Full Disclosure mailing list archives
Re: Brute force every Samsung repair customer's info with ease
From: Justa Person <keepondoin () gmail com>
Date: Tue, 13 Sep 2016 05:02:02 -0500
Either Samsung reads this list or they just have great timing. Just shy of three weeks later they responded asking for more information. Hope they close it soon. On Mon, Sep 12, 2016 at 8:01 PM, Justa Person <keepondoin () gmail com> wrote:
Sure..Was having one heck of a time figuring out the proper number to enter into the web form for my own repair and got to thinking about how terrible it seemed to disclose all that info based on just a ticket number and telephone number..And that I had tried a LOT of combinations from the info they had given me unsuccessfully without any lockout or anything. Putting those together I was able to do about 500 guesses/minute with that ugly code. But given that I encountered zero throttling or anything I would assume spawning some workers, perhaps across a botnet even, would make short work of enumerating the valid combinations. Oh, and they are nice enough to inform you if you try to pass a bad ticket number too. On Mon, Sep 12, 2016 at 5:49 PM, Nick <akarta315h () gmail com> wrote:You wish to give anymore info on how u came cross this? Please. Ta On 12 Sep 2016 17:45, "Justa Person" <keepondoin () gmail com> wrote:Samsung has zero interest in fixing this and I'm tired of trying to report it to them. Enjoy. http://pastebin.com/cKu2WDGV _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Brute force every Samsung repair customer's info with ease Justa Person (Sep 12)
- Re: Brute force every Samsung repair customer's info with ease Nick (Sep 15)
- Re: Brute force every Samsung repair customer's info with ease Justa Person (Sep 15)
- Re: Brute force every Samsung repair customer's info with ease Justa Person (Sep 15)
- Re: Brute force every Samsung repair customer's info with ease Justa Person (Sep 15)
- Re: Brute force every Samsung repair customer's info with ease Nick (Sep 15)