Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking into an insurance company by exploiting their premium calculator

eaton-works.com

Post reply on HN
Print view View original

41–50 of 113 posts

Re: Hacking into an insurance company by exploiting their premium calculator

#41

Post by cnewey »

spaceheater wrote: post #35
orenlindsey wrote: post #24

So crazy that things like this still happen in production. I mean, maybe I have survivorship bias (we never hear about the companies that don't have security flaws, or the hundreds of APIs that are completely secure), but it should be super easy to make a site that is secure. Even I know how to do it. It shouldn't be that hard to find people who know how to make secure sites.

You are either young or don't know any better. All major companies have bug bounties program and consistently, every few weeks, payout CRITICAL level bounties, as in attacker managed to get full server/access to any account etc. Security breaches are just a matter of time. Who is to blame is debatable, since being a criminal and breaking and stealing (into digital or physical business) is against the law.

The sad fact is that the law in most countries is so toothless (and the law enforcement agencies so far behind) that the legal penalties are mostly just academic.

Bug bounties (and proper education + screening processes for developers) are the most effective way for businesses to prevent security breaches - relying on legal recourse is more of a “shutting the stable door after the horse has bolted” sort of approach.

Re: Hacking into an insurance company by exploiting their premium calculator

#42

Post by cwmoore »

AndrewKemendo wrote: post #20
autoexec wrote: post #16

> Everything after October 18 is a back-and-forth between CERT-In and me trying to determine if there would be a bug bounty reward. TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter. If a "leading Insurance Broker across India" can't afford to hire competent developers the least they can do is throw a couple bucks at someone who took th…

Most likely there are few alternatives which likely led to this issue in the first place

Unlike other scenarios!

Re: Hacking into an insurance company by exploiting their premium calculator

#44

Post by autoexec »

zelon88 wrote: post #34
autoexec wrote: post #16

> Everything after October 18 is a back-and-forth between CERT-In and me trying to determine if there would be a bug bounty reward. TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter. If a "leading Insurance Broker across India" can't afford to hire competent developers the least they can do is throw a couple bucks at someone who took th…

I've seen similar levels of incompetence first hand. This isn't someone actively ignoring important security warnings. This is someone not understanding what you are talking about. This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to th…

> This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to them or their team.

Sounds like exactly the kind of someone you wouldn't want to have to trust with your personal information let alone trust to manage your life/property/business/liability insurance.

Re: Hacking into an insurance company by exploiting their premium calculator

#45

Post by dirtyhippiefree »

zelon88 wrote: post #34
autoexec wrote: post #16

> Everything after October 18 is a back-and-forth between CERT-In and me trying to determine if there would be a bug bounty reward. TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter. If a "leading Insurance Broker across India" can't afford to hire competent developers the least they can do is throw a couple bucks at someone who took th…

I've seen similar levels of incompetence first hand. This isn't someone actively ignoring important security warnings. This is someone not understanding what you are talking about. This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to th…

The Peter Principle…people get promoted into incompetence.

Re: Hacking into an insurance company by exploiting their premium calculator

#46

Post by zelon88 »

autoexec wrote: post #44
zelon88 wrote: post #34

Earlier quoted context omitted.

I've seen similar levels of incompetence first hand. This isn't someone actively ignoring important security warnings. This is someone not understanding what you are talking about. This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to th…

> This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to them or their team. Sounds like exactly the kind of someone you wouldn't want to have to trust with your personal information let alone trust to manage your life/property/business/l…

Unfortunately the people in charge of hiring IT Directors often aren't qualified to hire IT Directors.

Re: Hacking into an insurance company by exploiting their premium calculator

#47

Post by pavel_lishin »

orenlindsey wrote: post #24

So crazy that things like this still happen in production. I mean, maybe I have survivorship bias (we never hear about the companies that don't have security flaws, or the hundreds of APIs that are completely secure), but it should be super easy to make a site that is secure. Even I know how to do it. It shouldn't be that hard to find people who know how to make secure sites.

> it should be super easy to make a site that is secure.

A "site" that's a static webpage? Sure.

A full application that just happens to use HTTP as one of its interfaces? More difficult than you'd think.

Re: Hacking into an insurance company by exploiting their premium calculator

#48

Post by elliottcarlson »

m-GDEV wrote: post #36

I've not very knowledgeable on the process of building a backend API but could someone explain how sending the email's password back in an error log could ever been a good idea?

Obviously, the answer is never (unless it's for _very_ specific testing in a dev only environment).

In this case, it's not that they were sending the password directly for any reason, but instead returning the raw SMTP log from sending the email; which as a byproduct had the password in it due to needing to authenticate with the SMTP server.

Re: Hacking into an insurance company by exploiting their premium calculator

#50

Post by stcredzero »

rudasn wrote: post #33
roland35 wrote: post #31

Yikes! This an unusual exploit since it both has an absolutely massive impact (literally access to everything on SharePoint and Outlook??), with a relatively straightforward vector (just looking at client side JavaScript). One nit: I'd rather see people redact sensitive data with solid blocks instead of blurs in screenshots. Can't be too careful!

I think nowadays the blur feature just makes it look blurry, but it's not the actual original text being blurred.

How are we to know if someone didn't just use an affine transform? This is another place where ignorance could result in security leaks.
Post reply on HN