7 ms·

Reading this made me confused. You have a 'hire me' link on a page where you talk about exploiting someone's app? If you're not writing this up like a white hat

Reading this made me confused. You have a 'hire me' link on a page where you talk about exploiting someone's app? If you're not writing this up like a white hat, isn't the article counterproductive to you? I can understand why you did all this (and hopefully, you reached out to the app provider to let them know about these holes), and it seems like you know enough about what you're doing. I'm just scratching my head at the end of all of this, and the article itself feels like it lacks structure.

deadf00d 5y ago
The idea is to show my work. I tried to add a touch of humor, I think it's funny to try to earn money like this (actually you can't because they verify all transaction). If you think I can be seen as a black hat, I might modify some of it. Also, a lot of developer (and some of my colleague too) tends to think that "hacking" doesn't exist like in movies or even doesn't exist at all (because they use ORM, don't laugh, I really got this one). By taking a real world example, I think It's a cool way to get people back in reality. Anyway, people and my customers, hire me for my skills, and for what I did. Nobody care that you hacked an office, but if this office is the CIA, then it's cool. For the lack of structure, it probably is, if you can give me example that I could fix, It would be very kind of you. Thanks for your feedback.
- mr-wendel 5y ago
  I would like to highlight the parent post's comment about attempting to contact the people whose work you are exposing vulnerabilities in. I have to say that if this is "showing your work" then the most important thing you've shown is poor judgement in publishing their secrets in a submission to a very popular website. The fact that they have followed such shockingly bad security practices themselves is absolutely no excuse. The work I wish we saw was the valiant effort you made to contact the company and help them see their mistakes. That is an area where we can all use more good examples, even if only to show how difficult it is to get something so obviously problematic taken seriously. I'm certain you mean no ill will, but the lack of consideration here is concerning. [EDIT] As per the posters comments, the keys included weren't the real ones. I still think the point stands: they are trivial to obtain when you know they are included in the package so their exclusion only means so much.
  - noasaservice 5y ago
    This is an 0day public disclosure. The company affected should THANK this person for not selling the exploit on the dark web and making bank. And this goes back to the whole "responsible vulnerability disclosure". The damned white hats want to demonize anybody not reaching out to some opaque company and being told it might be fixed in 90-360 days. 0Days are JUST AS responsible as other types of disclosure. You owe them nothing, and they owe you nothing. And you're publishing info to everyone. Information symmetry.
    - deadf00d 5y ago
      Yeah, that's what I think too.
    - deleted 5y ago
      [deleted]
    - mr-wendel 5y ago
      I can't disagree more. They should thank him if he actually reached out to help, even if only to say "look how bad this is; you're easy pwnbait, kthxbye". Based on this article we don't even know if they are opaque (or worse, belligerent). I've tried to be as careful as possible in my wording to avoid demonizing the poster. I still see absolutely nothing indicating maliciousness or ill intent and I would just as strongly disagree with anyone trying to do that. My apologies if I have come across as being hateful in any way. I prefer to champion a web that goes back to a "hacker" culture I learned from in my youth that predates Internet culture: we believe DO owe each other something, somewhere in the positive gradient: basic decency, an assumption that we're all worthy of respect (unless proven otherwise), and that you never try to "score points" at the expense of someone else. But that is just what I believe and what my preferences are. Certainly "do no harm" is the rock bottom line.
      - orf 5y ago
        You don’t owe companies that don’t invest in security anything. This whole comment smells of upmost naïvete. It’s a for-profit company without a bug bounty program, in no way whatsoever should they expect someone to work for free to fix issues they created. The keys are public, they made them public. Do you expect that there are not automated systems trawling apps from the g-play store and doing what he’s doing?
- deleted 5y ago
  [deleted]
- noasaservice 5y ago
  You're going to get a lot of hate here from the tech bros. This, however, is much more inline with Defcon, CCC, and hacking culture. And this sort of writeup about (React, API endpoint insecurity, cheating apps) would be a straight-up accepted submission to the respective cons.
  - deadf00d 5y ago
    As usual. That's cool ! Might try to do a submission.
- UncleMeat 5y ago
  > I think it's funny to try to earn money like this A lot of us think it is unethical and would take it as a huge red flag.
  - deadf00d 5y ago
    It's a concept, what I mean is the goal is cool. Feeling like in a movie.
- gigaflop 5y ago
  First off, you've done useful and valid work. Not that you should need me to say it, but I'll throw some kudos. Explaining that it's not possible to actually 'cash out' would be great, and that would probably help deter script kiddies from trying to defraud the app. There are real people on the other side! Tokens should be marked as redacted imo, and code sections could probably do to be snipped. If you wanted a tl;dr, I guess it would be that it looks like ctrl-c and ctrl-v were your primary editing tools. They're great, and I use them all the time, but that w(t) thing took me 10 seconds of scrolling to get through when skimming, which was 10 seconds with none of your own words on screen. Less can often be more! Especially if I'm looking at disassembled gibberish.
  - deadf00d 5y ago
    Thanks for your wonderful feedback. I understood my mistake. I think the article humor has not been received as intended, that's why I added a disclaimer in the top level of the article to contextualize it a little bit more. Hope I've not done any harm to their infrastructure. I'll definitely take care to this in my next articles. I also trimmed a bit the long code of the w() function, making the article easier to read.
- ska 5y ago
  For what it's worth, I think that is an idiosyncratic use of "earn".
- sockpuppet69 5y ago
  Yeahhhhhh you’re not gonna get hired by any scrupulous company.
jotm 5y ago
Well, you know how some hackers are hired by companies they hacked? That kind of idea, I'm guessing.
nsarafa 5y ago
I would hire this guy. Knows what he's doing and is clearly talented

