Accessing Max Verstappen's passport and PII through FIA bugs

by galnagli • 9 months ago

632 141 9 months ago

Just out of interest have you had any legal threats etc from this kind of probing if they don't have explicit bug bounty programs? Also do you ever get offered bounties in on reporting where there wasn't a program?

forgotaccount222• 9 months ago

When I was still in university I reported a vulnerability and when the company started threatening me with legal action, my professor wrote a strongly worded email and they dropped it. Haven't had it since in 8 years. Feels like many companies understand what we do now, atleast compared to 10 years ago.

SirHumphrey• 9 months ago

This seems depressingly common in universities. I know of a case where someone discovered anyone with a university account (so students, etc.) can edit DNS, and the IT tried to file charges until the head of CS department intervened.

iancarroll2• 9 months ago

Actual legal threats are uncommon but I have seen some companies try to offer a bribe disguised as a retroactive bug bounty program, in exchange for not publishing. Obviously it is important to decline that.

intheitmines2• 9 months ago

Thanks, its cool to hear attitudes have changed.

gausswho• 9 months ago

Decline because it'd mean you were profiting off of a crime? Or that the opportunity of publishing has higher value than the bribe?

zozbot2342• 9 months ago

The kind of probing they did and described in the blogpost, with the attempt to raise their privileges to admin is legally fishy AIUI. Usually this kind of thing would be part of a formal, agreed-to "red teaming" or "penetration testing" exercise, precisely to avoid any kind of legal liability and establish necessary guidelines. Calling an attempted access "ethical" after the fact is not enough.

iancarroll2• 9 months ago

Good-faith security research[0] is the only way this industry will move forward, for better or worse. It is clear that most companies do not want to invest in anything further like VDPs.

[0] https://www.justice.gov/archives/opa/pr/department-justice-a...

bitexploder• 9 months ago

Without any sort of formally posted bug bounty program explicitly authorizing this sort of activity the CFAA prohibits unauthorized access of "protected computers". I would classify this as legally risky. If FIA had a stick up their ass they could definitely come after the researcher. The researcher's ethical standing is pretty clean in my book, but this was definitely a little more than just changing a URL parameter (only a little more). I would say this is unsafe to do if you are in the united states. The stopping point was somewhere around "I think I could provide the admin role" and reaching out to the best contact you can find and say "Hey, I am an ethical white hat security researcher and I noticed X and Y and in my experience when I see this there is a pretty reasonable chance this privilege escalation vulnerability exists. The chance it exists is high enough in my experience that you should treat it like it exists and examine your authorization code. If you would like I can validate this on my end as well if you give me permission to examine this issue. I am an ethical security researcher" ---> point over to your website and disclosed issues if you got em. To just do it is ehh... I would not take the risk. However if I /did/ do it I would definitely disclose it to them immediately and give an explanation like the above. Shooting the messenger in this case would be pretty asinine, especially if they didn't access anything sensitive, that would preclude FIA from having any evidence you did anything sketchy (cause you did not). The reason I would not do it is because you never know if a system like this pre-fetches data, etc. and that is definitely opening you up to liability of possessing PII etc. Overall, I have disclosed issues like this in the past without actually exploiting the issue to good results. Some times companies ignore it. You can always say "If you do not want to treat this issue as a vulnerability I am going to write this up on my website as an example of things you should probably not do" if you feel ethically compelled to force them to change without actually exploiting the issue. People tend to get the message and do something.

trollbridge• 9 months ago

... so you'd prefer that the only people doing this will be black-hat hackers who then sell the information on the black market?

Nextgrid2• 9 months ago

What he did there could indeed be legally risky.

Remember that while for a lot of us this kind of security research & remediation is “fun”, “the right thing to do”, etc there are also people in our industry that are completely incompetent, don’t care about the quality of their work or whether it puts anyone at risk. They lucked their way into their position and are now moving up the ranks.

To such a person, your little “security research” adventure is the difference between a great day pretending to look busy and a terrible day actually being busy explaining themselves to higher ups (and potentially regulators) and get a bunch of unplanned work to rectify the issue (while they don’t care personally whether the site is vulnerable - otherwise they wouldn’t have let such a basic vulnerability slip through - now that there is a paper trail they have to act). They absolutely have a reason and incentive to blame you and attempt legal action to distract everyone from their incompetence.

The only way to be safe against such retaliation is to operate anonymously like an actual attacker. You can always reveal your identity later if you desire, but it gives you an effectively bulletproof shield for cases where you do get a hostile response.

aleph_minus_one2• 9 months ago

while they don’t care personally whether the site is vulnerable - otherwise they wouldn’t have let such a basic vulnerability slip through

Even if they do care personally (which I would assume is often the case if the respect person is not an ignorant careerist), they often don't have the

- organizational power

- (office-)political backing

- necessary very qualified workforce

to be capable of deeply analyzing every line of code that gets deployed. :-(

Kaibu• 9 months ago

In Germany, the case of a company called "Modern Solution" has gained quite a bit of traction. An IT guy found a password, tried it on the company's phpmyadmin and reported that he could access their data. They sued him and the case went up to the highest German court, which acknowledged the lower court's decision to rule with the company. The IT guy got fined.

https://www.heise.de/news/Bundesverfassungsgericht-lehnt-Bes... (German article)

aleph_minus_one2• 9 months ago

Some additional relevant information:

When the changes that toughened the § 202 StGB were made in 2007, there were a lot of public rallies against it in which many programmers participated. These were ignored by the politicians in power. This (together with other worrying political events) even lead to a temporary upcoming of a new party (Piratenpartei) in Germany.

