4 ms·
> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. How did they verify the never exploited m
by rjmunro 2y ago
> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously.
How did they verify the never exploited maliciously part?
Did the person who's password they changed ever notice that their password didn't work any more and report the problem?
- arrowleaf 2y agoAssuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.
- nkurz 2y agoI don't think that's correct. See the section in the article "Enumerating Employee Emails" which finishes "The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send."
- amatecha 2y agoRight, especially considering the Subaru Starlink service has apparently existed since 2014 or so[0], I have to wonder how long these vulnerabilities have been present. [0] https://web.archive.org/web/20140719230852/https://www.subaru.com/engineering/starlink.html https://web.archive.org/web/20140719230852/https://www.subar...