Live data from Hacker News

Hacking into an insurance company by exploiting their premium calculator

eaton-works.com

71–80 of 113 posts

Re: Hacking into an insurance company by exploiting their premium calculator

#71
post #65

There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was). I managed to get my a…

There is a huge missing niche for trusted intermediaries of identity information. We’ve been working on this at https://cerebrum.com in a different niche (background checks), but this comment just triggered a slew of ideas…

Re: Hacking into an insurance company by exploiting their premium calculator

#72
Wild-assed guess before I read this: in their greed for personal information, they took what should be a purely client-side scripted job into something that connects to the back end.

Edit: Yup! Instead of just doing calculations, it involved some e-mail workflow.

> The password could be used to log into the “noreplyeicher@ttibi.co.in” Microsoft email account.

I'm surprised this is literally true as described.

The actual browser itself makes the actual SMTP connection to the Microsoft e-mail host! The authentication name used is the above e-mail address. I typed out the Base64 to check:

  1> (base64-decode "bm9yZXBseWVpY2hlckB0dGliaS5jby5pbg")
  "noreplyeicher@ttibi.co.in"
There is a second IT silliness here, a minor one compared to the password gaffe. "noreply" addresses should not be real mail accounts or working aliases!

The noreply address is just a fake you put into the SMTP envelope and From: which will bounce due to not resolving if someone replies to it.

Re: Hacking into an insurance company by exploiting their premium calculator

#73
I am not Indian but I work for a large Tata like IT firm. This hit way too close to home. There a lot of cultural issues here that comes down to management being rewarded if things are done cheaply and discouraging any agency or self-realization by the developers. If I saw this in the US, I’d walk out. They literally don’t have that option as there’s a 90 day salary clawback if they do. Some general thoughts:

- Most management has a non-tech background. So they get what they want to hear and don’t want to hear what’s wrong.

- Thinking this coming from the same team or from the same company is wrong. They silo developers like crazy. There likely was an API developer, an Office 365 developer, frontend developer (so specific it is down to the framework or stack!) and the developers themselves will not touch anything they aren’t “certified “ in.

- I have been in meetings on $100 million projects where they will seriously argue over the cost of sendgrid. Eventually this will come down to no one having “sendgrid experience” And some developer saying they can do it in Office365.

- Security team will get the first cut in budget since it should “already be secure.”

- You are likely talking over the head of the nephew hired to do security for this. Will the government or anyone sue them? No, so why is this guy bugging us.

Developers aren’t encouraged to develop but get tickets out and not question them. The manga is “It wasn’t in the requirements” all the way down the chain.

I work with smart developers out of India but it is not a culture of innovation. This kind of work is treated like a call center. Don’t go off script, stick your little problem domain, if we aren’t failing we are winning.

Re: Hacking into an insurance company by exploiting their premium calculator

#74
post #65

There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was). I managed to get my a…

The author of the article also rediscovered this vulnerability in June 2023.

https://eaton-works.com/2023/06/06/honda-ecommerce-hack/

Re: Hacking into an insurance company by exploiting their premium calculator

#75

I am not Indian but I work for a large Tata like IT firm. This hit way too close to home. There a lot of cultural issues here that comes down to management being rewarded if things are done cheaply and discouraging any agency or self-realization by the developers. If I saw this in the US, I’d walk out. They literally don’t have that option as there’s a 90 day salary clawback if they do. Some general thoughts: - Most…

> I have been in meetings on $100 million projects where they will seriously argue over the cost of sendgrid. Eventually this will come down to no one having “sendgrid experience” And some developer saying they can do it in Office365.

Reading this in your comment was physically painful.

Re: Hacking into an insurance company by exploiting their premium calculator

#76
It's a bit hard to imagine this specific problem existing outside of the Microsoft ecosystem. I can very well imagine that there are loads of corporate resources provided through a valid O365 account that are useful for targeted hacks -- heck, the metadata in the corporate directory alone is going to be useful to a ne'er-do-well.

I really can't believe they haven't changed the password. I wonder what part of their workflow that breaks?

Re: Hacking into an insurance company by exploiting their premium calculator

#77

The security blunders are obviously horrible, but MAYBE explained by inexperienced developers tasked with something way beyond their understanding. But how on earth did anyone approve storing confidential customer documents in an email account? This seems to indicate there's nobody in charge that understands anything about how to run this business. And if it's a subsidiary or outsourcing partner, it also shows that n…

I saw a fairly large estate agency system that bcc’d every outgoing email from their system to a shared account everybody then synced to Outlook. It was part audit log, part debugging tool, part database backup.

They changed when they realised employees were taking all their customers’ details to new jobs.

Re: Hacking into an insurance company by exploiting their premium calculator

#78
post #34

Earlier quoted context omitted.

I've seen similar levels of incompetence first hand. This isn't someone actively ignoring important security warnings. This is someone not understanding what you are talking about. This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to th…

The Peter Principle…people get promoted into incompetence.

We put peter there.

He's doing the job we put him there to do.

Re: Hacking into an insurance company by exploiting their premium calculator

#79

Wild-assed guess before I read this: in their greed for personal information, they took what should be a purely client-side scripted job into something that connects to the back end. Edit: Yup! Instead of just doing calculations, it involved some e-mail workflow. > The password could be used to log into the “noreplyeicher@ttibi.co.in” Microsoft email account. I'm surprised this is literally true as described. The act…

  > The actual browser itself makes the actual SMTP connection to the Microsoft e-mail host!
This is not generally possible, browsers cannot make arbitrary socket connections in the way that would be required to reliably communicate with an SMTP server. The article makes clear that the frontend is calling a poorly-coded email-sending API implemented as an HTTP endpoint.

Re: Hacking into an insurance company by exploiting their premium calculator

#80

> Everything after October 18 is a back-and-forth between CERT-In and me trying to determine if there would be a bug bounty reward. TTIBI never responded to the question, so I decided to close the case on December 22 and CERT-In sent me a nice appreciation letter. If a "leading Insurance Broker across India" can't afford to hire competent developers the least they can do is throw a couple bucks at someone who took th…

That’s a load-bearing password!
Post reply on HN