Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Happens When You Send a Zero-Day to a Bank?

privacylog.blogspot.com

Post reply on HN
Print view View original

191–200 of 454 posts

Re: What Happens When You Send a Zero-Day to a Bank?

#191

Post by walrus01 »

rabidonrails wrote: post #43
wyldfire wrote: post #38

Lesson learned: when reporting a vulnerability, record all discussions from first contact with the vendor. At least in cases where the vendor doesn't have a clear, easy to find policy and/or bounty for disclosures. I think it's totally fair to reject an NDA but I don't blame him for fearing an overzealous reaction on their part. Even being on the right side of criminal and civil law, you really do have to be willing…

I believe that you'd need to tell them that they were being recorded or you could get yourself into trouble. Edit: looks like this could be possible without getting into trouble depending on the state you're in: http://lifehacker.com/5491190/is-it-legal-to-record-phone-ca...

All of Canada is single party consent for recording. If you're the person doing the recording, you've consented, so you are good. Don't assume everyone that speaks English is in the US.

Re: What Happens When You Send a Zero-Day to a Bank?

#192

Post by walrus01 »

smnrchrds wrote: post #175
rabidonrails wrote: post #43

Earlier quoted context omitted.

I believe that you'd need to tell them that they were being recorded or you could get yourself into trouble. Edit: looks like this could be possible without getting into trouble depending on the state you're in: http://lifehacker.com/5491190/is-it-legal-to-record-phone-ca...

Obligatory disclaimer: IANAL It's completely legal to record a phone call in Canada as long as you are a party to that conversation. However I still cannot find an app for my Android phone to do this.

SIP softphone (zoiper, etc) and route calls through an asterisk server you control, which is set to record.

Re: What Happens When You Send a Zero-Day to a Bank?

#193

Post by astrodust »

mseebach wrote: post #174
iamleppert wrote: post #156

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…

There's no analogy - what you're describing is literally a lawyer.

The EFF, ACLU, CBLDF all exist even though they act as lawyers for many people. Safety in numbers, plus trusted reputation.

Re: What Happens When You Send a Zero-Day to a Bank?

#195

Post by ballenf »

lisper wrote: post #11
tdalaa wrote: post #5

Wow. Going on with your life as a C-level executive with this knowledge, as if it's just all good, is just insane. I'm sure they're in the clear personally now, but I can certainly see why they would wanna sell their company fast after gaining this knowledge in 2010.

> I'm sure they're in the clear personally now Don't be so sure. If they didn't disclose this to their buyers they are guilty of fraud. The statute of limitations has probably run out (I don't know which state has jurisdiction here), but delayed discovery rules may apply.

I'm not so sure it's fraud for 2 reasons: 1) how easy it would/should be for the buyer to discover the issue; 2) these transactions generally have very detailed disclaimers / disclosure -- basically making them 'as-is' transactions.

If I were a betting man, I'd bet the buyer knew about the issue and basically didn't care.

Re: What Happens When You Send a Zero-Day to a Bank?

#196

Post by dheera »

iamleppert wrote: post #156

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…

Why didn't they just give him $10K to shut up and then go fix the issue? It would be cheaper than all the lawyer fees.

Re: What Happens When You Send a Zero-Day to a Bank?

#197

Post by dmix »

ballenf wrote: post #195
lisper wrote: post #11

Earlier quoted context omitted.

> I'm sure they're in the clear personally now Don't be so sure. If they didn't disclose this to their buyers they are guilty of fraud. The statute of limitations has probably run out (I don't know which state has jurisdiction here), but delayed discovery rules may apply.

I'm not so sure it's fraud for 2 reasons: 1) how easy it would/should be for the buyer to discover the issue; 2) these transactions generally have very detailed disclaimers / disclosure -- basically making them 'as-is' transactions. If I were a betting man, I'd bet the buyer knew about the issue and basically didn't care.

Yet security researchers go to prison for iterating the ID numbers in a URL to access private profile pages :/

This is negligent. If they are running banking ecommerce infrastructure and are unable to deal with 101 security risks then it is absolutely negligent. The "it is too complex for the average person" isn't an adequate defense.

The only thing is that there has to be someone who lost something of real value for it to go to court as negligence does it not?

Re: What Happens When You Send a Zero-Day to a Bank?

#198

Post by artursapek »

JackFr wrote: post #151
artursapek wrote: post #99

Earlier quoted context omitted.

Martin Shkreli claims to have made a lot of money by shorting pharma companies ahead of their FDA results - he would read their studies and make reasonably accurate predictions as to the outcome.

Shkrelli has shuttered two hedge funds (Elea Capital Management & MSMB Capital Management) when he was unable to cover shorts and put options when the stock price moved away from him. He is also currently awaiting trial for securities fraud. So I would take his comments with a grain of salt.

This is why I said "claims". He no doubt failed at some of his shorts. On a livestream he said he made all the money he still has on his companies, not trading. The strategy is still relevant to the discussion, though.

Re: What Happens When You Send a Zero-Day to a Bank?

#199

Post by jdmichal »

mcbits wrote: post #172
jdmichal wrote: post #154

Earlier quoted context omitted.

First, IANAL but I would be very surprised if beeps alone would be considered a legal notification of recording. Second, those beeps probably exist to reinforce that the audio is unmolested. A beep every 5 seconds means you would have to cut audio in five-second increments, which is not likely to be convenient to whatever segment of audio you actually want to cut.

Apparently the legalese is "recorder warning tone" and it should be a 1400 Hz beep every 15 seconds. https://en.wikipedia.org/wiki/Recorder_warning_tone I mentioned it because someone working for a big organization and making a lot of interstate calls probably hears these beeps all day and would be less likely to protest than if someone verbally announced that they're recording the call.

Interesting... So seeing that it's a federal standard, now I wonder whether it is sufficient notification of recording...

If so, as you point out it seems like an interesting way to avoid having to announce the recording to those not knowledgeable.

EDIT: I don't know how reliable this site is, but it seems to indicate the recording beep is sufficient for notification, but not sufficient for consent, which makes sense.

http://www.justanswer.com/criminal-law/5dj81-question-record...

Re: What Happens When You Send a Zero-Day to a Bank?

#200

Post by lr4444lr »

idbehold wrote: post #140
lr4444lr wrote: post #117

Earlier quoted context omitted.

Yeah, but presumably he'd claim it on an asset in the red, and for a large enough amount of money to be worth risking lying about under oath. Zecco could have the court subpoena the ISP to prove the IP was in use at the time by the defendant.

Of course it was from his IP, the only way the transaction works is if your browser has the proper cookies. The whole vulerability is that all someone has to do is put that into ANY webpage you visit and so long as your browser still had the cookies, the transaction would go though without you needing to do anything.

Good point. IANAL, but I would think burden of proof is still on the claimant that the transaction was fraudulent. If it had happened to multiple users around the same time frame who provably visited a similar set of potentially malicious websites, it might work, but then the company could respond that it's strange he conveniently didn't notice anything on the statements or confirmation of purchase e-mails until the exploit was publicized.
Post reply on HN