Reward programme security

[masaccio]

Spotted this today on reward programme security. My favourite bit:

Most significantly, the researchers found a vulnerability in the Points.com global administration website in which an encrypted cookie assigned to each user had been encrypted with an easily guessable secret—the word “secret” itself. By guessing this, the researchers could decrypt their cookie, reassign themselves global administrator privileges for the site, reencrypt the cookie, and essentially assume god-mode-like capabilities to access any Points reward system and even grant accounts unlimited miles or other benefits.

[can2]

That’s utterly amazing. I remember I had to allow third party cookies to buy Hilton points, which shows points.com’s heavy reliance on cookies perhaps.

Thanks for sharing.

[Lady London]

How, precisely, does one do this?

Asking for a friend 🙂