• kitnaht@lemmy.world
    link
    fedilink
    English
    arrow-up
    59
    arrow-down
    29
    ·
    edit-2
    4 months ago

    Exploit. The system worked as intended, just without a rate limit. A hack would be relying on a vulnerability in the software to make it not function as programmed.

    It’s the difference between finding a angle in a game world that causes your character to climb steeper than it should, vs rewriting memory locations to no-clip through everything. One causes the system to act in a way that it otherwise wouldn’t (SQL injections, etc) – the other, is using the system exactly as it was programmed.

    Downloading videos from YouTube isn’t “Hacking” YouTube. Even though it’s using the API in a way it wasn’t intended. Right-clicking a webpage and viewing the source code isn’t hacking - even if the website you’re looking at doesn’t want you looking at the source.

      • ___@lemm.ee
        link
        fedilink
        English
        arrow-up
        2
        ·
        4 months ago

        A system fault is not the same as a vulnerability. These would have different baseline CVSS 3.1 scores, with the temporal and environmental reducing over time. A medium/low at best for a public endpoint exposing PII.

    • Natanael@slrpnk.net
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      4 months ago

      Hacking is the entire process including figuring out if something is or is not rare limited

    • just_another_person@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      13
      ·
      4 months ago

      Sure. Except you’re wrong and have absolutely idea of what people in this community say about things. Let me be a dick and literally googz this for you and find an embarassing answer because you couldn’t do it yourself.

          • stephen01king@lemmy.zip
            link
            fedilink
            English
            arrow-up
            4
            ·
            4 months ago

            But they are using a loophole to gain sensitive data. They did not gain unauthorised access to the system.

            • Guest_User@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              4 months ago

              They absolutely gained unauthorized access to the data. Their access was not intended or sanctioned. If it was intended to be public and accessible like it was, this wouldn’t be a story and they wouldn’t have locked down the access.

              • stephen01king@lemmy.zip
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                But by the guy’s definition, they also used a loophole to extract sensitive information, so it it also an exploit.

    • 0xD@infosec.pub
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      5
      ·
      4 months ago

      A missing rate limit is a vulnerability, or a weakness, depending on the definition. You’re playing smart without having an idea of what you’re talking about. Here you go:

      https://cwe.mitre.org/data/definitions/799.html

      YouTube videos are public, and as such it’s not really hacking. If you were able to download private videos, for example, it would be a vulnerability like “Improper Access Control”. It does not matter in the least whether you use an “exploit” in your definition (which is wrong) or “just increment the video ID”.

      The result is a breach of confidentiality, and as such this is to be classified as a “hack”.