The fact that these rallies were ignored by the politicians in power lead to the situation that from then on by many programmers the German politicians got considered to be about as trustworthy as child molesters who have relapsed several times.

anal_reactor3• 9 months ago

Lesson: instead of being the good guy and reporting shit, just sell it on black market.

luxuryballs• 9 months ago

well at least it was a password hash :D

dmitrygr• 9 months ago

Don't get too excited. They never said what kind of hash. Given the rest of the site's security design, might have easily been unsalted md5

auxiliarymoose2• 9 months ago

Or maybe rot26 — I've heard it's twice as secure as rot13!

Group_B• 9 months ago

There's probably another rockyou out there waiting to happen

GEBBL• 9 months ago

Strange, the site is run by an Ian Carroll, but the examples show Sam Curry, who is a very famous bug bounty hunter.

captnasia• 9 months ago

if you look at his other posts, it looks like they collaborate often.

gregschlom• 9 months ago

From the post:

"Having been able to attend these events by hoarding airline miles and schmoozing certain cybersecurity vendors, Gal Nagli, Sam Curry, and I thought it would be fun to try and hack some of the different supporting websites for the Formula 1 events."

cathalc• 9 months ago

That is shamefully poor security.

gnerd00• 9 months ago

wait until you see the party footage

daemonologist• 9 months ago

It's hard to even call it security - it was just wide open...

I will say though, this kind of thing does wonders for my imposter syndrome.

whatever1• 9 months ago

Just use a framework to build your site. Don’t reinvent the wheel!

ChaseRensberger• 9 months ago

i respectfully disagree with this sentiment. i think that in general, reinventing the wheel can be a great learning opportunity in understanding how the wheel works.

AnimalMuppet• 9 months ago

It can. But it can be very bad at producing wheels that don't break.

jonplackett• 9 months ago

But maybe do that on a smaller scale personal project?

catoc• 9 months ago

Reinventing the wheel for Formula 1 driving…

samarthr1• 9 months ago

I funnily just read a whole Twitter thread that had this same thesis, not 45 minutes ago... What a small world

atonse• 9 months ago

Great to reinvent the wheel for your mom and pop blog, or to teach yourself these concepts and try to break in. But not for authn and authz for something official like this.

motorest4• 9 months ago

Just use a framework to build your site. Don’t reinvent the wheel!

How do you arrive at that conclusion after reading an article on how an API had a broken access control vulnerability?

renewiltord• 9 months ago

He’s being sarcastic and suggesting using some out of the box rbac thing.

maxbond2• 9 months ago

There are some vulnerabilities frameworks can address wholesale (like CSRF or XSS) as long as you keep to the blessed way of doing things, but they aren't able to save you from a complete failure to build authorization into your API. Like how seatbelts save lives but can't stop you from accelerating directly into a pole if you choose to do so.

zikani_03• 9 months ago

Mass assignment problems sometimes also come from (improper?) use of frameworks. This goes beyond frameworks and more about how thorough the testing and review of how the user account modification and access control is done.

homakov2• 9 months ago

Github used a framework tho.

forgotaccount222• 9 months ago

Archaic company has archaic security. Well done on the RD, but boy does it not surprise me one bit. Would almost be willing to bet that the hash was MD5 too.

veqq• 9 months ago

What hash do you use?

scq• 9 months ago

bcrypt is the industry standard.

megous• 9 months ago

yescrypt is very common these days, default in Debian

blitzar• 9 months ago

im 1337 - I use plain text stored in a public s3 bucket

zozbot2342• 9 months ago

It's an F1 racing site, their job is literally to move fast and break things. https://xkcd.com/1428/

olyjohn• 9 months ago

You break things in F1, you lose. Reliability and consistency is key.

mikey_p• 9 months ago

No, this is the FIA[1], not Formula 1. They are very very different organizations.

[1] https://en.wikipedia.org/wiki/F%C3%A9d%C3%A9ration_Internati... https://en.wikipedia.org/wiki/Formula_One_Group

LorenDB• 9 months ago

Ian, it would be great to see an RSS feed on your website if you want to gain another regular reader :)

galnagli• 9 months ago

Ian is a great writer

heavyset_go• 9 months ago

Seconding this

jacquesm6• 9 months ago

That's not just one vulnerability, that's a whole slew of failures. For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that.

