Skip to content

McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Who Tried the Password ‘123456’

Technology
70 53 0
  • 0 Stimmen
    1 Beiträge
    0 Aufrufe
    Niemand hat geantwortet
  • Apple’s plan: Stall, cheat, repeat

    Technology technology
    32
    1
    191 Stimmen
    32 Beiträge
    2 Aufrufe
    R
    I have an idea - make this issue solved via direct popular vote. Ranked choice, variants range from "Apple owns your butts" to "Apple should be punished with its monthly margin for failing to deliver hourly orgasms with its devices" to "Apple open sources and PD's everything or Apple leaves". They'll be interested themselves in making the OS as convenient for normal usage as possible. Including the walled garden part. OK, just a thought experiment.
  • Electric Bikes

    Technology technology
    1
    2
    0 Stimmen
    1 Beiträge
    9 Aufrufe
    Niemand hat geantwortet
  • The AI girlfriend guy - The Paranoia Of The AI Era

    Technology technology
    1
    1
    6 Stimmen
    1 Beiträge
    11 Aufrufe
    Niemand hat geantwortet
  • 191 Stimmen
    26 Beiträge
    100 Aufrufe
    A
    I wish everyone could read your comment right now. Spot on
  • 177 Stimmen
    118 Beiträge
    285 Aufrufe
    K
    My 2 cents is that it would have flourished a lot longer if eclipse wasn't stretched so thin like using a very thick amorphous log that is somehow still brittle? And ugly? As a bookmark.
  • Digg founder Kevin Rose offers to buy Pocket from Mozilla

    Technology technology
    7
    2
    1 Stimmen
    7 Beiträge
    32 Aufrufe
    H
    IMO it was already shitty.
  • 1 Stimmen
    8 Beiträge
    37 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.