3 ms·

I looked at your post, then at these Twitter threads recommended in the other comments https://news.ycombinator.com/item?id=30187898 https://news.ycombinator.co

• PretzelPirate 5y ago
  There is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate the signature”. The attacker was able to point that to a function they wrote instead of using the real one, so the function returned saying “yep, that’s a valid signature” when it wasn’t.
  • Ansil849 5y ago
    I understand the first part, "There is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate the signature", but I'm having trouble understanding the second part, "The attacker was able to point that to a function they wrote instead of using the real one". In other words I (relatively) understand the 'what', but I don't understand how was the attacker able to do the redirect?
    • civilized 5y ago
      Something something system addresses.