Norman Wexler

This year, I wish you less — less information, less food, less entertainment, less communication, less stimulation. You already have too much of all that, and it stands in the way of your serenity, health, sleep, and creativity. Merry Christmas! ☦️

Give remote code execution to your friends!!! 😊

A 19-year old broke into India's largest high school examination system of 2M+ students a year, the CBSE, and was able to view and CHANGE any students' marks. He responsibly wrote to the team 3 months ago, and it took them 3 days to fix only one of the issues. Today, they took the entire website down. This is a absolute embarrassment. The futures and lives of millions rests in the hands of the utterly incompetent. There is also no mass media reporting on the matter. This topic is close to me because not only is this the education system I went through, but 12 years ago and silently for 5yrs since, I'd written about and reported a much less severe vulnerability allowing me to scrape these results too. More than a decade later, not much has changed. This 19yo, Nisarga Adhikary, wrote a great piece outlining each vulnerability he reverse engineered: - the master password leak - the client-side 2fac / OTP validation workaround - tokenless access to the entire internal app (dashboard, evaluator details, etc) setting dummy browser values - changing any password without knowing the old one - an IDOR vuln allowing you to act as any user and edit exam marks For those interested in a beautiful study in security breaches, this is a must read (link below). If there's any light at the end of the tunnel, it's that a 19yo who never went to college can do things 99% of top engineers couldn't figure out.