all 43 comments

[–]insomniasic 30 points31 points  (9 children)

Bring this to the attention of someone higher.

[–]babysharkvic_au[S] 8 points9 points  (8 children)

You mean the uni?

[–]Imperial_Swine 15 points16 points  (3 children)

Probably the press at this point?

[–]babysharkvic_au[S] 10 points11 points  (2 children)

I'll give it a go :)

[–]StayAwayFromTheAqua 1 point2 points  (1 child)

Careful, the likely response you will get is to be accused of being a hacker and the Feds will be notified of your 'hacking'.

[–]auscompgeek 2 points3 points  (0 children)

Responsible disclosure would've been best: have a reputable journalist (such as Ben Grubb from SMH) report this to the company anonymously on your behalf. That way they can't report you to the feds.

[–]MrRoyaleWithCheese 9 points10 points  (3 children)

Well it's not gonna get much attention here

[–]babysharkvic_au[S] 9 points10 points  (2 children)

I'd be surprised if not- chances are if you went to uni at the UNSW and attended any event, your details are there. Name, date of birth and mobile are enough for a wealth of social engineering hacks...

[–]DLLM_wumao 7 points8 points  (1 child)

This is a mandatory notifiable breach. If your uni doesn't escalate, they're going to be explaining their unlawful conduct to the AIC in a few weeks.

PM me if you want to talk about how to proceed.


[–]henry82 2 points3 points  (0 children)

If your uni doesn't escalate,

is this a uni website? or its just advertised at uni

[–]ManwithaTan 27 points28 points  (0 children)

Holy shit, this is really important man. Definitely see if you can get this to news outlets.

[–]Godly_Shrek 21 points22 points  (0 children)

umm class action lawsuit when? i need to pay off my HECS

[–]Sayfog 4 points5 points  (6 children)

So the schema request is currently giving a 403, what was in it, specifically the schema, before? Password hashes? Addresses? Any more details besides what was leaked via the web json?

[–]babysharkvic_au[S] 7 points8 points  (1 child)

Hmm their app is showing me undefined errors now, I think they might have shut down their services.

The SQL injections started off with usual stuff (like 9999' or (select count(*) from INFORMATION_SCHEMA.tables as sys1,INFORMATION_SCHEMA.tables as sys2,INFORMATION_SCHEMA.tables as sys3,INFORMATION_SCHEMA.tables as sys4,INFORMATION_SCHEMA.tables as sys5,INFORMATION_SCHEMA.tables as sys6)=0 or '0'='9999) but then it looked like it got more specific over time (I saw queries for cc_token, lst4digit, and some others)

[–]Sayfog 2 points3 points  (0 children)

Hmm okay, I'm just trying to figure out what data I could have put on there (and therefore been leaked). Hopefully the whole CC and addresses (can't remember if I ever had to put mine in) haven't been dumped.

[–]babysharkvic_au[S] 1 point2 points  (3 children)

I didn't want to go as far as re-enacting those SQL injections, but if I was a malicious actor, its basically follow-the-breadcrumbs until you had raw access to the database it looked like :/

[–]JustAThrowawayAcctL 4 points5 points  (2 children)

It requires a usertoken now to perform the requests, I can still see all the sqli attempts, but the phone numbers / emails are hidden for me and replaced with `123456789` and `********@useget.com`

[–]babysharkvic_au[S] 1 point2 points  (0 children)

Better than nothing, but cats out of the bag. The more concerning bit is the SQLi attempts- if they were successful, its unknown amounts of data that are out in the wild (not to mention the low hanging fruit of all the phone numbers, emails, name, etc they surely saw on their way to the SQLi attempts)

[–]ayyythrowaw 0 points1 point  (0 children)

Gee looks like they've just killed functionality of the service in order to "patch" this...

[–]groovypidgey 4 points5 points  (0 children)

Their systems are so vulnerable.

If you know someone's email address that had went through Qnect before, you could easily get into their account. Seems to be applicable if you previously transacted with them through Qnect, but never created an account when they rebranded to Get.

So simply sign up again using that same email address, but use a new number.

You'll get presented to a screen with the existing phone number linked to their email address for a OTP. The OTP will be sent to the new number you input however. Input the number, then you'll get a message saying wrong number. Back out and get back in.

