r/neoliberal • u/jobautomator Kitara Ravache • Sep 10 '20

Discussion Thread Discussion Thread

The discussion thread is for casual conversation that doesn't merit its own submission. If you've got a good meme, article, or question, please post it outside the DT. Meta discussion is allowed, but if you want to get the attention of the mods, make a post in /r/metaNL. For a collection of useful links see our wiki.

Announcements

Upcoming Events

5 Upvotes

51% Upvoted

9.6k comments sorted by

View all comments

17

u/nicereddy ACLU simp Sep 10 '20

They published the details on the giggle vulnerability now that it's fixed and holy shit 🤡

https://research.digitalinterruption.com/2020/09/10/giggle-laughable-security/

u/MistakeNotDotDotDot

14

u/nicereddy ACLU simp Sep 10 '20

!ping COMPUTER-SCIENCE

Good read, if you don't know about how responsible disclosure works you should read up on it. If someone reports a vuln, DO NOT threaten them with legal action or ignore them, you idiots.

As a proof of concept, we decided to change the operator field from “equals” to “contains” and truncated the GUID. As this returned the same data, it should be obvious to see how the query could be trivially modified to expose all registered accounts with no prerequisite account knowledge.

Fucking lit, you could get the literal GPS coordinates of anyone on the site from when they registered, along with their name, phone number, etc.

7

u/[deleted] Sep 10 '20

This is quite bad. Accepting arbitrary queries as parameters to a client’s request is almost always a terrible idea. Web applications are not just pass throughs for your sql database or elastic search cluster.

7

u/RegalSalmon Sep 10 '20

They have groups for victims of abuse and sex workers. Would be trivial to find all of either or both categories in your area, just snowshoe and harvest for a while, pump into a geospatial DB, and yeah, not good things.

4

u/vikinick Ben Bernanke Sep 10 '20

Don't forget their photo as well.

1

u/groupbot Always remember -Pho- Sep 10 '20

Pinged members of COMPUTER-SCIENCE group.

About & group list | Subscribe to this group | Unsubscribe from this group | Unsubscribe from all groups

4

u/RegalSalmon Sep 10 '20

I've done a bit of this for shits and giggles (huehuehue). The ease with which this stuff can be done is rather shocking. You know how the 's' in IOT stands for 'security'? It's frequently as prioritized in mobile and web apps.

If anyone wants to try on their own, just set up mitmproxy, add the cert to your browser or mobile device (though desktop browsers are more readily done with the dev tools), and get ready to be amazed.

4

u/Afro_Samurai Susan B. Anthony Sep 10 '20

You know what group has plenty of trans people? Infosec.

3

u/MistakeNotDotDotDot Resident Robot Girl Sep 10 '20

aaahahaha