3 ms·

I don't think you really mean that. If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfe

I don't think you really mean that. If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfer funds, I don't think you'd be consoled that the "hack" that drained your account was, at heart, only a matter of visiting some URLs. Obviously this "hack" was simpler, and AT&T's security was lousy. But the simplicity of an attack is not an excuse for mounting it.

wnight 14y ago
In this "attack" the URL was incremented by one. I've written a lot of loops, and incremented a lot of numbers, and none of them have ever become properly escaped XSS exploits, or malformed YAML, etc. If your bar for "hack" is so low that we're training pre-schoolers to accomplish it, it may lack all descriptive power. URLs are by design human readable and human editable. Simple discovered usage of these resources is not hacking, it is intended. Imagine you're reading a story at example.com/stories/bears-part_1_of_3.html and just as it gets good, it's done. Without so much as a "The End". Do you sit dumbfounded, or do you hack the bejeezus out of the website? See how silly that sounds. So lets just say you "went to the next page".
- frou_dh 14y ago
  Call it "Crafting a URL for $INTENT" and save all this talking past each other.
  - wnight 14y ago
    Gotta make it seem scary somehow.
AnthonyMouse 14y ago
>If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfer funds, I don't think you'd be consoled that the "hack" that drained your account was, at heart, only a matter of visiting some URLs. But it's not the "hack" that you're worried about, it's the stealing. And stealing is separately illegal. Not all stealing is hacking just because a computer is involved, and something that isn't otherwise hacking shouldn't become hacking just because it involves theft or some other malicious activity that would itself be against the law.

wnight 14y ago

In this "attack" the URL was incremented by one. I've written a lot of loops, and incremented a lot of numbers, and none of them have ever become properly escaped XSS exploits, or malformed YAML, etc. If your bar for "hack" is so low that we're training pre-schoolers to accomplish it, it may lack all descriptive power. URLs are by design human readable and human editable. Simple discovered usage of these resources is not hacking, it is intended. Imagine you're reading a story at example.com/stories/bears-part_1_of_3.html and just as it gets good, it's done. Without so much as a "The End". Do you sit dumbfounded, or do you hack the bejeezus out of the website? See how silly that sounds. So lets just say you "went to the next page".

frou_dh 14y ago
Call it "Crafting a URL for $INTENT" and save all this talking past each other.
- wnight 14y ago
  Gotta make it seem scary somehow.

AnthonyMouse 14y ago

>If your bank were open to an XSS attack that "only" required crafting a particular URL to allow access sufficient to transfer funds, I don't think you'd be consoled that the "hack" that drained your account was, at heart, only a matter of visiting some URLs. But it's not the "hack" that you're worried about, it's the stealing. And stealing is separately illegal. Not all stealing is hacking just because a computer is involved, and something that isn't otherwise hacking shouldn't become hacking just because it involves theft or some other malicious activity that would itself be against the law.