Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking into an insurance company by exploiting their premium calculator

eaton-works.com

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Hacking into an insurance company by exploiting their premium calculator

#21

Post by stuff4ben »

stcredzero wrote: post #12
danielklnstein wrote: post #7

This is a boggling level of disdain for customer security - even putting aside the insanely low levels of data security, it's mind boggling that the website remained up for months after the disclosure, and that even after being taken down the vulnerability remained open. Great post!

This is a boggling level of disdain for customer security To be fair, this usually doesn't start as a boggling level of disdain. It usually starts out as 100% ignorance. It's how the people and the group respond to the negative feedback from experts and from reality, which brings in the disdain, even spiraling to boggling levels. There are two deep lessons herein, rooted in game theory. EDIT: In this case, op did eve…

Replace "ignorance" with "incompetence". This is an "I have no idea what the hell I'm doing" level of incompetence.

Re: Hacking into an insurance company by exploiting their premium calculator

#22

Post by gorbachev »

The security blunders are obviously horrible, but MAYBE explained by inexperienced developers tasked with something way beyond their understanding.

But how on earth did anyone approve storing confidential customer documents in an email account? This seems to indicate there's nobody in charge that understands anything about how to run this business. And if it's a subsidiary or outsourcing partner, it also shows that nobody has ever audited this business.

This is criminally negligent behavior from the company owners, and whoever is contracting them to do this work.

Re: Hacking into an insurance company by exploiting their premium calculator

#24

Post by orenlindsey »

So crazy that things like this still happen in production. I mean, maybe I have survivorship bias (we never hear about the companies that don't have security flaws, or the hundreds of APIs that are completely secure), but it should be super easy to make a site that is secure. Even I know how to do it. It shouldn't be that hard to find people who know how to make secure sites.

Re: Hacking into an insurance company by exploiting their premium calculator

#25

Post by joosters »

polishdude20 wrote: post #23

I'm curious to know how this person decided to just go looking into the source code of this very specific app. Why this one?

I would guess that they have looked at lots of apps, it’s kind of what a security researcher does.

Re: Hacking into an insurance company by exploiting their premium calculator

#26

Post by stcredzero »

stuff4ben wrote: post #21
stcredzero wrote: post #12

Earlier quoted context omitted.

This is a boggling level of disdain for customer security To be fair, this usually doesn't start as a boggling level of disdain. It usually starts out as 100% ignorance. It's how the people and the group respond to the negative feedback from experts and from reality, which brings in the disdain, even spiraling to boggling levels. There are two deep lessons herein, rooted in game theory. EDIT: In this case, op did eve…

Replace "ignorance" with "incompetence". This is an "I have no idea what the hell I'm doing" level of incompetence.

This is an "I have no idea what the hell I'm doing" level of incompetence.

Isn't it accepted security knowledge, that about 99% of everybody is at a "should not be doing it myself" level of security/crypto incompetence? I'm not saying that the example isn't particularly bad. It is.

Requiring competence would appear to be the wrong way to do it, here.

Re: Hacking into an insurance company by exploiting their premium calculator

#27

Post by OtherShrezzing »

danielklnstein wrote: post #7

This is a boggling level of disdain for customer security - even putting aside the insanely low levels of data security, it's mind boggling that the website remained up for months after the disclosure, and that even after being taken down the vulnerability remained open. Great post!

Given that the password hasn't changed, I'd assume that there are exactly 0 sysadmins or software engineers working at this insurance company. A web app was poorly hacked together a few years ago, and just ticks-over in the background. Nobody in the org knows about the exploit (and it's possible they don't have the capacity to understand the exploit).

Re: Hacking into an insurance company by exploiting their premium calculator

#28

Post by mschuster91 »

> Logging into the Microsoft account was surprisingly easy. There was no two-factor authentication set up or any other login verification prompts. If there was, it probably would not have been possible for me to successfully login.

This shouldn't have been possible in the first place for a few months now as Microsoft did a massive push to disable anything but OAuth logins for O365.

Re: Hacking into an insurance company by exploiting their premium calculator

#29

Post by ahoka »

lxe wrote: post #14

"Appreciation letter" is why most of these vulnerabilities are not reported or disclosed by whitehats and are actively exploited by hackers. There should be a legal framework that holds companies liable for certain level of security mishandling when it comes to private customer data.

There is one in Europe, it’s called GDPR.

Re: Hacking into an insurance company by exploiting their premium calculator

#30

Post by incangold »

orenlindsey wrote: post #24

So crazy that things like this still happen in production. I mean, maybe I have survivorship bias (we never hear about the companies that don't have security flaws, or the hundreds of APIs that are completely secure), but it should be super easy to make a site that is secure. Even I know how to do it. It shouldn't be that hard to find people who know how to make secure sites.

I am so with you. I should be the lowest common denominator when it comes to security- I am what in my head qualifies as a novice. But I notice basic flaws at almost every company I work for. Absolutely baffled how this keeps happening.
Post reply on HN