Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Happens When You Send a Zero-Day to a Bank?

privacylog.blogspot.com

Post reply on HN
Print view View original

351–360 of 454 posts

Re: What Happens When You Send a Zero-Day to a Bank?

#351

Post by [deleted] »

eric_h wrote: post #269
jxcole wrote: post #225

Earlier quoted context omitted.

While it may be true that in this particular instance the FBI might act benevolently, the idea was that it would be nice if there was an organization you could go to with any zero day bug. Even if the FBI is not mismanaged and always tries to protect Americans, you could easily imagine a scenario where someone reports an exploit to an OS where anyone can remotely install a key logger. The FBI wouldn't be a good organ…

> While it may be true that in this particular instance the FBI might act benevolently Indeed. Didn't the FBI effectively purchase a zero day to break into the iPhone of the San Bernardino shooter? Didn't they also then not disclose said zero day to Apple? There's no way that any LE agency can be trusted with this responsibility; I'm not convinced that it can be done by the federal government at all. EFF seems like a…

[deleted]

Re: What Happens When You Send a Zero-Day to a Bank?

#352

Post by asafira »

jeremyt wrote: post #113

I wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there. https://jeremytunnell.com/2014/12/22/swab-password-policies-...

Are most of these actually still there? The password requirements have changed dramatically in the last 6 months.

Re: What Happens When You Send a Zero-Day to a Bank?

#353

Post by sjy »

__jal wrote: post #101
dublinben wrote: post #31

Earlier quoted context omitted.

Consideration can be as minimal as "your continued employment with this company." It does not have to be any sort of additional dollar amount.

"We won't sue you", however, is not consideration.

It is, especially (but not necessarily) if the person promising not to sue has a valid claim. This is covered in any contract law textbook, but it's an old common law principle so there are plenty of free online sources, too. For example, in the US, see Bennett, 'Forbearance to Sue' (1898) 10(2) Harvard Law Review 113–118 [1]; in the UK, see Kelly, 'Forbearance to Sue and Forbearance to Defend' (1964) 27(5) Modern Law Review 540–545 [2].

[1] http://www.jstor.org/stable/1321438

[2] http://onlinelibrary.wiley.com/doi/10.1111/j.1468-2230.1964....

Re: What Happens When You Send a Zero-Day to a Bank?

#354

Post by charleslmunger »

venantius wrote: post #315
logicallee wrote: post #310

Earlier quoted context omitted.

I'm pretty surprised at this: >For every valid report they get, they get 3 that aren't valid. Because taking the time to write and to submit an invalid report is a total waste of the reporter's time. Reports aren't the type of thing that someone will accidentally say "oh this is a severe vulnerability! here's some cash" even though the researcher has submitted bullshit. So can you talk about "3 that aren't valid" for…

As someone who has been on the receiving end of a bug bounty's mailbox, 3-to-1 sounds about right. We got a ton of invalid "security vulnerabilities" that were essentially either people reporting OAuth as a vulnerability or not understanding how XSS actually worked. Most of these came from teenagers in southeast Asia.

I've also seen lots of reports of some serious vulnerability - "major product X doesn't validate TLS certificates" - where it looks like the reporter forgot they had added their own cert to the OS's trust store.

Re: What Happens When You Send a Zero-Day to a Bank?

#355

Post by platz »

joshuamorton wrote: post #343
platz wrote: post #130

Earlier quoted context omitted.

The response to invalidate is a choice by the bank, not the person who finds the card. Also, that is a single number. It's suspicious/threatening for a non-trivial amount of cards when the presenter also makes demands.

How is "someone has stolen your clients information and likely already sold it to nefarious actors, because otherwise it wouldn't be on the internet anywhere, so you should keep them safe by deactivating those accounts" threatening? I'd be annoyed if my bank didn't do something.

That is a different point. You are changing the party being considered by re-framing it under yourself, a customer, instead of considering it from the point of view of the bank.

Re: What Happens When You Send a Zero-Day to a Bank?

#356

Post by spectrum1234 »

jart wrote: post #344
iamleppert wrote: post #156

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…

There was a guy who got thrown in prison for bringing a vulnerability to the attention of AT&T. He was thrown in solitary confinement for over a year. Then his sentence got vacated. What did he do as soon as he was released from prison? He went on CNBC to argue that independent security researchers should start a hedge fund that short sells the stocks of companies affected by vulnerabilities. https://youtu.be/jxUWRRD…

This is brilliant. And if companies are going to be so resistant this is the obvious solution.

Re: What Happens When You Send a Zero-Day to a Bank?

#357

Post by tjpnz »

A strong argument can be made against revealing your name when disclosing information like this - especially if you're dealing with banks (often litigious and technically illiterate) and even more so if you're in the United States. If I was the OP I would've found a way of reporting this information to the bank anonymously. Possibly followed up with a promise of media disclosure if not fixed in a timely manner.

Re: What Happens When You Send a Zero-Day to a Bank?

#358

Post by alkonaut »

alexbecker wrote: post #280
alkonaut wrote: post #231

I'm not quite following the timeline: why did he end up under an NDA and the too-long wait to get it fixed? Why not say "I'm publishing this on my blog in 30 days so it better be fixed by then"? Would you risk getting in legal trouble for publishing a way to do bank fraud (for example) - assuming you gave some reasonable timeframe for disclosure?

> Would you risk getting in legal trouble for publishing a way to do bank fraud (for example) - assuming you gave some reasonable timeframe for disclosure? Of course you would. The bank would call the FBI and tell them you're hacking the bank, and the FBI would then knock down your door, tear up your house and drag you away. The system would then do everything it could to represent what you did as a crime, and if you…

So basically what's needed is a place to send these notices anonymously and a place to anonymously publish the exploit after responsible disclosure - at least for countries where legislation works like you describe.

I still hope this is not the case in most places outside the US - that is, I hope the responsible disclosure is complete proof you are in fact not hacking anyone.

Re: What Happens When You Send a Zero-Day to a Bank?

#360

Post by i336_ »

iamleppert wrote: post #156

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy woul…

I was thinking of exactly this as I read the article.

In a situation like this I'd probably directly ping taviso or someone else from the Google Project Zero team. Their contact information (email, G+, twitter (DM)) is not impossible to get at.

From there, I could get advice about next steps (the Project Zero team are going to know a few people) or maybe they could run with it themselves (depending on the bug; I don't know what the response would have been in this case).

Post reply on HN