Hacking into an insurance company by exploiting their premium calculator
1–10 of 113 posts
Re: Hacking into an insurance company by exploiting their premium calculator
#2Part of the problem is effectively using this inbox as a "free" SMTP account so they don't have to pay for outbound emails. There would not be as much sensitive information in this account's sent/inbox if they using something like SES, which is incredibly cheap ($0.10/1000 emails).
Re: Hacking into an insurance company by exploiting their premium calculator
#3> More than 5 months later, TTIBI still have not changed the password of the email account despite being aware of the vulnerability
Hopefully they at least took the Base64 password out of the error log. I'm sure they did. Right? !?
Re: Hacking into an insurance company by exploiting their premium calculator
#4Part of the problem is effectively using this inbox as a "free" SMTP account so they don't have to pay for outbound emails. There would not be as much sensitive information in this account's sent/inbox if they using something like SES, which is incredibly cheap ($0.10/1000 emails).
That's technically correct, but the real cost in using SES here is probably the development time:
- store all sent emails
- create an interface for business/non-devs to view and search past messages
If they were using all the functionality of this "free" SMTP approach, that's quite a bit of development + maintenance cost.
Re: Hacking into an insurance company by exploiting their premium calculator
#5> More than 5 months later, TTIBI still have not changed the password of the email account despite being aware of the vulnerability Hopefully they at least took the Base64 password out of the error log. I'm sure they did. Right? !?
Ticket is probably still in the backlog
Re: Hacking into an insurance company by exploiting their premium calculator
#6It's always fascinating that, seemingly, the smarter you are in general the stupider you are with computers.
Re: Hacking into an insurance company by exploiting their premium calculator
#7This is a boggling level of disdain for customer security - even putting aside the insanely low levels of data security, it's mind boggling that the website remained up for months after the disclosure, and that even after being taken down the vulnerability remained open.
Great post!
Re: Hacking into an insurance company by exploiting their premium calculator
#8This is a boggling level of disdain for customer security - even putting aside the insanely low levels of data security, it's mind boggling that the website remained up for months after the disclosure, and that even after being taken down the vulnerability remained open. Great post!
Sometimes it feels like the only way to fix these problems is for the(ir) world to burn once.
Re: Hacking into an insurance company by exploiting their premium calculator
#9When security through obscurity isn't.
Re: Hacking into an insurance company by exploiting their premium calculator
#10This is a boggling level of disdain for customer security - even putting aside the insanely low levels of data security, it's mind boggling that the website remained up for months after the disclosure, and that even after being taken down the vulnerability remained open. Great post!
Sometimes it feels like the only way to fix these problems is for the(ir) world to burn once.
“We’re reaching out to negotiate for the decryption key.”
“There is no key.”