5 ms·
Thanks! I just finished the writeup, posted here: https://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/ In short: i
by nneonneo 8y ago
Thanks! I just finished the writeup, posted here: https://www.robertxiao.ca/hacking/locationsmart/ https://www.robertxiao.ca/hacking/locationsmart/
In short: it was a fairly straightforward modification of the usual API flow, to omit the secondary API call that requests consent, then request a JSON location payload instead of an XML payload. For whatever reason, that bypassed the usual consent check and just dumped the phone's location.
- Sephr 8y agoThanks, your write-up is very informative! I think the HN staff should change the URL to your post.
- deleted 8y ago[deleted]
- dang 8y agoChanged. Thanks for emailing us! We wouldn't have seen this otherwise. (Submitted url was https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/. https://krebsonsecurity.com/2018/05/tracking-firm-locationsm...)
- deleted 8y ago[deleted]
- zodPod 8y agoMan I got here once the link had already changed and your write up is concise and tells all of the necessary information versus the Krebs article which is way too long and really doesn't say much useful. Thanks!
- fein 8y agoWhen I read this I just started cackling like a mental patient. The first thing that comes to mind is if this is on a well known framework, I want to know because those security defaults are awful. However if these guys rolled their own API auth system and messed up something this simple, or deliberately modified framework defaults... I can't even imagine what conversations happened at their offices this morning.
- bostik 8y ago> JSON location payload instead of an XML payload. For whatever reason, that bypassed the usual consent check To me that sounds like you stumbled upon an unauthenticated development/debug mode.