Sure. Except you’re wrong and have absolutely idea of what people in this community say about things. Let me be a dick and literally googz this for you and find an embarassing answer because you couldn’t do it yourself.
Comment on Authy got hacked, and 33 million user phone numbers were stolen
kitnaht@lemmy.world 5 months agoExploit. The system worked as intended, just without a rate limit.
just_another_person@lemmy.world 5 months ago
stephen01king@lemmy.zip 5 months ago
So your googling proved him right. What’s embarrassing about being right?
Guest_User@lemmy.world 5 months ago
They gained unauthorized access. From that guys definition that is a hack, no an exploit
stephen01king@lemmy.zip 5 months ago
But they are using a loophole to gain sensitive data. They did not gain unauthorised access to the system.
0xD@infosec.pub 5 months ago
A missing rate limit is a vulnerability, or a weakness, depending on the definition. You’re playing smart without having an idea of what you’re talking about. Here you go:
cwe.mitre.org/data/definitions/799.html
YouTube videos are public, and as such it’s not really hacking. If you were able to download private videos, for example, it would be a vulnerability like “Improper Access Control”. It does not matter in the least whether you use an “exploit” in your definition (which is wrong) or “just increment the video ID”.
The result is a breach of confidentiality, and as such this is to be classified as a “hack”.
Natanael@slrpnk.net 5 months ago
Hacking is the entire process including figuring out if something is or is not rare limited
dezmd@lemmy.world 5 months ago
Exploiting is hacking, quit being pedantic.
___@lemm.ee 5 months ago
A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.