Slashdot Mirror
Attacker Compromises Pornhub, Sells Shell Access for $1,000, Says Columnist (csoonline.com)
An anonymous reader writes: Four days after launching a bug bounty program, Pornhub is said to be compromised. The person responsible used a vulnerability in the user profile script that handles images (not ImageMagick) and is selling shell access on one of their servers for $1,000 USD. This is the second major website the hacker has shelled. Prior to Pornhub, they compromised the LA Times website.
CSO's security columnist notes that Pornhub "announced their bounty program on May 9, but it's a private, invite-only program managed by HackerOne. As such, it isn't clear if there would've been a way to report this flaw and collect a reward to begin with." In addition, on Twitter the attacker reportedly posted "I don't report vulnerabilities anymore, go underground or go home."
CSO's security columnist notes that Pornhub "announced their bounty program on May 9, but it's a private, invite-only program managed by HackerOne. As such, it isn't clear if there would've been a way to report this flaw and collect a reward to begin with." In addition, on Twitter the attacker reportedly posted "I don't report vulnerabilities anymore, go underground or go home."
Bug bounties are bogus. Don't make a lottery out of security.
I watch porn just like every other guy and not a small number of women.
But who actually pays to subscribe to something that is obviously available for free?
If they want me to pay money they'd better send one of those Nubile girls to my house.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
"I don't report vulnerabilities anymore, go underground or go home."
Here's hoping I see a future /. story titled "PornHub Hacker arraigned today". I don't give a rat's ass that it's Pornhub, the sentiment that this guy has deserves the consequences in anti-hacking laws.
As much as I get your feelings on this, the number of people who've been sued after reporting vulnerabilities makes me understand it.
The difference is: those other people did not deserve to be arrested. For finding a vulnerability and subsequently selling shell access, this guy does deserve it.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
That last sentence is bogus. Their bug-bounty program isn't invitation only. I have the submission form open in another tab right now. The only requirement that differs from any other is that if your first four reports are bogus, they may stop paying attention to you (known as a signal requirement) .
lol.. You are not paying for porn, you are paying for a shell account which can allow you to access porn and a lot more. Hell, you can even set up your own website and host your own porn on their servers if your privileges are high enough.
Dude, not fucking cool.
Certain sites get immunity from hacking just because. They are privy to an unspoken rule where they get left alone because messing with them is like shitting in your own bed.
Thats what you did, you just shit in your own bed, and while I realize they have a section for that, its still not cool.
This is about as uncool as when rootshell was hacked. Again, shitting in your own bed.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Do you have a source for that, or are you completely making things up and then believing your own fiction, as so many Slashdotters sem to do? I don't see anything like that in the terms and conditions myself.