4 ms·

Taking over Heroku accounts

105 points by aburan28 10y ago

CameronBanga 10y ago
Nice, simple explanation of an attack. Walks you through every step along the way. A+.
- esevece 10y ago
  I'm glad you liked it! I wasn't sure that it was well explained.
whamlastxmas 10y ago
What is someone's motivation for finding stuff like this? I assume they just have some sort of innate satisfaction from finding vulnerabilities, sort of like solving a puzzle? It seems hard to believe money is the motivating force, since the bug bounties are pretty low and I'm sure the $/hour is super low unless you're some sort of penetration tester wizard.
- cloudjacker 10y ago
  There are actually only a couple things to check out If you happen to be familiar with a certain protocol or technology, it is easy to check other people's implementation of it It isn't the same people synthesizing attacks and raking up bug bounties. If you happen to know how one thing works, then there are 3-5 things to try pretty quickly and sometimes one door leads to another
- deleted 10y ago
  [deleted]
- mattbeckman 10y ago
  I have a personal, but less extreme, example of why it can be beneficial to keep an eye open. A service my company started using had an easy-to-find gap in authentication, where they were only checking to see if you were logged in, but they were not preventing accounts from accessing data in other accounts. I pulled some data, made a screenshot, and told my CEO. He then started a call with the CEO of the new service, and I provided the screenshots, and the details of the vulnerability. We ended up getting 90% off service fees for 6 months, which saved us a ton of money. In cases like these, everybody wins.
- joshmn 10y ago
  Curiosity is one hell of a disease. Source: As a child, I wondered a lot about electricity. Growing up in Minnesota, during winter I would drag my feet on the carpet to build up a static charge so I could zap my mom. This wasn't enough, so I decided to stick a paperclip in an outlet. Twice, because once wasn't enough. I was 6.
- RIMR 10y ago
  >I assume they just have some sort of innate satisfaction from finding vulnerabilities, sort of like solving a puzzle? Oh yeah, that's exactly why I do what I do. I also keep a portfolio of all the freelance, zero-profit whitehat hacking that I do to show to employers, it's not as if it were without benefit. The first time I saw Shodan.io, I thought to myself "I could do that", so I spent $500 over 6 months and started scanning the entire Internet for vulnerabilities. It was a lot of fun, and I never earned a penny, but employers love when I bring out all my data, like my 100k row spreadsheet of every single HP printer connected to the internet with a WAN IP address. It was also fun to localize my scans to my current city, because I could walk around downtown and know that MY packets were trickling through all the buildings around me. Tl;Dr: People are intrinsically motivated to do what they love, whatever it may be.
- esevece 10y ago
  In my case, the motivations are money and freedom. I enjoy doing it, but if I didn't make money I won't do it. My only income is what I make participating in bug bounty programs. Context: I live with my parents, I'm not married, I don't have kids, I didn't go to university, I don't have a CV worth enough to get a job where I would earn as much money as from bounties (unless in my country), and I work in personal projects which wouldn't allow me to commit 8 hours a day working for a single company.
  - whamlastxmas 10y ago
    If it's not too personal, how much do you make in a month and year? How much does that vary? How good would you rate yourself at doing this? Do you work a lot with a small group of companies or do you do it for tons? How long does it take on average per bug?
    - esevece 10y ago
      Not fixed income and in this year I haven't even got close to 10,000. How much it vary depends on how much time I spend and how much the companies consider to pay me at the time of giving the reward for a bug (if I find one, of course). I'm not good at rating, but I'm sure I'm not good at doing this. Usually I look for bugs in companies that I like their products/services and/or their security team, and usually I choose the ones I think it would be fun to find bugs. I'm not able to answer the last one because I don't time how long does it take to find a bug, but I can say that it takes time (it takes more time when you are tired :D).
      - whamlastxmas 10y ago
        Ah okay, I got the impression you were getting a full-time livable income from doing this, which seemed like it would be really hard to do even for someone who was really good at it.
    - esevece 10y ago
      Some people make a ±100k per year, if that's what's you want to know.

