There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was). I managed to get my a…
Hacking into an insurance company by exploiting their premium calculator
71–80 of 113 posts
Re: Hacking into an insurance company by exploiting their premium calculator
#72Edit: Yup! Instead of just doing calculations, it involved some e-mail workflow.
> The password could be used to log into the “noreplyeicher@ttibi.co.in” Microsoft email account.
I'm surprised this is literally true as described.
The actual browser itself makes the actual SMTP connection to the Microsoft e-mail host! The authentication name used is the above e-mail address. I typed out the Base64 to check:
1> (base64-decode "bm9yZXBseWVpY2hlckB0dGliaS5jby5pbg")
"noreplyeicher@ttibi.co.in"
There is a second IT silliness here, a minor one compared to the password gaffe. "noreply" addresses should not be real mail accounts or working aliases!The noreply address is just a fake you put into the SMTP envelope and From: which will bounce due to not resolving if someone replies to it.
Re: Hacking into an insurance company by exploiting their premium calculator
#73- Most management has a non-tech background. So they get what they want to hear and don’t want to hear what’s wrong.
- Thinking this coming from the same team or from the same company is wrong. They silo developers like crazy. There likely was an API developer, an Office 365 developer, frontend developer (so specific it is down to the framework or stack!) and the developers themselves will not touch anything they aren’t “certified “ in.
- I have been in meetings on $100 million projects where they will seriously argue over the cost of sendgrid. Eventually this will come down to no one having “sendgrid experience” And some developer saying they can do it in Office365.
- Security team will get the first cut in budget since it should “already be secure.”
- You are likely talking over the head of the nephew hired to do security for this. Will the government or anyone sue them? No, so why is this guy bugging us.
Developers aren’t encouraged to develop but get tickets out and not question them. The manga is “It wasn’t in the requirements” all the way down the chain.
I work with smart developers out of India but it is not a culture of innovation. This kind of work is treated like a call center. Don’t go off script, stick your little problem domain, if we aren’t failing we are winning.
Re: Hacking into an insurance company by exploiting their premium calculator
#74There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was). I managed to get my a…
Re: Hacking into an insurance company by exploiting their premium calculator
#75I am not Indian but I work for a large Tata like IT firm. This hit way too close to home. There a lot of cultural issues here that comes down to management being rewarded if things are done cheaply and discouraging any agency or self-realization by the developers. If I saw this in the US, I’d walk out. They literally don’t have that option as there’s a 90 day salary clawback if they do. Some general thoughts: - Most…
Reading this in your comment was physically painful.
Re: Hacking into an insurance company by exploiting their premium calculator
#76I really can't believe they haven't changed the password. I wonder what part of their workflow that breaks?
Re: Hacking into an insurance company by exploiting their premium calculator
#77The security blunders are obviously horrible, but MAYBE explained by inexperienced developers tasked with something way beyond their understanding. But how on earth did anyone approve storing confidential customer documents in an email account? This seems to indicate there's nobody in charge that understands anything about how to run this business. And if it's a subsidiary or outsourcing partner, it also shows that n…
They changed when they realised employees were taking all their customers’ details to new jobs.
Re: Hacking into an insurance company by exploiting their premium calculator
#78Earlier quoted context omitted.
I've seen similar levels of incompetence first hand. This isn't someone actively ignoring important security warnings. This is someone not understanding what you are talking about. This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to th…
The Peter Principle…people get promoted into incompetence.
He's doing the job we put him there to do.
Re: Hacking into an insurance company by exploiting their premium calculator
#79Wild-assed guess before I read this: in their greed for personal information, they took what should be a purely client-side scripted job into something that connects to the back end. Edit: Yup! Instead of just doing calculations, it involved some e-mail workflow. > The password could be used to log into the “noreplyeicher@ttibi.co.in” Microsoft email account. I'm surprised this is literally true as described. The act…
> The actual browser itself makes the actual SMTP connection to the Microsoft e-mail host!
This is not generally possible, browsers cannot make arbitrary socket connections in the way that would be required to reliably communicate with an SMTP server. The article makes clear that the frontend is calling a poorly-coded email-sending API implemented as an HTTP endpoint.Re: Hacking into an insurance company by exploiting their premium calculator
#80> Everything after October 18 is a back-and-forth between CERT-In and me trying to determine if there would be a bug bounty reward. TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter. If a "leading Insurance Broker across India" can't afford to hire competent developers the least they can do is throw a couple bucks at someone who took th…