Storage Auctions

Storage Battles Makes Huge Security Blunder

Offline luke

  • ****
  • 282
    • View Profile
    • Email
Re: Storage Battles Makes Huge Security Blunder
« Reply #15 on: November 26, 2014, 10:05:48 AM »
Upon additional analysis of the email addresses showing, that's the name the person choose as their user ID.  Those people are just idiots who did that.

Now here's the fun part, but I'm sure Jim already knows this cause he has an ACE *Security Adviser* cough.

Say I want to win an auction, or try to snipe it, in the final minutes and I know the bidder I'm up against and their Internal ID used by storage battles.

storagebattles.com/profile/?logmeout=please&loid=XXXXX

Just replace the "XXXXX" with the ID you want to log out, set it as a loop to prevent that user from logging in and bidding, until the auction is over.

Lets say an employee at SB provides the complete list of ID and user names to a person or a friend that's interested in a unit. Then they can exploit it.  Let's say a person got a friends ID from just looking at the html, while his friend was logged in and jotted it down.

He still hasn't fixed the SSL issue when logging into or creating a new account..

 


Re: Storage Battles Makes Huge Security Blunder
« Reply #16 on: June 28, 2015, 10:55:04 PM »
Anything in the internet is no longer considered private – I think everyone knows that. But for anyone who is able to make a ‘guess’ on how to find out personal information given the initial email to re-register in the new website, I think that is dangerous and it compromises the trust of everyone. Has anyone followed up on this so that there is no further compromise being done? The fact that you can search users’ email addresses, and with the re-registration instruction, that can make anyone log on to anyone’s account!


xx
Huge Storage Vault Auction Coppell Texas

Started by PitzerAuction

3 Replies
3034 Views
Last post November 15, 2012, 07:22:15 PM
by PitzerAuction
xx
Which online storage auction service's business model makes more sense?

Started by Travis

11 Replies
2254 Views
Last post September 26, 2014, 12:48:49 PM
by auctionguy
xx
HUGE lot of ULINE Cold Packs ?

Started by zbert2131

3 Replies
3613 Views
Last post May 10, 2011, 02:48:50 PM
by zbert2131
xx
Storage Battles Named SBOAlliance Preferred Partner for Online Storage Auctions

Started by StorMe

7 Replies
2905 Views
Last post July 05, 2013, 11:04:12 AM
by Travis