8 ms·
How I pwned a major New Zealand service provider
- davesmylie 1y agoHmm. Notably Farmers NZ recently had an extended unplanned outage, and has a 4 star app
- xupybd 1y agoKiwi bank is the most likely IMO. Almost 4 star and the kind of think GPT would do is leave in the Kiwi part.
- svarrall 1y agoThey mentioned the name of the app in the article “KiwiServices”
- pikelet 1y agoThey mentioned at the top of the article that this is not the real name.
- deleted 1y ago[deleted]
- girvo 1y agoThat reminds me of all the SQL injection vulns that we used to blame on PHP. As PHP becomes less popular, and the same/similar vulnerabilities remain, I realise it's more just bad practices (though ~2000-early 2010s PHP really was pretty rough when it came to creating those holes, but that might just be a function of how popular it was!) Nice work on finding it :)
- rsch 1y agoPHP was blamed for a good reason: for a long time it did not by default support prepared SQL statements. You could install the mysqli extension to gain such support but that was almost never available on shared web hosts.
- allset_ 1y agoAnd every tutorial you could find on how to use PHP with a database was a tutorial on how to add SQL injection to your site.
- girvo 1y agoThat was the bigger problem, IMO, in that even once PDO existed and the MySQL extension was "fixed" to have prepared statements, so much of the documentation still did it wrong. And yet similar classes of bugs still pops up today, even with what I would've assumed to be safe defaults? I'm guessing its non-standard databases or DB clients or something? This case is more just a pure lack of sanitisation, but it's fascinating to see in 2025 still :)
- hsbauauvhabzb 1y agoBe super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
- StrauXX 1y agoNo, they did not in any way break the law. As they wrote themselves: > I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
- shakna 1y agoUnder New Zealand's Crimes Act, all unauthorised access is illegal. This has been used in court to cover places where someone was not pre-approved, rather than just a policy that gives an implied acceptance. It has also been used where someone has accidentally gained access via insecured systems. I would not be so confident in stating that they did not break the law.
- StrauXX 1y agoAny half-decent VDP will have a safe harbour clause. Otherwise ot isn't a true VDP but rather just contact details.
- hsbauauvhabzb 1y agoA security disclosure contact email is not a safe harbour clause.
- shakna 1y agoSo far, the courts have ruled that you need to be specifically approved, by name, before any works begin. There is no safe harbour here. Your policy does not overrule the law. You need a pre-existing relationship with the company, before you begin to look for vulnerabilities.
- ngonch 1y agoAustralia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop
- apimade 1y agoThat is neither standard nor normal.
- bell-cot 1y agoPerhaps. From a distance (physical, social, or both) local norms of behavior are often non-standard and abnormal.
- mvdtnz 1y agoWhat this person is describing are not norms here.
- loktarogar 1y agoThis isn't normal in Australia or New Zealand, at a national or a local scale. But you can't draw conclusions at a national scale from a local interaction, either way.
- no_carrier 1y agoIt's certainly not the norm in Australia, nor have I come across that in probably the last 15 or so years. Running your credit card through the terminal to place a hold on funds is done pretty much everywhere. I'm sure there's a few crusty old operators out there doing things the old way.
- ngonch 1y agoHotels always ask to physically take my credit card, random maintenance guys ask to access my apartment without a heads-up from the landlord. It's seen as normal, but in my book it's a bit careless.
- dylan604 1y agoby default, make the thing return a 400 Invalid Request for any request that did not fit exactly what you are expecting. That at least lets you focus on ensuring the data that you are expecting is sane/valid/safe. Undocumented features will eventually bite you, and are loaded footguns, especially if your QA team doesn't know about the undocumented features.
- efilife 1y agoWere you paid? I hope yes
- pjsg 1y agoDoes this api allow me to enumerate the users (by phone number) using the service? That would seem to be bad as well. I. guess that it depends on what their fix was. If this really was the first api request made by the app, and it has a serious vulnerability, then the omens are not great for the rest of the api calls either.
- sitzkrieg 1y agoto think someone thought that api was a good idea and got all the way to deploying it, yikes
- protocolture 1y agoHonestly cool to see a story like this where the punchline isnt "They never fixed the bug" or "They sent goons after me".
- taitems 1y agoAt least they cared. I found an enumeration attack on an Australian referral service where phone numbers were keys and it returned way too much personal information. Responsibly disclosed numerous times, LinkedIn contacted employees. Not even acknowledged and at last check, still open vulnerability.
- manosyja 1y agoFull disclosure was a thing exactly because of that.
- mixermachine 1y agoThe sad thing is, that at some point they truly get exposed (big leak) and your name might come up because they have nobody else to blame. I wish you the best and hope you have lawyer insurance.