Gregory's Serverokay found their S3 creds. they hardcoded them in a Jenkinsfile.
|
23 comments
 anyway I'm gonna be near their HQ on thursday. Maybe I'll stop by and ask if they're still in business, and if they are, do they know where their NUCs are? and in case anyone is getting deja-vu: This is a completely different company than the other one I found like 3 weeks ago: I'm really not the right person to work in computer security research, but it'd be nice to have a sort of consulting job with a local one where I can just point them at some really broken shit and they investigate it and maybe give me a commission Why the fuck is this on hacker news? ugh. I'm gonna need to run my own mastodon instance, aren't I? If you found this on hacker news, you owe me 5$: @foone For single user (or small # of user) instances, you might want to look at the might lighter weight (and therefore cheaper to run): @foone honestly, you should probably see if the California Privacy Protection Agency is hiring investigators.  @foone you can make some money (not a lot) from responsible disclosure to bug bounty programs But many companies like this don't have structured and rewarded bug bounty programs @foone where do you find these devices? eBay? A local recycling center?   @foone@digipres.club yeah thats the one i rememberd   |
not a good sign to see a bash case statement for environment, and prod sets the server to FOOBAR.EGG
and test sets the server to... FOOBAR.EGG