News for hackers. Stuff that matters.

A comment on I got access to all of BitTorrent Inc's source code and sensitive documents.

Re:I got access to all of BitTorrent Inc's source code and s... by citricsquid on Wednesday July 31, 2013 @06:48PM (#6137330)
Looks like he acquired login information, he didn't exploit some sort of major vulnerability that needed to be fixed which is generally what bug bounties seem to be for. He's insulted he didn't get paid for not being an asshole, what a strange world we live in. Facebook (or any other company) wouldn't pay out if one of their support staff accidentally made a random user an admin, why should this be any different.
[ Parent | on HN ]
Re:I got access to all of BitTorrent Inc's source code and s... by Andrenid on Wednesday July 31, 2013 @07:12PM (#6137452)
He didn't get credentials, they never secured their admin panels:

> A friend was looking for a hosting provider and wanted it all secure, I checked a network range and found the Jenkins panel of BitTorrent. This was all 100% accidental, truth! At the end of the day If I wanted to 'hack' BitTorrent I wouldn't even know where to begin. I mean, there is no real skill or talent involved in what I did to find the information on BitTorrent. They forgot to set a user/pass to the admin panel, that had access to github from a master account. Github accounts had user/passes that was linked to everything.

> No hacking, just random find. Mad huh?

[ Parent | on HN ]
Re:I got access to all of BitTorrent Inc's source code and s... by patrickgokey on Wednesday July 31, 2013 @06:53PM (#6137354)
Like he says on the forum thread, he did not acquire any login information. Just the opposite, in fact. They neglected to set a username/password to their admin panel. That's a gaping security hole if I've ever seen one.
[ Parent | on HN ]
Re:I got access to all of BitTorrent Inc's source code and s... by Dylan16807 on Wednesday July 31, 2013 @09:23PM (#6138028)
He stumbled across a major vulnerability that needed to be fixed, not login credentials.

>He's insulted he didn't get paid for not being an asshole, what a strange world we live in.

That's how bug bounties work, yet people don't complain there.

[ Parent | on HN ]