Hacker News Reader

Comment by nathanmock | Hacker News Reader

I accidentally stumbled upon employee admin screens, all by changing a key, isAdmin = true. https://news.ycombinator.com/item?id=9121004

View on HN

That is by definition not accidental.

Yeah, I definitely would not do that to a 3rd party system without a specific letter of engagement for penetration test or security review. Now, that being said, it's the first thing I would tell every single developer about as a senior developer and I would insist that test cases be written to verify that no such 'feature' was permitted into the application.

Should I consult with my lawyer before manually entering an address into a browser? I could easily make a mistake that would allow me to access the wrong page.

Heck, if we're being that careful maybe I should just throw my computers out the window. A Google search result or a forum post could link me to the wrong page and I could get sued.

That is more of a debug menu.

How in the world did you only get 8 points for that? I've upvoted yours. That seems almost as bad as the incident reported in this thread.

Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.

This is a good point, but there should be more awareness towards the issue as a whole. I've seen many apps who expose data dangerously. Some developers may not be aware that these values are exposed (even with SSL), so they should architect their apps accordingly, reinforcing the fact that you should never trust the client. I also briefly touch on the fact about this dynamic architecture and some of the implications it brings.

You mean throwing up a Meteor app with a direct db feed and no fine grained security at the server side can lead to exploits?

Aha! Good point!

Interesting nevertheless, but ultimately not more than a slight reveal of how things look on the inside.

Information leakage is absolutely a security issue.

The information leaked was most probably a few views/menus. He's only tricking the client in to thinking he's an administrator, not the server.

How do you know that he got 8 points?

He's had a few more since, but it is a story submission not a comment, so the vote numbers are public:

"90 points by nathanmock"

Wow, that is a reckless implementation.

Reply on news.ycombinator.com