Accessing Max Verstappen's passport and PII through FIA bugs • Hacker News Board

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#91

Post by jacquesm » Thu, Oct 23, 2025, 9:44 AM UTC

motorest wrote: post #88

jacquesm wrote: post #83

Earlier quoted context omitted.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

> A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is st…

How do you propose he would have been able to establish that this was indeed a vulnerability?

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#92

Post by achairapart » Thu, Oct 23, 2025, 9:50 AM UTC

motorest wrote: post #88

jacquesm wrote: post #83

Earlier quoted context omitted.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

> A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is st…

Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above:

> Did you try adjusting price?

And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#93

Post by anal_reactor » Thu, Oct 23, 2025, 9:55 AM UTC

Kaibu wrote: post #79

intheitmines wrote: post #2

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

In Germany, the case of a company called "Modern Solution" has gained quite a bit of traction. An IT guy found a password, tried it on the company's phpmyadmin and reported that he could access their data. They sued him and the case went up to the highest German court, which acknowledged the lower court's decision to rule with the company. The IT guy got fined. https://www.heise.de/news/Bundesverfassungsgericht-lehnt…

Lesson: instead of being the good guy and reporting shit, just sell it on black market.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#94

Post by anal_reactor » Thu, Oct 23, 2025, 9:59 AM UTC

cheschire wrote: post #60

rpcope1 wrote: post #58

Earlier quoted context omitted.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

My insurance company has different frontend password regex on registration page and on login page. My password passed the registration regex but fails the login regex. In order to log in, I need to manually remove the frontend-side password regex check.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#95

Post by spockz » Thu, Oct 23, 2025, 10:14 AM UTC

jacquesm wrote: post #83

School-Cotton wrote: post #78

Earlier quoted context omitted.

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

Why are you on HN? A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper e…

How did the arrest go? For all you know it was the local cop that took him to the station and put him under arrest. Not to necessarily punish but to imprint that even though the action was minimally invasive for a simple bus ticket, it applied on larger systems, could have a significant effect. So more as a simple friendly deterrent rather than arrest and spent some nights in jail.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#96

Post by motorest » Thu, Oct 23, 2025, 10:32 AM UTC

jacquesm wrote: post #91

motorest wrote: post #88

Earlier quoted context omitted.

> A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is st…

How do you propose he would have been able to establish that this was indeed a vulnerability?

> How do you propose he would have been able to establish that this was indeed a vulnerability?

I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances.

https://news.ycombinator.com/item?id=14835515

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#97

Post by motorest » Thu, Oct 23, 2025, 10:37 AM UTC

achairapart wrote: post #92

motorest wrote: post #88

Earlier quoted context omitted.

> A kid showed up a bunch of big names. The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£). If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"? Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is st…

Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above: > Did you try adjusting price? And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

> Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above

You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research?

Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#98

Post by wqaatwt » Thu, Oct 23, 2025, 10:46 AM UTC

School-Cotton wrote: post #78

achairapart wrote: post #75

Earlier quoted context omitted.

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill.

Then you took their money and gave them the item without saying anything.

Would seem like a weird situation but I don’t see how its theft.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#99

Post by LudwigNagasena » Thu, Oct 23, 2025, 10:59 AM UTC

wqaatwt wrote: post #98

School-Cotton wrote: post #78

Earlier quoted context omitted.

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill. Then you took their money and gave them the item without saying anything. Would seem like a weird situation but I don’t see how its theft.

I bet that would be most likely classified as shoplifting and/or fraud depending on jurisdiction.

Re: Accessing Max Verstappen's passport and PII through FIA bugs

#100

Post by technothrasher » Thu, Oct 23, 2025, 10:59 AM UTC

SirHumphrey wrote: post #87

forgotaccount22 wrote: post #10

Earlier quoted context omitted.

When I was still in university I reported a vulnerability and when the company started threatening me with legal action, my professor wrote a strongly worded email and they dropped it. Haven't had it since in 8 years. Feels like many companies understand what we do now, atleast compared to 10 years ago.

This seems depressingly common in universities. I know of a case where someone discovered anyone with a university account (so students, etc.) can edit DNS, and the IT tried to file charges until the head of CS department intervened.

Many years ago when I was at school, I found a paper on a table in the computing library with a list of root passwords for some of the machines at Yale, just sitting there. I tried one and it was valid (this was the old days when remote root logins were a thing). I sent the admins a message telling them, and I was entirely ignored. A month later I tried the password again and it was still good. Luckily for me, I guess, it was before the days of suing people for trying to be helpful.