Top all-time · #7983
Ian Carroll
Personal blog · ian.shsecurityother
Ian Carroll writes ian carroll, a personal blog at ian.sh about security. Since 2014, 9 different Hacker News readers have linked it 14 times, most often “Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications”. No feed was found, so read it on the site itself.
I'm the founder of Seats.aero, a site for discovering flights with points and miles. Outside of work, I do security research on bug bounties, transportation, and other interesting areas.
Most-linked posts?
- Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications2 people · 2 mentions · first linked 2025-07-09
- Security concerns with the e-Tugra certificate authority2 people · 2 mentions · first linked 2022-11-17
What Hacker News says?
Seems to be back up now, my site ( https://ian.sh ) was down for a while.
Comment linking /
on “Microsoft Azure Outage”Submitted Bypassing airport security via SQL injection as a story · 2004 points
HN discussion> there were many log lines referencing [EJBCA] Is this link supposed to go somewhere specific, or just to the EJBCA homepage? It currently just points back to https://ian.sh/etugra
Comment linking /etugra
on “Security concerns with the e-Tugra certificate authority”Submitted Accessing Max Verstappen's passport and PII through FIA bugs as a story · 632 points
HN discussionI've read more than just this particular writeup. See also: https://ian.sh/mcdonalds > During a cursory security review of a few hours, we identified two serious issues: the McHire administration interface for restaurant owners accepted the default credentials 123456:123456, and an insecure direct object reference (IDOR) on an internal API allowed us to access any contacts and chats we wanted. Together they allowed…
Comment linking /mcdonalds
on “'123456' password exposed chats for 64M McDonald's job applicants”Submitted MarkMonitor left 60k domains for the taking as a story · 420 points
HN discussionSome Netgear routers even have a built-in (root) telnet server and a command to dump the admin password. https://ian.sh/blog/2014/10/18/netgear-wndr4000-security/
Comment linking /blog/2014/10/18/netgear-wndr4000-security/
on “Hacking the D-Link DIR-890L”Submitted Security concerns with the e-Tugra certificate authority as a story · 157 points
HN discussionSubmitted Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications as a story · 133 points
HN discussionSubmitted CookieMonster: a tool for breaking stateless authentication as a story · 4 points
HN discussionSubmitted Driving in China as a Tourist as a story · 2 points
HN discussionSubmitted Certificate Transparency restrictions soon in effect as a story · 2 points
HN discussionSubmitted Backstage access: an unauthenticated SQL injection in Front Gate Tickets as a story · 1 points
HN discussionSubmitted Exploiting Redash instances with CVE-2021-41192 as a story · 1 points
HN discussion
