How I pwned a major New Zealand service provider(mrbruh.com) |
How I pwned a major New Zealand service provider(mrbruh.com) |
If you reported them, chances are, the business would be shut down.
[0] https://www.rba.gov.au/payments-and-infrastructure/payments-...
Pine Gap is the world’s largest network tap, after all, invalidating the human rights of close to 2 billion people, every single second of the day.
The nation was bred to be so compliant. Australians are not afraid of licking boots if it means cheap avocados can be smashed.
I used a freshly generated virtual credit card with payment amount +20$ as a limit (just to be sure).
I swear half my job these days is helping australian businesses retroactively purge themselves of plaintext card data.
I have seen some shit man.
Nice work on finding it :)
If this really was the first api request made by the app, and it has a serious vulnerability, then the omens are not great for the rest of the api calls either.
Looks like he did some research before.
On the other hand
>On day 2 I awoke and began by finding some form of contact details, information was somewhat sparse but I managed to find a phone number.
Doesn't a responsible disclosure policy contain contact infos on where to report usually?
When it comes to random companies running their own VDP vs. hiring it out, it can be less than standard despite there being lots of resources on setting it up. I've seen ones that only include a phone number, the email address listed doesn't exist anymore, etc.
Others have had to even get to the point of contacting an executive via LinkedIn despite there being a VDP page / security.txt.
> I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
I would not be so confident in stating that they did not break the law.
And yet similar classes of bugs still pops up today, even with what I would've assumed to be safe defaults? I'm guessing its non-standard databases or DB clients or something?
This case is more just a pure lack of sanitisation, but it's fascinating to see in 2025 still :)
I've not had this done to me in Australia since late 90s early 00s. These days all it takes is a simple tap (or chip swipe) to put a temporary Hold[0] that's released on check-out (or next day).
In Asia, they quite often take your CC details and enter it into a text field in their own system in case they need to process it later, including the CVV. Sometimes they're writing it down on paper.
They're not entering it into a PCI compliant system where the digits are masked.