←back to thread

Accessing Max Verstappen's passport and PII through FIA bugs

(ian.sh)
605 points galnagli | 1 comments | 22 Oct 25 18:21 UTC | HN request time: 0.208s | source
Show context
awesome_dude ◴[22 Oct 25 21:25 UTC] No.45675356[source]▶
Rule 1.

NEVER trust user supplied data.

Once that rule was broken, any other rules broken became clear to everyone

replies(3): >>45676139 #>>45676989 #>>45681943 #
jacquesm ◴[22 Oct 25 22:49 UTC] No.45676139[source]▶
You'd think that client side security would be something that we'd gotten over by now.
replies(2): >>45677562 #>>45683834 #
rpcope1 ◴[23 Oct 25 02:34 UTC] No.45677562[source]▶
You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.
replies(1): >>45677748 #
cheschire ◴[23 Oct 25 03:02 UTC] No.45677748[source]▶
I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.
replies(7): >>45677777 #>>45677902 #>>45678651 #>>45678780 #>>45679165 #>>45680139 #>>45681137 #
mulmen ◴[23 Oct 25 03:34 UTC] No.45677902[source]▶
Did you try adjusting price?
replies(3): >>45679214 #>>45680517 #>>45681477 #
achairapart ◴[23 Oct 25 07:33 UTC] No.45679214[source]▶
A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...
replies(1): >>45679458 #
umanwizard ◴[23 Oct 25 08:16 UTC] No.45679458[source]▶
It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.
replies(4): >>45679731 #>>45679762 #>>45680020 #>>45680373 #
jacquesm ◴[23 Oct 25 09:00 UTC] No.45679762[source]▶
Why are you on HN?

A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest.

The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.

replies(3): >>45679984 #>>45680235 #>>45684990 #
spockz ◴[23 Oct 25 10:14 UTC] No.45680235[source]▶
How did the arrest go? For all you know it was the local cop that took him to the station and put him under arrest. Not to necessarily punish but to imprint that even though the action was minimally invasive for a simple bus ticket, it applied on larger systems, could have a significant effect. So more as a simple friendly deterrent rather than arrest and spent some nights in jail.
replies(1): >>45681578 #
1. abustamam ◴[23 Oct 25 13:28 UTC] No.45681578[source]▶
I don't think you can call any sort of arrest a simple friendly deterrent, or intended not to punish. That shit's traumatizing. Should he have done that? Probably not. But did he deserve arrest for finding a vulnerability? This could have been a conversation that didn't involve police. The kid could have helped them improve their systems instead of spending taxpayer dollars to send cops to the kid to arrest him.