News for hackers. Stuff that matters.
Re:When security goes right by jacques_chester on Thursday December 25, 2014 @11:19PM (#8798024)
A few months ago, working on a system, I noticed that the URLs seemed to be based directly on a fixed, sequential user ID. It was a system that, in this case, was being used by An Important Company You Have Probably Heard Of.

I was about to see what happened if I changed the number, when I realised that I am a foreign citizen in a country with notoriously unpleasantly drafted laws about computer security.

And then I stopped. It's almost certain that nothing would go awry, but the mere act of gently poking might be interpreted in an unfavourable light. Losing a work visa is very easy and I very much don't want to.

Re:When security goes right by ikeboy on Thursday December 25, 2014 @11:44PM (#8798079)
Ever heard of tor?
Re:When security goes right by resonantcore on Thursday December 25, 2014 @11:48PM (#8798084)
Tor doesn't necessarily help you.

If you're accessing a system a certain way (i.e. accessing certain parts of an application), then your traffic abruptly stops and a Tor exit node IP picks back up, you're hosed.

Re:When security goes right by ikeboy on Friday December 26, 2014 @12:23AM (#8798145)
So you wait an hour. This is a huge company, apparently, so there's got to be other people using the same part of it.
Re:When security goes right by resonantcore on Friday December 26, 2014 @12:27AM (#8798149)
Sure, that works. The point we were trying to make was merely, "Tor is not a magic bullet. It must be used wisely."
Re:When security goes right by ikeboy on Friday December 26, 2014 @12:32AM (#8798162)
Fair point. But the post I responded to was saying to just give up.

Tor may not be enough. To really be safe, use the precautions in http://pastebin.com/cRYvK4jb (this guy hacked finfisher and got away with it, so they know what they're doing.) Mostly whonix, truecrypt, and tor.

(Come to think of it, why hasn't that post been taken down? Is there nothing against pastebin's tos in there? They took down all the sony leaks.)

I would never go back and forth on the same page between tor and clearnet. I assumed that level of caution was obvious, especially to a fellow hacker (we're talking about vulnerability-noticers here, after all.)

Re:When security goes right by jacques_chester on Friday December 26, 2014 @07:47AM (#8798738)
It's just easier not to do something that might, vaguely, break a broadly-drafted law.