I hope you got at least free tickets for life out of this.

skeezyjefferson2• 9 months ago

For instance there is absolutely no need to keep those documents on the live server for applicants once they have been used for their intended purpose. Blast radius reduction and all that.

I hate this kind of post-hoc finger pointing people do after security breaches. There are other concerns in life beyond security - youre naive to think differently. Is your house secure or could somebody break past your protections? Have you harmed your defensive posture with negligence of security? Do you even care?

zamadatix• 9 months ago

I hope you never handle other people's PII with that attitude. It should well and beyond be treated more securely by a company collecting it than some random person's house or individual set up, there are laws about this.

margalabargala• 9 months ago

That's what you choose for yourself.

How do you feel if that's also what your bank chooses for you?

jacquesm6• 9 months ago

I get told at least a couple of times every month that security and business continuity are a complete waste of time for your average company. So this isn't post-hoc, it is more like 'the dumb fucks don't even practice the basics and they could - and should - have known better'.

sebasvisser• 9 months ago

Sure, hate on the person pointing at the fire instead of the people holding the matches.

If you aren’t prepared to face criticism after a failure, you shouldn’t participate in a professional environment. Without people pointing out where it went wrong you’ll never j ow what to improve upon. Because if you knew, and chose not to act..now that would be a whole new level of incompetence.

zalusio• 9 months ago

Security has to be the #1 priority in computing, unlike your house which probably doesn't need to be fortified like a prison. The reason is that unlike your house, a computer system is exposed to 8 billion people at all times, and maybe 7 billion of them will face no consequences if they break in and steal your stuff.

awesome_dude• 9 months ago

Rule 1.

NEVER trust user supplied data.

Once that rule was broken, any other rules broken became clear to everyone

jacquesm6• 9 months ago

You'd think that client side security would be something that we'd gotten over by now.

rpcope1• 9 months ago

You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.

hulitu• 9 months ago

You'd think that client side security would be something that we'd gotten over by now.

Well, we have passkeys. /s

nradov• 9 months ago

Never trust any data. Even if the data comes from a partner or internal system it could be compromised or defective.

logicallee• 9 months ago

Never trust any data. Even if the data comes from a partner or internal system it could be compromised or defective.

I don't even call it data anymore. I call it datain't.

coldpie2• 9 months ago

Rule 0: Any networked computer should be considered semi-public. Don't store any information you do not want to be public, or give access to controls that you do not want to be publicly accessible, on a networked computer. There are simply too many vulnerabilities to assume otherwise.

normie3000• 9 months ago

I doubt there are many people in rich countries that follow this rule, given that smartphones are networked computers and people don't want their personal photos to he publicly accessible.

paddleon• 9 months ago

missed opportunity to grant the authors a F1 super license and get the chance to actually drive one of the cars!

stingrae• 9 months ago

If only that's all it takes

CSDude• 9 months ago

Imagine being a world class F1 driver and (someone) still have to upload your CV somewhere.

ddalex• 9 months ago

a couple of weeks ago Verstappen raced in a "Advanced-amateur" competition in Germany - he had to be "trained" by an official instructor in a restricted car because he hadn't raced there before

I imagine the instructor "What could I teach Verstappen now..."

yieldcrv• 9 months ago

responsible disclosure made you no money and even after that blogpost you still have to take the l33tcode interview

Briannaj• 9 months ago

my favorite type of hacking. reading the js an modifying the PUT. Works a lot more often than you expect.

Aeolun• 9 months ago

They took the website offline on the same day it was reported! That’s amazing!

ehnto• 9 months ago

Yeah I thought that was good. The fix wasn't that long either given how fast enterprises like this usually operate.

Jeremy1026• 9 months ago

I wonder how much the FIA being European affected the response. Would they have been as quick to react if they were American and knew they'd only be facing a relatively small class-action settlement?

olliebrkr• 9 months ago

HAX HAX HAX SUPERHAX HAX HAX (sorry)

timpattinson• 9 months ago

du du du du..... hax verstappen

braza• 9 months ago

In 2025 I think most of the PII is just a legal liability for 99% of the cases.

I once saw a custom service where you could connect your data, like Mixpanel or some analytics, and the whole motto was that this service did not want any of your PII data, and even the employees and companies that could access all the anonymous data had pseudonyms (e.g., a company named "Ocean's Eleven" with the employees Billy, Reuben, Rusty, Benedict, Linus, Basher, and so on).

Does someone know any architectures or designs of applications (books or references) that take anonymity as default?

t1234s• 9 months ago

Is this a case where the back end has no whitelisting of what fields are allowed to be written to for that specific endpoint?

encom2• 9 months ago

Missed opportunity to delete Lance Stroll's license.

homakov2• 9 months ago

The JSON HTTP response for updating our own profile contained the "roles" parameter, something that might allow us to escalate privileges if the PUT request was vulnerable to mass assignment. We began looking through the JavaScript for any logic related to this parameter.

Oh, here we go again. JavaScript brings mass assignment back. My efforts went in vein. Strong params, pls!

Accessing Max Verstappen's passport and PII through FIA bugs

Related Stories