Fun fact: I was able to access a bunch of employee admin screens in early 2015 because of the client side architecture of the app. I noticed around a year later the architecture had changed and always wondered if my article had a role in the transition

http://nathanmock.com/archives/how-i-accessed-employee-setti...

OP here, 10 free promo codes! http://redeemco.com/g/metareader_8jmx/ Thanks for your feedback!

Wish this was during SXSW!

I accidentally stumbled upon employee admin screens, all by changing a key, isAdmin = true. https://news.ycombinator.com/item?id=9121004

That is by definition not accidental.

Yeah, I definitely would not do that to a 3rd party system without a specific letter of engagement for penetration test or security review. Now, that being said, it's the first thing I would tell every single developer about as a senior developer and I would insist that test cases be written to verify that no such 'feature' was permitted into the application.

Should I consult with my lawyer before manually entering an address into a browser? I could easily make a mistake that would allow me to access the wrong page.

Heck, if we're being that careful maybe I should just throw my computers out the window. A Google search result or a forum post could link me to the wrong page and I could get sued.

That is more of a debug menu.

Because it's just the UI, you can't actually use it without an admin account. It's really not an issue at all.

This is a good point, but there should be more awareness towards the issue as a whole. I've seen many apps who expose data dangerously. Some developers may not be aware that these values are exposed (even with SSL), so they should architect their apps accordingly, reinforcing the fact that you should never trust the client. I also briefly touch on the fact about this dynamic architecture and some of the implications it brings.

You mean throwing up a Meteor app with a direct db feed and no fine grained security at the server side can lead to exploits?

Aha! Good point!

Interesting nevertheless, but ultimately not more than a slight reveal of how things look on the inside.

Information leakage is absolutely a security issue.

The information leaked was most probably a few views/menus. He's only tricking the client in to thinking he's an administrator, not the server.

How do you know that he got 8 points?

He's had a few more since, but it is a story submission not a comment, so the vote numbers are public:

"90 points by nathanmock"

Author here: I was able to access employee settings for Uber Technologies, not just employee driver settings.

Very cool. With the same approach were you able to manipulate prices or surge/no surge?

Wouldn't be very useful in real life, but if they have a bug bounty program you could report it.

I don't think this is the case. Setting this "isAdmin" flag simply caused the UI to be rendered. But I'm pretty sure that require any access to the remote API calls will be rejected.

What's to stop me from buying coffee for all my friends as well?

The last paragraph of the article says, "For whatever it’s worth, fiendish subscribers must adhere to at least one limitation: They must wait 30 minutes before ordering another coffee."

Yes, there is that limit –– and a good one. You could get around it maybe if you were with some friends doing a klatsch with staggered drinking rates and drink start times, but then you'd just look really cheap.

you could just ask for an empty cup and split the drink with a friend. then a little bit later, get another one. During a long talk with a friend, you could continue to do that and go through several cups. I don't think a random barista who makes 10 bucks an hour will care, especially if you leave a tip. The owner probably won't care because he makes more money every time you get a cup of coffee.

This is my first open source iOS app. Completed in about 8 hours. Would love to get your feedback. Looking forward to your contributions. Enjoy!

Good observation, now that's attention to detail!