i'm in
Comment on Authy got hacked, and 33 million user phone numbers were stolen
just_another_person@lemmy.world 4 months agoYeah. They got data in a way that was not intended. That’s a hack. It’s not always about subverting something by clickity-clacking like in the movies.
downpunxx@fedia.io 4 months ago
just_another_person@lemmy.world 4 months ago
Well…you son of a birch…now I’m in.
hemmes@lemmy.world 4 months ago
You name it, we got it!
NateNate60@lemmy.world 4 months ago
With due respect, you are wrong.
hack
…
- (transitive, slang, computing) To hack into; to gain unauthorized access to (a computer system, e.g., a website, or network) by manipulating code
Hacking means gaining unauthorized access to a computer system by manipulating or exploiting its code.
just_another_person@lemmy.world 4 months ago
Exactly what this is. Read the disclosure. What about your response doesn’t fit that?
NateNate60@lemmy.world 4 months ago
They did not do it by manipulating code. This wasn’t the result of a code vulnerability. If you leave the door wide open with all your stuff out for the entire neighbourhood to see, you can’t claim you were “broken into”. Similarly, if you don’t secure your endpoints, you can’t claim you were “hacked”.
sudneo@lemm.ee 4 months ago
Lack of rate limiting is a code vulnerability if we are talking about an API endpoint.
Not that discussion makes any sense at all…
Also, “not securing” doesn’t mean much. Security is not a boolean. They probably have some controls, but they still have a gap in the lack of rate limiting.
NateNate60@lemmy.world 4 months ago
With due respect, you are wrong.
hack
…
- (transitive, slang, computing) To hack into; to gain unauthorized access to (a computer system, e.g., a website, or network) by manipulating code
Hacking means gaining unauthorized access to a computer system by manipulating or exploiting its code.
kitnaht@lemmy.world 4 months ago
Hint – by manipulating or exploiting its code
Which I am explaining, they…did…not…do…
Guest_User@lemmy.world 4 months ago
They absolutely exploited unintended functionality. If this was intended, they wouldn’t have added rate limiting and locked down the api after. It was clear to say this was certainly not an intended use of the api.
In a video game for example, if there is a an item that caused excessive lagging just by placing the item. Placing a lot of them with the intent to lag the game would be an exploit. They only used items sanctioned by the game, but for unintended reasons and they would likely be banned for exploitation.
lazynooblet@lazysoci.al 4 months ago
You’re arguing with someone who was agreeing with you 😑
NateNate60@lemmy.world 4 months ago
You are correct, I replied to the wrong comment
kitnaht@lemmy.world 4 months ago
Exploit. The system worked as intended, just without a rate limit.
dezmd@lemmy.world 4 months ago
Exploiting is hacking, quit being pedantic.
___@lemm.ee 4 months ago
A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.
just_another_person@lemmy.world 4 months ago
Sure. Except you’re wrong and have absolutely idea of what people in this community say about things. Let me be a dick and literally googz this for you and find an embarassing answer because you couldn’t do it yourself.
Image
stephen01king@lemmy.zip 4 months ago
So your googling proved him right. What’s embarrassing about being right?
Guest_User@lemmy.world 4 months ago
They gained unauthorized access. From that guys definition that is a hack, no an exploit
0xD@infosec.pub 4 months ago
A missing rate limit is a vulnerability, or a weakness, depending on the definition. You’re playing smart without having an idea of what you’re talking about. Here you go:
cwe.mitre.org/data/definitions/799.html
YouTube videos are public, and as such it’s not really hacking. If you were able to download private videos, for example, it would be a vulnerability like “Improper Access Control”. It does not matter in the least whether you use an “exploit” in your definition (which is wrong) or “just increment the video ID”.
The result is a breach of confidentiality, and as such this is to be classified as a “hack”.
Natanael@slrpnk.net 4 months ago
Hacking is the entire process including figuring out if something is or is not rare limited