Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

My twitter stream is now full of people, some of whom I am sure do not have the skill to evaluate if something is a JavaScript security threat or not, who have copied and pasted a random script they read on the internet into the developer console. Granted, this one is pretty simple and easier to evaluate than most, but still… you really get why Facebook hacked the console to warn people not to do that.

edit: This tweet said exactly what I was thinking when I saw all of this. https://twitter.com/s_m_i/status/493609377958723584

"Also this uber thing shows folks will copy and paste commands they don’t understand without a second thought if the incentives are right"



It's just phishing via web console. You can convince humans to do just about anything for the right incentive.


What's the worst that could happen?


Ordering an expensive car ride, presumably.


Grabs your account information and sends it along to the hacker.


Yikes...

     >window.Uber.pingData.client.paymentProfiles

     [
     Object
     cardExpiration: "2014-03-01T00:00:00+00:00"
     cardExpirationEpoch: 1393632000000
     cardNumber: "[last 4]"
     cardType: "MasterCard"
     id: [payment id]
     useCase: "personal"
     uuid: "[uuid of payment option from their system]"
     __proto__: Object
     ,
     Object
     accountName: "[acct number]"
     billingCountryIso2: "US"
     billingZip: "[billing zip]"
     cardExpiration: "2017-09-01T00:00:00+00:00"
     cardExpirationEpoch: 1504224000000
     cardNumber: "[last 4]"
     cardType: "Visa"
     id: [payment id]
     tokenType: "braintree"
     useCase: "personal"
     uuid: "[uuid of payment option from their system]"
     __proto__: Object
     ]


XSS?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: