing attacks let you get a boolean true or false answer from an injected query and, I think, guess secrets: any correct guess will give a delayed response, and a false wlil return immediately.
Earlier quoted context omitted.
Yes, this crosses all the lines. You can debate the finer points of the SQL injection bit, but the moment he got into Rocket Chat admin and started gratuitously stealing employee cookies, there's just no way to paint that any color other than black. As his bio states, he's a software engineer - clearly not a security professional, because he's steamrolling right through all infosec ethics. A quick Google search for h…
If I was interviewing the author for a role their complete disregard for infosec ethics would be a hard "no" from me - no matter how good they might be at interviewing.