Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Max Verstappen's passport and PII through FIA bugs

ian.sh

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#71

Post by codethief »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

I did something similar on an airline website earlier this year: I wanted to change the date of my return flight and also make it an open jaw (i.e. leave from a different airport than where I had arrived). Changing my flights was included in my original fare, modulo the fare difference. Unfortunately, on their website the input text field for the airport I would be flying out from would get disabled a second or two into loading the "alternative flights search" page, and wouldn't allow me to make it an open jaw. So I fired up my browser dev tools and changed the value of the text field to the desired airport code. Suddenly, I was finding the flights I had been looking for – as it turns out, at no additional charge whatsoever.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#73

Post by squigz »

bitexploder wrote: post #59
zozbot234 wrote: post #27

Earlier quoted context omitted.

The kind of probing they did and described in the blogpost, with the attempt to raise their privileges to admin is legally fishy AIUI. Usually this kind of thing would be part of a formal, agreed-to "red teaming" or "penetration testing" exercise, precisely to avoid any kind of legal liability and establish necessary guidelines. Calling an attempted access "ethical" after the fact is not enough.

Without any sort of formally posted bug bounty program explicitly authorizing this sort of activity the CFAA prohibits unauthorized access of "protected computers". I would classify this as legally risky. If FIA had a stick up their ass they could definitely come after the researcher. The researcher's ethical standing is pretty clean in my book, but this was definitely a little more than just changing a URL parameter…

I'd highly recommend adding some newlines to such comments. Walls of text are not fun to read.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#74

Post by jacquesm »

cheschire wrote: post #60
rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

What's insane is that there are countries where this is considered hacking, even if all you do is change the URL.

somefile-small.jpg -> somefile.jpg

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#75

Post by achairapart »

mulmen wrote: post #62
cheschire wrote: post #60

Earlier quoted context omitted.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

Did you try adjusting price?

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#76

Post by blitzar »

veqq wrote: post #16
forgotaccount22 wrote: post #9

Archaic company has archaic security. Well done on the RD, but boy does it not surprise me one bit. Would almost be willing to bet that the hash was MD5 too.

What hash do you use?

im 1337 - I use plain text stored in a public s3 bucket

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#77

Post by Nextgrid »

intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

What he did there could indeed be legally risky.

Remember that while for a lot of us this kind of security research & remediation is “fun”, “the right thing to do”, etc there are also people in our industry that are completely incompetent, don’t care about the quality of their work or whether it puts anyone at risk. They lucked their way into their position and are now moving up the ranks.

To such a person, your little “security research” adventure is the difference between a great day pretending to look busy and a terrible day actually being busy explaining themselves to higher ups (and potentially regulators) and get a bunch of unplanned work to rectify the issue (while they don’t care personally whether the site is vulnerable - otherwise they wouldn’t have let such a basic vulnerability slip through - now that there is a paper trail they have to act). They absolutely have a reason and incentive to blame you and attempt legal action to distract everyone from their incompetence.

The only way to be safe against such retaliation is to operate anonymously like an actual attacker. You can always reveal your identity later if you desire, but it gives you an effectively bulletproof shield for cases where you do get a hostile response.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#78

Post by School-Cotton »

achairapart wrote: post #75
mulmen wrote: post #62

Earlier quoted context omitted.

Did you try adjusting price?

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#79

Post by Kaibu »

intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

In Germany, the case of a company called "Modern Solution" has gained quite a bit of traction. An IT guy found a password, tried it on the company's phpmyadmin and reported that he could access their data. They sued him and the case went up to the highest German court, which acknowledged the lower court's decision to rule with the company. The IT guy got fined.

https://www.heise.de/news/Bundesverfassungsgericht-lehnt-Bes... (German article)

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#80

Post by alt227 »

olyjohn wrote: post #28
zozbot234 wrote: post #26

Earlier quoted context omitted.

It's an F1 racing site, their job is literally to move fast and break things. https://xkcd.com/1428/

You break things in F1, you lose. Reliability and consistency is key.

Apart from the many many times where a teams R&D department has come up with a radical new idea for a machine part which gives them an advantage, and then all the other teams copy it making it the new standard. This is how F1 has evolved forever, by taking risks and experimenting. Not by reliability and consistency!
Post reply on HN