4 ms·
It's amazing that such a huge oversight can be made. I hope American Express doesn't try to sue this guy.
by avree 15y ago
It's amazing that such a huge oversight can be made. I hope American Express doesn't try to sue this guy.
- wgx 15y agoFinancial services are, of course, among the most cautious of organisations - which makes this kind of glaring mistake all the more worrying. Astonishing.
- alfiejohn_ 15y agoSurely this is just a honeypot?
- asto 15y agoIt could have been. Except, you can't leave your valuables on the street and then arrest someone for breaking and entering when they're stolen!
- mootothemax 15y agoExcept, you can't leave your valuables on the street and then arrest someone for breaking and entering when they're stolen! Agreed, that would be theft: Theft by finding occurs when someone who chances upon an object which seems abandoned takes possession of the object but fails to take steps to establish whether the object is abandoned and not merely lost or unattended http://en.wikipedia.org/wiki/Theft_by_finding http://en.wikipedia.org/wiki/Theft_by_finding
- toyg 15y agoThe admin page is completely unprotected, you don't even get a notice about the system being private. They can't sue him, they wouldn't have a leg to stand on. To me it looks like somebody left a "DEBUG = True" somewhere on the site and went to the beach :)
- mootothemax 15y agoThey can't sue him, they wouldn't have a leg to stand on. Why not? I've been clicking around various US laws and have yet to see any mention about a login screen or "Go away, private!" messages being required before it counts as unauthorized access: http://www.irongeek.com/i.php?page=computerlaws/state-hacking-laws http://www.irongeek.com/i.php?page=computerlaws/state-hackin...
- rufibarbatus 15y agoThe question is, is the disclosure of this (technically public) resource location litigation material? IANAL, but I can definitely see both sides of this debate being highly defensible.
- onemoreact 15y agoIn the US the first time you sue someone can be for any reason. It's only considered abusive if you do it several times without reason.
- cookiecaper 15y agoIndeed. Perhaps it would have been better to publish the exploit anonymously. It's definitely not too useful in terms of street cred -- while we all appreciate discovery of security bugs, it takes no skill and is a common script-kiddie method to just try /admin, etc., after URLs, so there is not much value professionally in having your real name tied to it, but significant risk and harassment issues come into play, especially in a big thing like this where the ire of angry and/or fleeced customers can easily be manipulated and misdirected.