Slashdot Mirror
The FCC Website Lets You Upload Malware Using Its Own Public API Key (hackernoon.com)
The FCC lets you upload any file to their website and make that file publicly accessible using the FCC.gov domain. Or rather they don't, but they have somehow not realized that they are letting people do it and telling them how in their own documentation. From a report: Take a look at this document about FCC Chairman Ajit Pai which has clearly not been put there by anyone who works at the FCC, neither has this one. Those currently uploading files are able to do this using the FCC's own public API, a key that they seem to send to anyone with any email address. Obviously I am not going to tell you how, but if you have enough of the right kind of technical experience the public FCC API documentation will. People seem to be experimenting uploading different filetypes, so far they have managed pdf/gif/ELF/exe/mp4 files up to 25MB in size, which means that you could easily host malware on the FCC.gov website right now and use it in phishing campaigns that link to malware on a .gov website.
How long before it is hosting kiddy porn and will the FBI raid them?
Time to offend someone
to download random files of unknown origin, from a website they say can't be trusted? That is, if I am to believe the article summary.
Anyone mind sharing a valid API key?
Two wrongs don't make a right, but 3 lefts do - Lew of GO magazine
And these are the people who are making decisions about the future of the Internet?
Omne ignotum pro magnifico.
In case the files get removed or you use a text-only browser: The first PDF document looks like an official FCC letter and reads: Dear American citizenry, Weâ(TM)re sorry Ajit Pai is such a filthy spineless cuck. Sincerely, The FCC The second PDF is just an empty document with one line of profanity.
Eh... interesting but boring. How about PHP/asp/py/pl/vbs and other server side languages?
Cwm, fjord-bank glyphs vext quiz
Just as with their DDoS mitigation tactics, you can bet that they will fix this with some "commercial cloud partner" Secret Sauce. Because God knows, we can't expect the Federal Communications Commission to have in-house the technical skills to competently run a reasonably safe server that allows them to accept public comment and supporting evidence documents over The Internet.
I hope you are not surprised by this.. The FCC has been this way for decades now.
Indeed, younguns should take a moment and watch Pump Up The Volume (again). Everybody knows the war is over.
Perhaps we might see an unexpected release on their site about how they've decided to 'do the right thing (tm)' re. net neutrality ?
Requiem for the American Dream
When they opened up the site for the auto-submit bots from Comcast and Verizon to flood their public feedback channel with ant-neutrality comments, this was a side effect.