The FCC.gov Website Lets You Upload Malware (or anything) Using Its Own Public API Key
-
The FCC.gov Website Lets You Upload Malware Using Its Own Public API Key | HackerNoon
Somewhat incredibly I am the first tech writer on the planet to break this story, but even more incredibly the FCC lets you upload any file to their website and make that file publicly accessible using the FCC.gov domain.
-
-
This article is so badly written I had to bleach my eyes AND brain after reading it!
-
@kt_ said in The FCC.gov Website Lets You Upload Malware (or anything) Using Its Own Public API Key:
This article is so badly written I had to bleach my eyes AND brain after reading it!
FCC “apology” shows anything can be posted to agency site using insecure API
FCC API could be misused to host malware on FCC's domain.
-
@kt_ said in The FCC.gov Website Lets You Upload Malware (or anything) Using Its Own Public API Key:
This article is so badly written I had to bleach my eyes AND brain after reading it!
The headline is so awful I saw it earlier and I dismissed it as "oh I guess they're building a database of computer viruses. Good for them."
Now that I've taken a second look, the complaint is actually, "they let anybody upload any file and then host it on the SSL-secured FCC domain". Adding the words "malware", "public API key" only confuse the issue. And omitting the extremely important bit, "... and then it's hosted on the FCC.gov website" makes it sound harmless.
Basically, whoever wrote that article is a moron. Ars' headline is a lot better.
