News for hackers. Stuff that matters.

A comment on LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time. Parent comment

Re:LocationSmart Leaked Location Data for All Major U.S. Car... by chatmasta on Thursday May 17, 2018 @04:36PM (#17095420)
Do you think your graduate degree was necessary to find this bug, or could any idiot with devtools open find it just by trying to automate the site?

Your descriptions thus far are pretty vague but man... it sounds like there is a VERY high likelihood that this was being exploited by malicious actors on an ongoing basis.

[ Parent | on HN ]
Re:LocationSmart Leaked Location Data for All Major U.S. Car... by nneonneo on Thursday May 17, 2018 @05:04PM (#17095796)
https://www.robertxiao.ca/hacking/locationsmart/ provides the technical details. In short: much more likely the latter than the former. And this /try/ page has been up at least since Jan 2017 (~18 months).
[ Parent | on HN ]
Re:LocationSmart Leaked Location Data for All Major U.S. Car... by chatmasta on Friday May 18, 2018 @06:58AM (#17100410)
FYI to anyone downvoting this / the OP:

I didn’t mean this to be offensive or crass. I was asking because generally security exploits are ranked by (a) severity and (b) triviality. That is, a severe bug that is extremely difficult to exploit is not as alarming as a severe bug that is trivial to exploit.

When laypeople read that a CMU researcher discovered a bug, they might assume it is not trivial. So in that sense mentioning the PhD almost does a disservice to expressing the triviality of the bug.

When a high school kid in Hungary discovered he could purchase train tickets for any price by changing it client side, non-technical people could understand it was a trivial bug. When a CMU researcher discovers a bug, they likely assume the opposite.

[ Parent | on HN ]