Password leak puts online radio stations at risk of hijack

(graphic: file image)

A password leak vulnerability in a well-liked broadcast platform may allow hackers to hijack online radio stations.

The protection flaw makes it possible for any person to show the plaintext admin account and password for basically any radio station hosted on SoniXCast, a new York-primarily based on-line broadcast website, boasting over 50,000 terrestrial and web radio stations on its network.

The website’s API can also be trivially exploited to expose passwords to radio stations hosted by the company. The passwords can be used to log in to the provider, replace debts, and benefit full manage of the radio station. A hacker might even adjust the broadcast settings, permitting anything to be broadcast over the airwaves.

“that you can hijack a station. If it be a spiritual station you might air profanity. If or not it’s a news or financial station you might air fake information or false stock information,” stated Roger Hågensen, who discovered the flaw, in an e-mail to ZDNet.

“reckoning on how huge/conventional a station is this might have larger ramifications,” he stated.

To determine the bug, Hågensen provided ZDNet with several screenshots and are living hyperlinks that confirmed exposed data.

Hågensen mentioned the worm to the company in may additionally. piece of email viewed by ZDNet showed that the company noted it deliberate to repair the vulnerability. but some station credentials might still be seen on the website at the time of writing, which is why we’re now not revealing specifics.

in its place of fixing the worm, SoniXCast owner Brian Walton accused Hågensen of “nefarious intentions” and said he would file the vulnerability disclosure to native land safety.

In emails, Walton pointed out Hågensen as an “smug, pushy individual” for his persistence in reporting the vulnerability, which become deemed a “low priority” construction issue.

Troy Hunt, who runs breach notification website Have I Been Pwned, talked about the company’s response to the liable disclosure became “disappointing.”

“it be simple that firms are receptive of vulnerability stories and take them as an opportunity to enhance their own safety posture rather than proverbially shooting the messenger,” Hunt informed ZDNet.

“The vulnerability is rarely that unusual in that it comfortably amounts to a right away object reference; an identifier is exposed publicly which ties to an individual useful resource — during this case a station being broadcast — and there are insufficient entry controls keeping that aid,” he talked about.

regarding OWASP’s leading net software security risks, Hunt stated the vulnerability continues to be ranked because the fourth most important chance on the web today.

Walton didn’t reply to a request for comment.

Latest topics for ZDNet in Security