How the Pwnedlist Got Pwned

http://krebsonsecurity.com/2016/05/how-the-pwnedlist-got-pwned/

by pfg • 10 years ago

30 5 10 years ago

pfg• 10 years ago

tl;dr: site used to track public password breaches allowed users to get a list of 866M credentials because of a simple parameter tampering vulnerability.

curiousgal• 10 years ago

How does Pwnedlist get those dumps anyway? Pastebin bots would cover Pastebin but what about chat rooms and the rest?

SlashmanX• 10 years ago

Is it really necessary to run Kali to just change a parameter in a POST request? Also the response from InfoArmor is disconcerting: "Clearly you have a special account... Oh wait s\\t no". The default position shouldn't be to fob it off as not an issue it should be "Ok, we'll look into it and try reproduce"

jlgaddis• 10 years ago

It's easy to think that and initially downplay this kind of thing but, in my 20+ years in this field, I've had more than one instance where I've said to someone "no, that can't happen" only to discover that it can and did happen.

CM30• 10 years ago

Is it me or are there quite a few security related services and companies making these sorts of minor (but easily addressable) mistakes that cost them a ton?

I swear I remember quite a few sites like this getting compromised or exploited recently.

How the Pwnedlist Got Pwned

Related Stories