5 ms·
Yes, this crosses all the lines. You can debate the finer points of the SQL injection bit, but the moment he got into Rocket Chat admin and started gratuitously
by marcan_42 5y ago
Yes, this crosses all the lines. You can debate the finer points of the SQL injection bit, but the moment he got into Rocket Chat admin and started gratuitously stealing employee cookies, there's just no way to paint that any color other than black.
As his bio states, he's a software engineer - clearly not a security professional, because he's steamrolling right through all infosec ethics.
A quick Google search for his username yields his GitHub with his real name, and he has a LinkedIn. He graduated from the same university as me.
Blackhat is not a good hobby, especially not with no opsec.
- comprev 5y agoIf I was interviewing the author for a role their complete disregard for infosec ethics would be a hard "no" from me - no matter how good they might be at interviewing.
- sombremesa 5y agoI think this depends somewhat on how old they were - young people do stupid things.
- comprev 5y agoHis LinkedIn profile photo would indicate he's not exactly early-20s.
- anthk 5y ago>Blackhat is not a good hobby, especially not with no opsec. Putting your ident in the clear (or at least trivially bound to a real ID) is not better than having shitty security defaults.
- arpa 5y agoDude, I'm not comfortable posting source of my online radio, because it uses ytdl, and here a guy casually strolls into blackhat territory, downloads 3k tables (presumably from to his home computer, using home pc, bonus points if that happens at work), then logs in as super admin to an e-shop, effectively takes over someones company chat and steals employee cookies. And writes about it AND ADVERTISES ON TWITTER under HIS OWN NAME. Is he INSANE or taking coke by a handful? Dude, you want to be legally forbidden to use a computer? because that's how you get legally forbidden to use one.