deadf00d 5y ago

The idea is to show my work. I tried to add a touch of humor, I think it's funny to try to earn money like this (actually you can't because they verify all transaction). If you think I can be seen as a black hat, I might modify some of it. Also, a lot of developer (and some of my colleague too) tends to think that "hacking" doesn't exist like in movies or even doesn't exist at all (because they use ORM, don't laugh, I really got this one). By taking a real world example, I think It's a cool way to get people back in reality. Anyway, people and my customers, hire me for my skills, and for what I did. Nobody care that you hacked an office, but if this office is the CIA, then it's cool. For the lack of structure, it probably is, if you can give me example that I could fix, It would be very kind of you. Thanks for your feedback.

mr-wendel 5y ago
I would like to highlight the parent post's comment about attempting to contact the people whose work you are exposing vulnerabilities in. I have to say that if this is "showing your work" then the most important thing you've shown is poor judgement in publishing their secrets in a submission to a very popular website. The fact that they have followed such shockingly bad security practices themselves is absolutely no excuse. The work I wish we saw was the valiant effort you made to contact the company and help them see their mistakes. That is an area where we can all use more good examples, even if only to show how difficult it is to get something so obviously problematic taken seriously. I'm certain you mean no ill will, but the lack of consideration here is concerning. [EDIT] As per the posters comments, the keys included weren't the real ones. I still think the point stands: they are trivial to obtain when you know they are included in the package so their exclusion only means so much.
- noasaservice 5y ago
  This is an 0day public disclosure. The company affected should THANK this person for not selling the exploit on the dark web and making bank. And this goes back to the whole "responsible vulnerability disclosure". The damned white hats want to demonize anybody not reaching out to some opaque company and being told it might be fixed in 90-360 days. 0Days are JUST AS responsible as other types of disclosure. You owe them nothing, and they owe you nothing. And you're publishing info to everyone. Information symmetry.
  - deadf00d 5y ago
    Yeah, that's what I think too.
  - deleted 5y ago
    [deleted]
  - mr-wendel 5y ago
    I can't disagree more. They should thank him if he actually reached out to help, even if only to say "look how bad this is; you're easy pwnbait, kthxbye". Based on this article we don't even know if they are opaque (or worse, belligerent). I've tried to be as careful as possible in my wording to avoid demonizing the poster. I still see absolutely nothing indicating maliciousness or ill intent and I would just as strongly disagree with anyone trying to do that. My apologies if I have come across as being hateful in any way. I prefer to champion a web that goes back to a "hacker" culture I learned from in my youth that predates Internet culture: we believe DO owe each other something, somewhere in the positive gradient: basic decency, an assumption that we're all worthy of respect (unless proven otherwise), and that you never try to "score points" at the expense of someone else. But that is just what I believe and what my preferences are. Certainly "do no harm" is the rock bottom line.
    - orf 5y ago
      You don’t owe companies that don’t invest in security anything. This whole comment smells of upmost naïvete. It’s a for-profit company without a bug bounty program, in no way whatsoever should they expect someone to work for free to fix issues they created. The keys are public, they made them public. Do you expect that there are not automated systems trawling apps from the g-play store and doing what he’s doing?
deleted 5y ago
[deleted]
noasaservice 5y ago
You're going to get a lot of hate here from the tech bros. This, however, is much more inline with Defcon, CCC, and hacking culture. And this sort of writeup about (React, API endpoint insecurity, cheating apps) would be a straight-up accepted submission to the respective cons.
- deadf00d 5y ago
  As usual. That's cool ! Might try to do a submission.
UncleMeat 5y ago
> I think it's funny to try to earn money like this A lot of us think it is unethical and would take it as a huge red flag.
- deadf00d 5y ago
  It's a concept, what I mean is the goal is cool. Feeling like in a movie.
gigaflop 5y ago
First off, you've done useful and valid work. Not that you should need me to say it, but I'll throw some kudos. Explaining that it's not possible to actually 'cash out' would be great, and that would probably help deter script kiddies from trying to defraud the app. There are real people on the other side! Tokens should be marked as redacted imo, and code sections could probably do to be snipped. If you wanted a tl;dr, I guess it would be that it looks like ctrl-c and ctrl-v were your primary editing tools. They're great, and I use them all the time, but that w(t) thing took me 10 seconds of scrolling to get through when skimming, which was 10 seconds with none of your own words on screen. Less can often be more! Especially if I'm looking at disassembled gibberish.
- deadf00d 5y ago
  Thanks for your wonderful feedback. I understood my mistake. I think the article humor has not been received as intended, that's why I added a disclaimer in the top level of the article to contextualize it a little bit more. Hope I've not done any harm to their infrastructure. I'll definitely take care to this in my next articles. I also trimmed a bit the long code of the w() function, making the article easier to read.
ska 5y ago
For what it's worth, I think that is an idiosyncratic use of "earn".
sockpuppet69 5y ago
Yeahhhhhh you’re not gonna get hired by any scrupulous company.

jotm 5y ago

Well, you know how some hackers are hired by companies they hacked? That kind of idea, I'm guessing.

nsarafa 5y ago

I would hire this guy. Knows what he's doing and is clearly talented