HackerOne breach lets outside hacker read customers’ private bug reports

guest · Dec 4, 2019

HackerOne breach lets outside hacker read customers’ private bug reports
Company security analyst sent session cookie allowing account take-over
December 4, 2019
https://arstechnica.com/information...de-hacker-read-customers-private-bug-reports/

Now, the company has paid a $20,000 bounty out of its own pocket after accidentally giving an outside hacker the ability to read and modify some customer bug reports.

The outsider—a HackerOne community member who had a proven track record of finding and privately reporting vulnerabilities through the platform—had been communicating late last month with one of the company’s security analysts.

“HackerOneStaff Access,” the community member haxta4ok00 wrote in broken English on November 24. “i can read all reports @security and more program.” In a follow-up message, haxta4ok00 wrote: “i found what is you can edit private program (for test) I have not changed anything and not used , all for the sake of hacking.”
Damage assessment
HackerOne isn’t saying precisely how much data was exposed. An incident report the company published on Tuesday said that all affected customers have already been privately notified. Tuesday’s report also said that the data was limited to reports the security analyst had access to, but the disclosure doesn’t provide even a rough estimate of how many customers or how much data were affected.
Click to expand...

Log in or Sign up

HackerOne breach lets outside hacker read customers’ private bug reports

guest Guest

Log in or Sign up

HackerOne breach lets outside hacker read customers’ private bug reports

guest Guest

Useful Searches