_vghb

6 ms·

1. 1.▲
   by _vghb 6y ago

   Yes, It's not 100% hacking, but I guess I exploited a vulnerability in their API by creating an administrator account to gain access to their dashboard. Thanks for the comment, I will change the dashboard picture
2. 2.▲
   by _vghb 6y ago

   There is a big dilemma about privacy in such contact tracing apps, solutions, that require a post of its own. I mean, if you have no idea who access the data, who can use the data. Yes anyone can put a TOS or privacy policy that no one can
3. 3.▲
   by _vghb 6y ago

   A simple cookie token or session token is all what it needed for a quick fix
4. 4.▲
   by _vghb 6y ago

   Sorry about that, and thanks for the update :)
5. 5.▲
   by _vghb 6y ago

   Yes, there should have been more pen testing and reviews before such an important service was released storing lot of personal information. I'm happy I was able to find the vulnerability within 4 days of it's public release
6. 6.▲
   by _vghb 6y ago

   OP here - Thank you very much. Yes it was a simple debugging everything done with the browser and with some code review :)
7. 7.▲
   How I hacked the StaySafe program, the government Covid-19 tracker of Sri Lanka

   50 points by _vghb 6y ago|15 comments