News for hackers. Stuff that matters.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by walrus01 on Wednesday August 22, 2018 @12:28PM (#17819880)
It's amazing the number of things you can find by simply enumerating through a sequential series of integers, in what is basically a "gimme data" request to some public facing data endpoint.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by gwbas1c on Wednesday August 22, 2018 @02:18PM (#17820680)
I once heard of a very major website essentially being DOS-ed because a scrapper was enumerating IDs in the URL. (Can't say the name because I signed an NDA.) The engineers involved all assumed the scraping was legitimate indexing by a 3rd party or researcher.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by compostable on Wednesday August 22, 2018 @01:01PM (#17820124)
Some guy went to jail for doing this.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by jessaustin on Wednesday August 22, 2018 @02:33PM (#17820825)
It's OK that was only 13 months because it turns out that the least ethical federal prosecutors are also the dumbest.

/s

Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by krylon on Wednesday August 22, 2018 @03:20PM (#17821212)
I assume you did not mean it like that, but 13 months in prison is nothing to get snarky about.

If I had to go to prison for 13 months - even if it was for something as silly as this example -, I'd most likely be out of a job and have a prior on my record, which would probably make it very hard to find a new job equivalent to the one I hold now.

13 months in prison can easily destroy somebody's professional existence, not to mention, if applicable, marriage/relationship and family.

Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact... by wolco on Wednesday August 22, 2018 @01:02PM (#17820133)
If it is public I don't see a problem. Reminds me of wardialing in the 80s.