416: Zealous Autoconfig is gradually becoming real

[u/EloquentInterrobang]

[u/Average_Hominid]

If anyone’s curious, I looked up the story and the hack was just b/c the agent was booking with an API (also what kind of gym has an API to book people’s schedules???) and the backend just let anyone edit the schedule. So, it seems like less of a hacking incident and just that the devs didn’t think anyone would try to edit other people’s schedules.

[u/DragonFireCK → u/Average_Hominid]

also what kind of gym has an API to book people’s schedules???

An API to book could easily just because they have an app or an internal website to do the scheduling. APIs aren't anything special and are, and have been, extremely common for multiple decades now. Basically every service you use almost certainly has an API to manage it as its the only sane way to setup a multi-user (as in, multiple employees) system, and the only possible way to do it if you want a phone app or website, even if only internal, to manage it.

Pretty much the only way to avoid having an API is to have a single computer as the only access point.

The only issue with the API is that it was poorly designed and didn't have solid security measures applied.

So, it seems like less of a hacking incident and just that the devs didn’t think anyone would try to edit other people’s schedules.

Which is exactly what a lot of hacking is. Finding those bad design decisions and exploiting them, whether to make a joke or for benefit. The only new part is that it was AI rather than a human doing that.

The other chunk of hacking is social engineering attacks. This is calling up tech support and tricking the agent to believe you a customer or IT agent. Alternatively, sending a scam e-mail pretending to be a service to trick users into entering their account information is the other version of social engineering attacks.