A security researcher discovered a critical vulnerability in a major New Zealand service provider's website. By manipulating a forgotten password request, they were able to inject arbitrary JavaScript code that executed when an administrator viewed the request in their backend system. This cross-site scripting (XSS) vulnerability allowed the researcher to gain access to administrator cookies and potentially full control of the provider's systems. Although they demonstrated the vulnerability by merely changing the administrator's password, they highlighted the potential for far more damaging actions. The researcher responsibly disclosed the vulnerability to the provider, who promptly patched the flaw and awarded them a bug bounty.
Federal prosecutors have linked the theft of $150 million in cryptocurrency from a crypto platform to the 2022 LastPass breaches. The hackers allegedly exploited vulnerabilities exposed in the LastPass hacks to steal a developer's decryption key, ultimately gaining access to the crypto platform's "hot" wallets. The indictment doesn't name the victimized crypto platform, but describes it as a "virtual currency exchange based in the United States." Two individuals, Russian national Ruslan Akhmetshin and an unnamed co-conspirator, are charged with money laundering and conspiracy to commit computer fraud. The indictment details Akhmetshin's alleged role in converting the stolen cryptocurrency into Bitcoin and then routing it through various channels to obscure its origin.
Hacker News commenters discuss the implications of the LastPass breach, focusing on the seemingly lax security practices that allowed the attackers to compromise a DevOps engineer's home computer and subsequently gain access to critical infrastructure. Several express frustration with password managers in general, highlighting the inherent risk of placing all eggs in one basket. Some question the plausibility of a DevOps engineer having access to decryption keys on a home machine, while others debate the efficacy of multi-factor authentication (MFA) against sophisticated attacks. The conversation also touches on the potential for insider threats and the difficulty of securing home networks against determined attackers. Some commenters find the timeline presented by the DOJ dubious, suggesting a longer period of compromise than officially acknowledged.
Bybit CEO Ben Zhou confirmed the cryptocurrency exchange suffered a security breach resulting in a loss of $1.46 billion. Zhou assured users that Bybit's insurance fund can fully cover the loss and that no user funds were affected. He attributed the loss to unauthorized access to Bybit's hot wallet, emphasizing that the platform's other security systems remained intact. Zhou also stated that an investigation is underway to determine the cause of the breach and prevent future incidents.
Hacker News users discuss the Bybit hack with skepticism, questioning the unusually large reported loss of $1.46 billion, especially given the lack of widespread media coverage. Some speculate about the possibility of an inside job or accounting errors, highlighting the opacity common in the cryptocurrency exchange world. Others point to the lack of specific details about the hack, like the exploited vulnerability or the affected assets, fueling further distrust. The exchange's claim of being able to cover the losses is met with suspicion, prompting discussion about the potential long-term impact on user trust and the overall stability of Bybit. Some comments also mention the ironic timing of the hack coinciding with Bybit's proof-of-reserves publication.
War Thunder players have repeatedly leaked classified military documents related to in-game vehicles, seeking to improve the game's realism or win arguments in online forums. Driven by a desire for accuracy and fueled by competitive debates, these leaks have involved information on tanks like the Challenger 2, the Leclerc, and the Chinese Type 99, often including restricted manuals and specifications. While players argue their intentions are to enhance the game, these actions have serious real-world implications regarding national security and the dissemination of sensitive military data. The video emphasizes the absurdity of the situation, highlighting the clash between a video game's pursuit of realism and the potential dangers of unrestricted access to classified information.
Hacker News users discussed the motivations behind War Thunder players leaking classified military documents. Several commenters suggested that the players' intense dedication to realism in the game drives them to seek out and share restricted information to prove a point or improve the game's accuracy. This dedication, coupled with a lack of awareness about the potential consequences, contributes to the leaks. Some argued that the game developers bear some responsibility for fostering this environment by encouraging such a high level of realism. Other comments pointed out the ease of finding such information online, and the seemingly lax security surrounding some of these documents. A few commenters also highlighted the inherent tension between realism in games and the potential for misuse of sensitive information.
Summary of Comments ( 2 )
https://news.ycombinator.com/item?id=43466355
HN commenters discuss the ethical implications of the author's actions, questioning whether responsible disclosure was truly attempted given the short timeframe and lack of clear communication with the affected company. Several express skepticism about the "major" provider claim, suggesting it might be smaller than portrayed. Some doubt the technical details, pointing out potential flaws in the exploit description. Others debate the legality of the actions under New Zealand law, with some suggesting potential CFAA violations, despite the author's New Zealand origin. A few commenters offer alternative explanations for the observed behavior, proposing it might be a misconfiguration rather than a vulnerability. The overall sentiment is critical of the author's approach, emphasizing the potential for harm and the importance of responsible disclosure practices.
The Hacker News post titled "How I pwned a major New Zealand service provider" (linking to https://mrbruh.com/majorprovider/) generated a significant discussion with a variety of comments. Several commenters focused on the ethical implications and responsible disclosure practices of the author.
One compelling line of discussion revolved around the perceived recklessness of the author's actions. Some argued that escalating access to the point of root, even unintentionally, crossed a significant ethical line, especially given the potential for widespread disruption. They emphasized the importance of responsible disclosure and suggested that the author should have stopped at demonstrating the initial vulnerability and reported it immediately. Others countered that the author's curiosity and desire to understand the full extent of the vulnerability were understandable, especially given the provider's seemingly dismissive response.
Another key point of discussion was the security posture of the affected provider. Several commenters expressed concern about the apparent lack of basic security measures, such as proper input sanitization and access controls. They questioned the competency of the provider's security team and speculated on the potential consequences of such lax security practices.
Several users also debated the legality of the author's actions. While some argued that the author's actions likely violated New Zealand law, others pointed out the potential ambiguity of the relevant legislation and the difficulty of proving intent.
The comment section also included technical discussions regarding the specific vulnerabilities exploited by the author. Some users dissected the technical details of the exploits, while others offered suggestions for mitigating similar vulnerabilities.
A recurring theme was the contrast between the author's perceived youthful enthusiasm and the provider's apparent apathy. Many commenters expressed sympathy for the author's situation, while criticizing the provider's dismissive response.
Finally, several commenters discussed the potential consequences for the author, ranging from legal repercussions to reputational damage. The discussion highlighted the complex ethical and legal landscape surrounding security research and responsible disclosure.