How a simple flaw in the Cox Communications website put all its users at risk
Some time ago, the beginner hacker Mark M. Leffer found a critical but easy to find flaw access exploit in the Cox Communication ISP website. Cox Communications, also known as Cox Cable, is an American privately owned subsidiary of Cox Enterprises providing digital cable television, Home Automation services, and telecommunications in the USA. It is the third largest cable television provider in the USA, serving more than 6.2 million customers.<p>Mark notified Cox Communications through email and the Twitter support page, but he did not get any replies and had no luck contacting the technical side of Cox Communications. He did not want to waste time, and he tried to protect the customers they are serving by thoroughly explaining the access exploit in a detailed e-mail and how to fully disclose the exploit.<p>Mark M. Leffer was asked about finding this access exploit.  He said about being generally interested in learning more and training himself to become a better pentester and hacker.  He read an article written about the company Bell having issues protecting pirates from accessing the database. Mark knew that Bell is owned by the same people as Cox Communications, so he decided to try various methods, but with no luck. As the time was passing by, Mark settled for the most simple thing called session swapping. He was able to access his friends account through a simple flaw successfully!<p>None of the huge companies like COX should have these kinds of natural to come around flaws in their website, said Mark. By his means, if he as a beginner hacker can find these access exploits in their website, then imagine an advanced hacker easily finding such easy to find exploits and actually having the wrong intentions and further exploiting this and retrieving the database or even a part of it putting many of its users at risk.