How I could hack internet bank accounts of Danish largest bank in a few minutes

Re:How I could hack internet bank accounts of Danish largest... by awalGarg on Tuesday October 06, 2015 @09:53AM (#10338850)

I wonder how the server was replying with a different dump every time. It wasn't the dump corresponding to the current request, but a random user's dump on every refresh. How would the server decide what information to dump?

Either: 1. The server was programmed to dump the most recent available session data, and presumably a lot of users were accessing the site concurrently. This would not be the case in development and thus, during dev, their devs would be seeing only the current session's information.

2. Someone intentionally planted this backdoor.

I hope it is the first case. Because if it is not the second case, it would take some really really apparent mistake or an extremely horrible debugging fashion to match the described behavior.

[ Parent | on HN ]

Re:How I could hack internet bank accounts of Danish largest... by Sijmen_Ruwhof on Tuesday October 06, 2015 @06:41PM (#10342931)

It's almost certainly not a backdoor, as it's way to noisy for that.

Why the random visitor technical details were shown is a really good question. I have spent quite some thought time on that also and couldn't come up with a solid answer.

[ Parent | on HN ]