Hacker News Reader

> After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously.

How did they verify the never exploited maliciously part?

Did the person who's password they changed ever notice that their password didn't work any more and report the problem?

Right, especially considering the Subaru Starlink service has apparently existed since 2014 or so[0], I have to wonder how long these vulnerabilities have been present.

[0] https://web.archive.org/web/20140719230852/https://www.subar...

Assuming `samwcurry@gmail.com` belongs to the same person who owns samcurry.net, they changed their own password.

I don't think that's correct. See the section in the article "Enumerating Employee Emails" which finishes "The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send."

Reply on news.ycombinator.com