105 points by aburan28 10y ago

CameronBanga 10y ago

Nice, simple explanation of an attack. Walks you through every step along the way. A+.

esevece 10y ago
I'm glad you liked it! I wasn't sure that it was well explained.

whamlastxmas 10y ago

What is someone's motivation for finding stuff like this? I assume they just have some sort of innate satisfaction from finding vulnerabilities, sort of like solving a puzzle? It seems hard to believe money is the motivating force, since the bug bounties are pretty low and I'm sure the $/hour is super low unless you're some sort of penetration tester wizard.

cloudjacker 10y ago
There are actually only a couple things to check out If you happen to be familiar with a certain protocol or technology, it is easy to check other people's implementation of it It isn't the same people synthesizing attacks and raking up bug bounties. If you happen to know how one thing works, then there are 3-5 things to try pretty quickly and sometimes one door leads to another
deleted 10y ago
[deleted]
mattbeckman 10y ago
I have a personal, but less extreme, example of why it can be beneficial to keep an eye open. A service my company started using had an easy-to-find gap in authentication, where they were only checking to see if you were logged in, but they were not preventing accounts from accessing data in other accounts. I pulled some data, made a screenshot, and told my CEO. He then started a call with the CEO of the new service, and I provided the screenshots, and the details of the vulnerability. We ended up getting 90% off service fees for 6 months, which saved us a ton of money. In cases like these, everybody wins.
joshmn 10y ago
Curiosity is one hell of a disease. Source: As a child, I wondered a lot about electricity. Growing up in Minnesota, during winter I would drag my feet on the carpet to build up a static charge so I could zap my mom. This wasn't enough, so I decided to stick a paperclip in an outlet. Twice, because once wasn't enough. I was 6.
RIMR 10y ago
>I assume they just have some sort of innate satisfaction from finding vulnerabilities, sort of like solving a puzzle? Oh yeah, that's exactly why I do what I do. I also keep a portfolio of all the freelance, zero-profit whitehat hacking that I do to show to employers, it's not as if it were without benefit. The first time I saw Shodan.io, I thought to myself "I could do that", so I spent $500 over 6 months and started scanning the entire Internet for vulnerabilities. It was a lot of fun, and I never earned a penny, but employers love when I bring out all my data, like my 100k row spreadsheet of every single HP printer connected to the internet with a WAN IP address. It was also fun to localize my scans to my current city, because I could walk around downtown and know that MY packets were trickling through all the buildings around me. Tl;Dr: People are intrinsically motivated to do what they love, whatever it may be.
esevece 10y ago
In my case, the motivations are money and freedom. I enjoy doing it, but if I didn't make money I won't do it. My only income is what I make participating in bug bounty programs. Context: I live with my parents, I'm not married, I don't have kids, I didn't go to university, I don't have a CV worth enough to get a job where I would earn as much money as from bounties (unless in my country), and I work in personal projects which wouldn't allow me to commit 8 hours a day working for a single company.
- whamlastxmas 10y ago
  If it's not too personal, how much do you make in a month and year? How much does that vary? How good would you rate yourself at doing this? Do you work a lot with a small group of companies or do you do it for tons? How long does it take on average per bug?
  - esevece 10y ago
    Not fixed income and in this year I haven't even got close to 10,000. How much it vary depends on how much time I spend and how much the companies consider to pay me at the time of giving the reward for a bug (if I find one, of course). I'm not good at rating, but I'm sure I'm not good at doing this. Usually I look for bugs in companies that I like their products/services and/or their security team, and usually I choose the ones I think it would be fun to find bugs. I'm not able to answer the last one because I don't time how long does it take to find a bug, but I can say that it takes time (it takes more time when you are tired :D).
    - whamlastxmas 10y ago
      Ah okay, I got the impression you were getting a full-time livable income from doing this, which seemed like it would be really hard to do even for someone who was really good at it.
  - esevece 10y ago
    Some people make a ±100k per year, if that's what's you want to know.