5 ms·
How the Pwnedlist Got Pwned
- pfg 10y agotl;dr: site used to track public password breaches allowed users to get a list of 866M credentials because of a simple parameter tampering vulnerability.
- curiousgal 10y agoHow does Pwnedlist get those dumps anyway? Pastebin bots would cover Pastebin but what about chat rooms and the rest?
- deleted 10y ago[deleted]
- SlashmanX 10y agoIs it really necessary to run Kali to just change a parameter in a POST request? Also the response from InfoArmor is disconcerting: "Clearly you have a special account... Oh wait s\\t no". The default position shouldn't be to fob it off as not an issue it should be "Ok, we'll look into it and try reproduce"
- jlgaddis 10y agoIt's easy to think that and initially downplay this kind of thing but, in my 20+ years in this field, I've had more than one instance where I've said to someone "no, that can't happen" only to discover that it can and did happen.
- CM30 10y agoIs it me or are there quite a few security related services and companies making these sorts of minor (but easily addressable) mistakes that cost them a ton? I swear I remember quite a few sites like this getting compromised or exploited recently.