You'll then have that OTP screen come up again, but with the new number you used to sign up. Enter the next OTP that comes to you, and voila you're in.

[–]mysakh 4 points5 points  (0 children)

There should be criminal law institutionalised against privacy negligence.

[–]Jackdchemist 4 points5 points  (2 children)

Here's a thought...Why don't you send an email to UNSW IT support so their cybersecurity teams can have a look at it

[–][deleted]  (1 child)


    [–]akkatrackerCommerce/Engineering 3 points4 points  (0 children)

    To be fair, given the recent ANU data breach - most GO8 unis would care, especially when student ID's and other info are leaked.

    [–]AppleShark 1 point2 points  (0 children)

    I won’t be surprised. I worked with them a few years ago and know the founders personally, they’re great people but the app has much to improve.

    [–]WunderTechComputer Science 1 point2 points  (1 child)

    OP do you have any of the data in the data leak? Is there any way I can check if my details or any other's details were in there?


    Na sorry, I didn't want to keep a copy of the data, it seemed too sensitive to keep a copy of. I've tried reaching out to Get to ask them to make something that lets people type in some details and get a 1-way confirmation of any leak, but haven't heard back...

    [–]eatmebunny 1 point2 points  (6 children)

    Didn't Get suffer a breach earlier this year? I got an email from Qnect (another society ticketing service) warning about one in June.

    [–]ayyythrowaw 0 points1 point  (5 children)

    [–]babysharkvic_au[S] 1 point2 points  (1 child)

    Yeah, they were hacked last year and rebranded to Get from Qnect, so even more surprising this data is so public after going through something like that :/

    [–]DarkMoon99 0 points1 point  (0 children)

    I guess they give zero fucks about protecting people's data, and max fucks about collecting the $$$. 😐

    [–]eatmebunny 0 points1 point  (2 children)

    Ah yep I misrecalled, turns out QPay (a similarly named company/competitor) notified me of a potential breach since they partnered with Get/Qnect.

    [–]akkatrackerCommerce/Engineering 2 points3 points  (1 child)

    Hey there :)

    I'm an ambassador for QPay, and while we did send out an alert, we have never been breached or set up any direct partnership with Get/Qnect.

    The confusion can arise when societies use QPay for one service (i.e. memberships) and then use Get for another (i.e. events). In this way, they export the data from QPay and import it into Get.

    The email(s) you are referring to was when QPay proactively reached out to users to let them know of the breach (both times, now and when they were Qnect) alerting them to the leaks so that they were aware our privacy policies and data protection do not apply to this exported data and to be wary of anyone purporting to be QPay maliciously in the wake of the hacks.

    [–]LifeProfessor11 0 points1 point  (0 children)

    I'm an exec and thats what I understood from the email we got from QPay...

    [–]fivedollarsanhour 0 points1 point  (1 child)

    is there a way for me to check if my data is there?

    [–]groovypidgey -1 points0 points  (0 children)

    If Troy Hunt has the data then you could check haveibeenpwned.com (doesn't seem so at this stage)

    [–]perseustree 0 points1 point  (1 child)

    How do I check if my data has been included in the leak? Can you give me a pointer on how to use Get website? Thanks

    [–]TheGamerWithMore 0 points1 point  (0 children)

    Wait for Troy Hunt's Have I Been Pwned website to email you.

    [–]therealkenkaniff 0 points1 point  (1 child)

    Looks like the endpoint now returns masked email/phone numbers for users: https://imgur.com/a/UwV0VyM

    [–]imguralbumbot 0 points1 point  (0 children)



    Source | Why? | Creator | ignoreme | deletthis

    [–]Jam-K -2 points-1 points  (1 child)

    Seems to me that if you were really concerned with protecting this data, you should have waited for the university to contact you and make it secure before posting a detailed account of how to get it on a public forum?

    [–]mugg74 0 points1 point  (0 children)

    Just how would the uni know who to contact?

    It's not their data, it's the data of a company set up by ex students. This nothing to do with the uni.

    The data is collected and held by the company using the company's system not the university.

    It would be a further breach of the data for the company to provide such data to the university for such notification.

    As the company provides services to student clubs at multiple universities just which uni should do the notification anyway?

    [–]houdeanie01 -2 points-1 points  (0 children)

    If this is a unsw society would recommend contacting Arc clubs people or something (i think they manage the clubs)