A provocative white hat hacker who has previously disclosed vulnerabilities in both California’s ObamaCare portal and FireEye’s core security product has now revealed a serious flaw in the Council of Better Business Bureau’s (CBBB) Web-based complaints application, which is used by nearly a million people annually to file complaints against businesses.
The CBBB criticized the “unauthorized application vulnerability test” but said in a statement that they believe “the motivation was not malicious,” and are “not pursuing the matter further.”
The CBBB is the umbrella organization for the independent local BBBs, the not-for-profit consumer advocacy groups that operate in the United States, Canada, and Mexico. The BBBs attempt to mediate disputes between consumers and businesses, and also accredit businesses based on how well the business meets the BBB’s “Standards of Trust.”
Independent security researcher Kristian Erik Hermansen discovered the vulnerability while attempting to file a complaint against Verizon. He told Ars the telecoms giant had defrauded a family member and that despite a successful class-action lawsuit against the company, the fraudulent charges were causing the family member credit problems.
“I saw an earlier complaint I filed and noticed the ID numbers were close in proximity,” he told Ars. “Thus, they were likely incremental. Whenever I see integers, I increment, and see [what happens]….Then I attempted to access one report using another ID,” he said, “and it worked, but only if you have a valid cookie / session token.”
Click HERE to read the entire article.
