well at least it was a password hash :D
There's probably another rockyou out there waiting to happen
Accessing Max Verstappen's passport and PII through FIA bugs
21–30 of 151 posts
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#22Re: Accessing Max Verstappen's passport and PII through FIA bugs
#23Ian, it would be great to see an RSS feed on your website if you want to gain another regular reader :)
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#24Ian, it would be great to see an RSS feed on your website if you want to gain another regular reader :)
Ian is a great writer
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#25That's not just one vulnerability, that's a whole slew of failures. For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that.
I hope you got at least free tickets for life out of this.
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#26Archaic company has archaic security. Well done on the RD, but boy does it not surprise me one bit. Would almost be willing to bet that the hash was MD5 too.
It's an F1 racing site, their job is literally to move fast and break things. https://xkcd.com/1428/
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#27Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?
The kind of probing they did and described in the blogpost, with the attempt to raise their privileges to admin is legally fishy AIUI. Usually this kind of thing would be part of a formal, agreed-to "red teaming" or "penetration testing" exercise, precisely to avoid any kind of legal liability and establish necessary guidelines. Calling an attempted access "ethical" after the fact is not enough.
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#28Archaic company has archaic security. Well done on the RD, but boy does it not surprise me one bit. Would almost be willing to bet that the hash was MD5 too.
It's an F1 racing site, their job is literally to move fast and break things. https://xkcd.com/1428/
You break things in F1, you lose. Reliability and consistency is key.
Re: Accessing Max Verstappen's passport and PII through FIA bugs
#29Just use a framework to build your site. Don’t reinvent the wheel!
i respectfully disagree with this sentiment. i think that in general, reinventing the wheel can be a great learning opportunity in understanding how the wheel works.
But maybe do that on a smaller scale personal project?