How three hackers got their hands (accidentally) on Max Verstappen’s passport
How it began
The three security researchers in this story are Ian Carroll, Sam Curry and Gal Nagli. They have been involved in detecting digital leaks for years. They do so not only to make money, but also to help organizations better secure their systems. While visiting a Formula One event, they got the idea to take a look at how well the FIA’s online environment was protected. Not out of malicious intent, but purely out of professional curiosity.
The discovery
The hackers created a test account on an official FIA platform intended for drivers and teams. There, for example, drivers can upload their data to apply for their so-called super license – the “driver’s license” needed to race in Formula One. The platform seemed innocent enough: you fill in some information, upload documents, and wait for approval.
But when the hackers studied the system a little more closely, they discovered something that didn’t belong. The Web site didn’t properly verify that someone logged in actually had the rights they claimed. By modifying a few lines of code, they were able to give their account more power – literally. Within seconds, they were administrator (“the boss”) of the system.
Sudden access to everything
With those new permissions, they could suddenly see all the data of drivers registered in the system. From e-mail addresses and phone numbers to driver’s licenses, resumes and even passports. When they saw that
FIA’s response
The investigators immediately reported the leak to the FIA via e-mail and LinkedIn. The organization responded the same day and took the system offline. Within a week, the leak was plugged and the hackers received confirmation that the problem had been fully fixed. Now – a few months later – they may make their story public – without too sensitive details, of course.
Header photo: Red Bull Contentpool