GitHub censored my research data • Hacker News Board

Re: GitHub censored my research data

#51

Post by gorer » Sat, Oct 15, 2016, 6:52 AM UTC

Flimm wrote: post #45

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

Don't you feel uncomfortable in making it harder for users to avoid websites with malicious software? It's definitely worth mentioning and explaining if you do.

Certainly yes, this is why he created new account at HN

Re: GitHub censored my research data

#52

Post by barkbro » Sat, Oct 15, 2016, 6:55 AM UTC

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

According to the article, the stores were running malicious javascript which grabs people's credit card info. This obviously means they are vulnerable in some kind of way, but I fail to see how this is reasonably likely to be exploited. Even if it was, you also have to consider the benefit of warning the users.

I am not a security expert though, and I might be missing out on something.

Re: GitHub censored my research data

#53

Post by ComodoHacker » Sat, Oct 15, 2016, 6:55 AM UTC

Back to the original problem of skimming.

I think the fastest way to get sites fixed is to run a script that crawls sites in the list, parses their Twitter and posts a warning there with link to original article.

Can someone help with that?

Re: GitHub censored my research data

#54

Post by [deleted] » Sat, Oct 15, 2016, 6:55 AM UTC

gwillem wrote: post #40

GL sent me this statement. For the record, I didn't publish vulnerable systems, I published stores that have malware. --- Willem, GitLab has opted to remove the list of servers that you posted in your snippet. GitLab views the exposure of the vulnerable systems as egregious and will not abide it. While GiLab reserves the right take further action, up to and including termination ( https://about.gitlab.com/terms/ ), w…

[deleted]

Re: GitHub censored my research data

#55

Post by jcoffland » Sat, Oct 15, 2016, 6:57 AM UTC

sh1392 wrote: post #39

We at GitLab believe the author did not responsibly disclose this security information in a proper manner, and today we removed the list of hosts in accordance with our terms of service ( https://about.gitlab.com/terms/ ). The author says that he contacted "about 30 merchants directly", but the published list includes over 1000 merchants. Most merchants were neither informed nor given a chance to respond in a timely…

What about the consumers who are being put at risk of being defrauded? Do they not have a right to protection? Malware infected ecommerce sites could be stealing credit card info and robbing consumers. Merchants who endanger consumers by failing to provide a secure platform for digital transactions do not have any right to be protected from having their negligence exposed.

Re: GitHub censored my research data

#56

Post by ChuckMcM » Sat, Oct 15, 2016, 6:57 AM UTC

So it seems the real bug here is that a site that is hosting malware is doing so because its actually vulnerable to being hacked, was hacked, and malware was installed. So posting the site name identifies a vulnerable site (which is wrong) and stops informing people that those sites have malware on them (which is an issue as well).

That is quite the catch 22. And of course many of the sites owners are clueless and don't even know how to patch or fix their systems.

My isn't that that a mess?

Re: GitHub censored my research data

#57

Post by jcoffland » Sat, Oct 15, 2016, 6:59 AM UTC

ChuckMcM wrote: post #56

So it seems the real bug here is that a site that is hosting malware is doing so because its actually vulnerable to being hacked, was hacked, and malware was installed. So posting the site name identifies a vulnerable site (which is wrong) and stops informing people that those sites have malware on them (which is an issue as well). That is quite the catch 22. And of course many of the sites owners are clueless and do…

It's not wrong to expose negligence which endangers others.

Re: GitHub censored my research data

#58

Post by lucaspiller » Sat, Oct 15, 2016, 7:01 AM UTC

I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off.

OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they checked 255k. If that's the case it would be trivial to send an automated email if malware is detected, and include links explaining how to fix it.

It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. What I mean is they probably hired a developer or team to build their website, and assumed that they would build a secure website - they didn't go out purposely and find someone to build them a site that would be hacked.

Re: GitHub censored my research data

#59

Post by zAy0LfpBZLC8mAC » Sat, Oct 15, 2016, 7:04 AM UTC

lucaspiller wrote: post #58

I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they chec…

So, you don't think that if you operate something that is a risk to other people, it's your obligation to reduce the risk? You can just say that you are incompetent at what you are doing, and therefore you shouldn't be shamed for putting other people at risk?

Re: GitHub censored my research data

#60

Post by Animats » Sat, Oct 15, 2016, 7:05 AM UTC

Do this kind of thing on your own domain.

I have a list of major sites with currently active phishing pages.[1] This is basically a join of PhishTank and DMOZ. Nobody seems to be upset by that.

Google is at the top of the list because of their hosting business. It's not just Google Sites. You can put a web site in a Google Spreadsheet cell, which Google doesn't seem to check as a possible phishing site.

If you host for others, or offer a URL shortening service, you need automated checking against all available phishing lists or you will be exploited.

[1] http://sitetruth.com/reports/phishes.html