(credit: Wired UK/Shuttershock)
The Federal Communications Commission’s website already gets a lot of traffic—sometimes more than it can handle. But thanks to a weakness in the interface that the FCC published for citizens to file comments on proposed rule changes, there’s a lot more interesting—and potentially malicious—content now flowing onto one FCC domain. The system allows just about any file to be hosted on the FCC’s site—potentially including malware.
The application programming interface for the FCC’s Electronic Comment Filing System that enables public comment on proposed rule changes—such as the dropping of net neutrality regulations currently being pushed by FCC Chairman Ajit Pai—has been the source of some controversy already. It exposed the e-mail addresses of public commenters on network neutrality—intentionally, according to the FCC, to ensure the process’ openness—and was the target of what the FCC claimed was a distributed denial of service (DDoS) attack. But as a security researcher has found, the API could be used to push just about any document to the FCC’s website, where it would be instantly published without screening. That was demonstrated by a PDF published with Microsoft Word that was uploaded to the site, now publicly accessible.
FCC has released a statement regarding Ajit Pai and net neutrality. https://t.co/AMzRe1mdLx @FCC @AjitPaiFCC #NetNeutrality @Lucky225 @Hak5 pic.twitter.com/KsVJED6st8
— JON JOLLEE (@h3apspray) August 31, 2017
Other researchers reproduced the vulnerability on August 30, posting about their findings to Twitter. Because of the open nature of the API, an application key can be obtained with any e-mail address.
Read 3 remaining paragraphs | Comments
Source: Ars Technica – FCC “apology” shows anything can be posted to agency site using insecure API

Duolingo launched an app called Tinycards last year to help you out on subjects other than languages. Unfortunately, it was an iOS exclusive until it came to the web a few months ago. Now, the flashcards app is finally available on Google Play, givin…



After dropping the idea for the Hyperloop, leaving the development to others, then getting back into the game, Elon Musk is showing a lot more interest in it. He recently held a student competition at his SpaceX headquarters, helping one team hit 201…
Bang & Olufsen never adopt a new technology until it can guarantee that the audio quality is up to its usual high standards. But the firm has moved fairly quickly, by its standards, to build its first pair of in-ear Bluetooth earbuds. The Beoplay…


Taking a screenshot on an Android smartphone can be achieved a number of different ways, but nearly all of them require a number of taps or button presses. However, thanks to a recent update to Google’s AI assistant, that task can now be performed si…

