Hello Everyone,

a week ago I posted about how important is to develop a hacker mindset, how hacking is a creative process, and how that concept led me to publish a book on the topic.

In that post, I mentioned I went from “vulnerabilities are nowhere to vulnerabilities are everywhere”, and while it may sound like a bold statement, it’s the truth. So, I thought to share another funny episode that happened right after that post, that may provide some more substance to that phrase.

I was uploading my book on another platform (I can’t mention the name, sorry) to be printed and distributed in a network of physical stores. While creating my “author profile”, I noticed that my home address was loaded asynchronously, and that rang a bell. I investigated a bit that HTTP call, and found a BAC (Broken Access Control) that allowed unauthenticated access to several thousands of authors’ Personal Identifiable Information (PII).

But there is moar! The platform wasn’t using custom software, but a commercial program in use on many other print-on-demand websites, all currently vulnerable with the same broken access control issue, and all exposing users’ data with a global impact on potentially hundred thousand people.

Now, stop your brain for a second. I know what you are thinking: “You have previous technical knowledge of the scenario and there is no creativity in the finding” – that is true but try to change your thinking path.

If you have in your mind a pre-defined set of “stuff to look for” (like that), as a hacker, you are gonna develop a strong tunnel vision and miss out on many other vulnerabilities you don’t know (yet) about, or miss out on the possibility to chain them together in a new and unexpected way.

Knowledge is a very good friend, but the mind has to stay open. I found that vulnerability while I wasn’t looking for it, my mind was open, relaxed and my mindset doesn’t change when I run a pentest or when I research a defense solution for a company.

In my opinion, that’s the hacker’s golden skill and I hope this makes the concept clearer.

As I said, vulnerabilities are everywhere 🙂

Cheers, Francesco

PS. Another good discussion would be how to report a vulnerability like that to a company with no VDP (Vulnerability Disclosure Program), but that’s probably a topic for another post 🙂