Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact...
by walrus01 on Wednesday August 22, 2018 @12:28PM
(#17819880)
It's amazing the number of things you can find by simply enumerating through a sequential series of integers, in what is basically a "gimme data" request to some public facing data endpoint.
[ Parent
| on HN ]
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact...
by gwbas1c on Wednesday August 22, 2018 @02:18PM
(#17820680)
I once heard of a very major website essentially being DOS-ed because a scrapper was enumerating IDs in the URL. (Can't say the name because I signed an NDA.) The engineers involved all assumed the scraping was legitimate indexing by a 3rd party or researcher.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact...
by compostable on Wednesday August 22, 2018 @01:01PM
(#17820124)
Some guy went to jail for doing this.
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact...
by jessaustin on Wednesday August 22, 2018 @02:33PM
(#17820825)
It's OK that was only 13 months because it turns out that the least ethical federal prosecutors are also the dumbest.
/s
Re:‘Legacy system’ exposed Black Hat 2018 attendees’ contact...
by krylon on Wednesday August 22, 2018 @03:20PM
(#17821212)
I assume you did not mean it like that, but 13 months in prison is nothing to get snarky about.
If I had to go to prison for 13 months - even if it was for something as silly as this example -, I'd most likely be out of a job and have a prior on my record, which would probably make it very hard to find a new job equivalent to the one I hold now.
13 months in prison can easily destroy somebody's professional existence, not to mention, if applicable, marriage/relationship and family.