News for hackers. Stuff that matters.

A comment on Governor vows criminal prosecution of reporter who found flaw in state website. Parent comment

Re:Governor vows criminal prosecution of reporter who found ... by strofcon on Thursday October 14, 2021 @03:34PM (#28868911)
But... they didn't change their name on the form. They literally just said "I'm still me, but I want this other file now, please."

All company data was, in OPs scenario, made public to any and all authenticated users.

There is no way to rationally spin this as a malicious act, in my view.

[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by kelnos on Thursday October 14, 2021 @04:27PM (#28869580)
I don't think simply changing the ID in the URL to see what would happen is itself a malicious act. But, after discovering the vulnerability, OP admitted to continuing to exploit the vulnerability so they could make use of the information they'd gotten, information that they should not have access to. That part of it is actively malicious.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by mcguire on Thursday October 14, 2021 @05:41PM (#28870543)
No one is claiming "I'm still me, but I want this other file now, please." is a malicious act.

Downloading a number of them and comparing information, however, is not necessarily malicious but rather sketchy.

[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by bawolff on Thursday October 14, 2021 @03:40PM (#28868977)
Well they changed an id number. I guess the real life version would be changing the SSN number on the form.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by MangezBien on Thursday October 14, 2021 @04:07PM (#28869310)
An ssn is considered private info, the plan number wouldn't be.
[ Parent | on HN ]