Re: Suspect arrested who used Heartbleed to infiltrate the Canada Revenue Agency (Our IRS)

[Andrew Klaus <andrewklaus () gmail com>]

I'm guessing he scripted to pull as many login/passes (or cookies) as
possible, then simply looped through them and grabbed the SIN data from the
web interface. Needing to "login" to each.

Indeed, what an idiot.


On Wed, Apr 16, 2014 at 12:27 PM, Justin Bull <me () justinbull ca> wrote:

> Some 19 year old kid used heartbleed to gain access to the CRA systems and
> purge 900 SINs (akin to SSN) from the agency.
>
> What a fool.
>
>
> http://www.theglobeandmail.com/news/national/rcmp-charge-teen-in-relation-to-alleged-heartbleed-bug-theft/article18041007/#dashboard/follows/
>
> --
> Best Regards,
> Justin Bull
> E09D 38DE 8FB7 5745 2044 A0F4 1A2B DEAA 68FD B34C
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/