Here’s the Netflix account compromise Bugcrowd doesn’t want you to know about [Updated]
Updated 3/23/2020: A Netflix spokeswoman said that the dismissal of this bug report on the grounds it was out-of-scope was a mistake on the part of the company. The company has since confirmed the validity of the report and began rolling out a fix on Friday. The spokeswoman said that the researcher will receive a bounty, although she didn't say how much it will be. What follows is the original Ars report:
A Netflix security weakness that allows unauthorized access to user accounts over local networks is out of the scope of the company's bug bounty program, the researcher who reported the threat said. Despite dismissing the report, the Bugcrowd vulnerability reporting service is trying to prevent public disclosure of the weakness.
The researcher's proof-of-concept exploit uses a classic man-in-the-middle attack to steal a Netflix session cookie. These browser cookies are the equivalent of a wristband that music venues use so paying customers aren't charged an entrance fee a second time. Possession of a valid session cookie is all that's required to access a target's Netflix account.
Read 16 remaining paragraphs | Comments