Hacker News Reader

Comment by jacquesm | Hacker News Reader

You'd think that client side security would be something that we'd gotten over by now.

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.

That’s incredible

Did you try adjusting price?

A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...

It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.

According to the article the system was developed by a regional subsidiary of a German mobile telco, which already tells you everything you need to know about its quality, but on top of that it was rushed to launch in time for some sporting event and thus even less testing was done that would normally happen.

Here's a better article: https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-... - it seems like this was good faith security research (he disclosed the issue after testing it) and he couldn't use the transport pass he "stole" because he didn't even live in their service area anyway.

This arrest had nothing to do with stealing and all to do with putting well-connected, incompetent people in a very uncomfortable position.

Why are you on HN?

A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest.

The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.

> A kid showed up a bunch of big names.

The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£).

If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"?

Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is still a no-no.

Did the kid go around changing price tags, or did they just show that it was possible?

How do you propose he would have been able to establish that this was indeed a vulnerability?

> How do you propose he would have been able to establish that this was indeed a vulnerability?

I could comment extensively on the issue, as it is not as cut and dry as you imply. Instead, I'm going to link to the HM discussion from 2017 , as I think it is insightful and covers nuances.

https://news.ycombinator.com/item?id=14835515

Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above:

> Did you try adjusting price?

And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

> Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above

You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research?

Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.

There was no personal profit. He bought a ticket he never used, just to show to people on twitter how bad the system was. He could have silently taken advantage of his discovery and travel at no cost for a long time peraphs. But no.

Sounds more like vulnerability reasearch than crime to me.

IANAL, and furthermore have no idea what Hungary’s legal system is like, but mens rea is a thing. If I break a window by using it as a target for practicing my golf swing (I don’t golf; I have no idea if this is something golfers do) I am culpable. If I break a window because I’m trying to land balls next to the window, I might be culpable. Again, IANAL, so if anyone wants to correct my analogy, please do.

if the kid could successfully modify the scanned value of physical barcodes a) that would be quite the feat and b) that would absolutely be showing up a bunch of big names

It wouldn't be quite the feat at all. Barcodes for pre-priced items sold by weight (cheese, meat, etc.) encode the price in the last four digits. Replacing those would be trivial.

This attack has been done trivially for years - you just sticker over the barcode with the barcode of a cheaper item in the store. If you plan to use self-service checkouts for this scam, pick cheaper item with same weight or with a tag that prices cheaply per unit of weight (produce) etc.

How did the arrest go? For all you know it was the local cop that took him to the station and put him under arrest. Not to necessarily punish but to imprint that even though the action was minimally invasive for a simple bus ticket, it applied on larger systems, could have a significant effect. So more as a simple friendly deterrent rather than arrest and spent some nights in jail.

I don't think you can call any sort of arrest a simple friendly deterrent, or intended not to punish. That shit's traumatizing. Should he have done that? Probably not. But did he deserve arrest for finding a vulnerability? This could have been a conversation that didn't involve police. The kid could have helped them improve their systems instead of spending taxpayer dollars to send cops to the kid to arrest him.

> without actually making off with all of the gold

This is the key difference. The comment I was replying to implied that the transaction was actually completed, or at least I thought it did.

If the guy[0] didn't indeed actually benefit from the vulnerability then that is a very different story, and I don't think he should be arrested in that case.

0: not "kid" -- he is 18 which I assume is above the age of criminal responsibility in Hungary.

It's more that they walked by, saw your door open, popped their head in and then called for you to make sure you knew the door was open.

No. It’s if you were selling something in your house for $10. Somebody came in, crossed out the number on the tag, wrote down $1 and handed you a bill.

Then you took their money and gave them the item without saying anything.

Would seem like a weird situation but I don’t see how its theft.

I bet that would be most likely classified as shoplifting and/or fraud depending on jurisdiction.

Or a form of negotiation if done in plain sight.

I am not malicious or willing to attempt theft. Academically though, in an official testing environment, that would be entertaining to attempt.

Yeah I’m not suggesting that you adjust the price, just curious if they were passing price through the client as well.

you can do this on surprisingly many websites, where they include the price in the url they redirect you to, when going to the payment provider, and even then often it is only protected by an md5 hash if it is verified

I love this so much

I did something similar on an airline website earlier this year: I wanted to change the date of my return flight and also make it an open jaw (i.e. leave from a different airport than where I had arrived). Changing my flights was included in my original fare, modulo the fare difference. Unfortunately, on their website the input text field for the airport I would be flying out from would get disabled a second or two into loading the "alternative flights search" page, and wouldn't allow me to make it an open jaw. So I fired up my browser dev tools and changed the value of the text field to the desired airport code. Suddenly, I was finding the flights I had been looking for – as it turns out, at no additional charge whatsoever.

What's insane is that there are countries where this is considered hacking, even if all you do is change the URL.

somefile-small.jpg -> somefile.jpg

Black hat hacking or white hat hacking? Genuinely curious because a lot of these security write-ups can't happen without "hacking." which may explain why we don't get these security write-ups from folks in those countries.

My insurance company has different frontend password regex on registration page and on login page. My password passed the registration regex but fails the login regex. In order to log in, I need to manually remove the frontend-side password regex check.

This absolutely boggles my mind. My last insurance company let me create a 20 character PW but limited the password field on the login screen to 16 chars. I didn't think to futz around with the code so I just recreated a less secure password. I suspect many other less technical people either did that too or just called support.

There is zero excuse for that though. 16 chars is just way too short for a proper secure pass phrase, but at least make it consistent with password creation!

Ever since I started using a password manager (a long time ago), I have encountered SO MANY password bugs. But one of the most frustrating issues, is when a website asks you to create a password, but does not tell you what length or characters are accepted. So you have to dumb down Keepass incrementally until it passes. A tedious game.

If your software doesn't accept this password, please change career immediately:

ú¨<¹7®fÍå0Á1n:1}Àº»ê:t]íw´¾ã\B²¸Æþ®M3_ø>$¼ÿa÷mH¦ñ%?6ñE$l#DhqI£«{'Ø"V^c4u

Variant of this I've hit is the phone number validation rules at signup differs from the actual API call to send 2FA texts (or was changed between the time of original signup and login attempt) so I create an account successfully with a Google Voice number and then when I actually need to receive 2FA the message goes into the aether with no error surfaced at any point.

> Variant of this I've hit is the phone number validation rules at signup differs from the actual API call to send 2FA texts

Yeah, this is incredibly annoying, though to be fair, this can be a hard problem to solve. 3rd-party systems often don't tell you what their exact phone number validation rules are or silently update them, and then, to top it off, don't throw errors when validation fails. And more often than not, the 3rd-party system's developers also must have never heard of the Falsehoods programmers believe about phone numbers[0].

Source: I was responsible for adjusting phone number validation for a major ecommerce site in the past.

[0]: https://chromium.googlesource.com/external/libphonenumber/+/...

Somewhere, there is a table with a `frequency` column, storing client-supplied values, and an application happily accepting them as-is.

This is why you normalize your tables and use FK Constraints - you aren’t going to catch all the edge cases in code. Let the DB be the final arbiter of validity, because it’s been tested to hell and back.

Re: Huel, that’s pretty smart. My rate of consumption is fairly consistent (usually 1x/day on weekdays), but occasionally I’ll have one on the weekend, so the given cadences worked for me. I do 2x 12-pack / 4 weeks to hit the free shipping tier.

> You'd think that client side security would be something that we'd gotten over by now.

Well, we have passkeys. /s

Reply on news.ycombinator.com