ISP security is clown shoes at times. I was reading a blog post of a dude who played with their ISP APIs and was able to make changes to his own router because authenticated API endpoints returned data unauthenticated multiple times because they could just send the same request multiple times until it returned data. They fixed it quick, but still …
It’s fascinating how these guys think. There’s so much inferring what might have been done behind closed doors, and correctly.
I’m also surprised that one of these threat-detection things people talk about wasn’t triggered when he was literally sending “123456789” in most of the fields of a request.
I’m also surprised that one of these threat-detection things people talk about wasn’t triggered when he was literally sending with “123456789” in most of the fields of a request.
Considering their systems allowed data return just because they got asked repeatedly, I’m not surprised at all. You’d be surprised the seemingly important metrics that don’t get monitored and reported on during day to day operations.
This is a new risk I’m just hearing about. Do they not configure them strictly enough?
ISP security is clown shoes at times. I was reading a blog post of a dude who played with their ISP APIs and was able to make changes to his own router because authenticated API endpoints returned data unauthenticated multiple times because they could just send the same request multiple times until it returned data. They fixed it quick, but still …
https://samcurry.net/hacking-millions-of-modems
A Relevant YouTube video was just posted a few hours ago about this by LowLevelLearning.
Here is an alternative Piped link(s):
Relevant YouTube video
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
It’s fascinating how these guys think. There’s so much inferring what might have been done behind closed doors, and correctly.
I’m also surprised that one of these threat-detection things people talk about wasn’t triggered when he was literally sending “123456789” in most of the fields of a request.
Considering their systems allowed data return just because they got asked repeatedly, I’m not surprised at all. You’d be surprised the seemingly important metrics that don’t get monitored and reported on during day to day operations.