Bug Bounty hunter picks up $24,000 from Yahoo
Posted by: Timothy Weaver on 03/17/2015 05:24 AM
[
Comments
]
Mark Litchfield, a security researcher, is $24,000 richer after finding bugs involving Yahoo! Stores and hosted websites.
The biggest threat was a vulnerability that allowed a hacker to opened up full admin access to all Yahoo! Stores.
Litchfield said: "This allowed me to fully administer any Yahoo! store, as well as have access to customer PII [personally identifiable information] for all orders placed within the store, names/addresses/email address/telephone numbers etc."
"We could also shop for free by either changing the prices or creating our own discount code. Also, we could place an order, then once received go and refund our money."
A related flaw was found that would allow a hacker to create a means to hijack an online website store.
The third flaw would have allowed a means for hackers to seize administrative access to Yahoo!-hosted websites.
"This basically allowed me to administer any Yahoo!-hosted website," he said.
Linchfield said that Yahoo was very quick to fix the flaws. But he went on to say that he has also found flaws in PayPal's Prostores, GoStoreGo and PayPal Manager, that gave him admin. access to their stores and all their customer PII.
Source: The Register.UK
The biggest threat was a vulnerability that allowed a hacker to opened up full admin access to all Yahoo! Stores. Litchfield said: "This allowed me to fully administer any Yahoo! store, as well as have access to customer PII [personally identifiable information] for all orders placed within the store, names/addresses/email address/telephone numbers etc."
"We could also shop for free by either changing the prices or creating our own discount code. Also, we could place an order, then once received go and refund our money."
A related flaw was found that would allow a hacker to create a means to hijack an online website store.
The third flaw would have allowed a means for hackers to seize administrative access to Yahoo!-hosted websites.
"This basically allowed me to administer any Yahoo!-hosted website," he said.
Linchfield said that Yahoo was very quick to fix the flaws. But he went on to say that he has also found flaws in PayPal's Prostores, GoStoreGo and PayPal Manager, that gave him admin. access to their stores and all their customer PII.
Source: The Register.UK
Comments
