Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Valve and HackerOne: how not to handle vulnerability reports

blog.jakegealer.me

Post reply on HN
Print view View original

91–100 of 162 posts

Re: Valve and HackerOne: how not to handle vulnerability reports

#91

Post by staz »

Saaster wrote: post #25

Companies receive so many "First, you have to be on the other side of this airtight hatch, then you..." reports that anything that looks even remotely like it will just get summarily closed. My personal favorite ones start with some form of "I copied the user's cookies from device A's file-system, and..." Just some suggestion on how to report these kind of things, because there is an actual underlying issue here wort…

> Companies receive so many [...] reports

If only Valve could hire a subcontractor whose task it was to triage and clarify theses reports...

Re: Valve and HackerOne: how not to handle vulnerability reports

#92

Post by zaptheimpaler »

In a way, this is the same problem that we see with tech hiring & recruiting. Most gatekeepers are less technical than the most tehcnical developers they gate-keep, but still necessary because 80-90% of reports(in case of security)/applicants(in case of hiring) are unqualified. Anyone who is qualified enough to screen without false positives can probably get a better job.

Re: Valve and HackerOne: how not to handle vulnerability reports

#93

Post by restingrobot »

kbenson wrote: post #85
restingrobot wrote: post #75

Earlier quoted context omitted.

I don't think you understand. There is no such thing as a "self-signed" CA cert, (its one or the other). This not about money, it's about control. There are many benefits to using a self-signed SSL cert over purchasing a CA one. However, Apple and Android inherently distrust self-signed certs so you have to actually provide the cert directly to ATS/Android OS which involves bundling it within the app, (a messy proces…

I understand, I mis-typed. I meant self-signed cert. That should have been pretty obvious from what I actually posted though. https://store.steampowered.com is the official steam marketplace. It does not use a self-signed certificate. > There are many benefits to using a self-signed SSL cert over purchasing a CA one. I'm sure there are (not that any are immediately coming to mind), but this is the official web market…

I'm not a valve developer so I can't tell you exactly what is happening, but you most certainly can serve different certificates to browser vs mobile. The apps are using WebViews which are not the same as Chrome and Mobile safari. It would make sense to us a CA cert for normal browser traffic as it is fairly sandboxed as far what you can and cannot do, the WebViews are a completely different environment.

Again I'm saying this based on real world experience with why someone would use http instead of https, so my point is just a guess. I might be giving Valve too much credit and trying to explain something that is just a mistake. I am basing my theory on the fact that the http endpoints immediately re-direct to https ones, so it seems to be intentional for one reason or another.

Re: Valve and HackerOne: how not to handle vulnerability reports

#94

Post by restingrobot »

detaro wrote: post #87
restingrobot wrote: post #82

Earlier quoted context omitted.

It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.

What doe cookies and metadata have to do with certificate validation?

The http link could theoretically be serving the cert to the device. I'm not sure WHY they would do this, just guessing. However, the redirect makes it seem intentional for whatever reason.

Re: Valve and HackerOne: how not to handle vulnerability reports

#95

Post by restingrobot »

odensc wrote: post #88
restingrobot wrote: post #61

>For a simple MITM exploit that can be fixed by replacing " http://" with " https://" , this is simply unacceptable. I think the author is really not understanding the complexity of updating to an https:// url inside of a mobile applicaiton. Valve is most likely using a self signed cert so that would require bundling the certification in with the app so that Apple/Android allowed it to load inside of a webview. This…

Steam is not using self-signed certs. store.steampowered.com is their main user-facing storefont. Why would they "most likely" be using a self-signed cert? That would be an extreme edge-case in my mind, not the standard.

I meant most likely as in a as to why they do the http to https redirect. I have seen this from several other apps, I don't think its extreme, but my guess is just based on the redirect seeming to be intentional. I should probably have said "this could possibly be because", rather than "most likely".

Re: Valve and HackerOne: how not to handle vulnerability reports

#96

Post by vntok »

kbenson wrote: post #78
vntok wrote: post #20

Earlier quoted context omitted.

> Say you'll be disclosing in 90 days if $company doesn't issue a reply publicly. That's blackmail. An expedient way of getting your door breached.

No, the disclosure is disconnected from payment, so it's not blackmail. Notifying companies is a courtesy, and considered good form. Companies offering rewards is to incentivize this behavior. Researchers releasing vulnerabilities after a time period no matter what is to incentivize companies to actually fix the problems (not just pay to shut up the researcher). Both are useful for a well functioning system of indepe…

That is false. In many jurisdictions, blackmail does not require a financial transaction, merely obtaining something deemed valuable by the blackmailer in exchange for keeping the blackmailee's information private. See [1] for the US:

Whoever, under a threat of informing, or as a consideration for not informing, against any violation of any law of the United States, demands or receives any money or other valuable thing, shall be fined under this title or imprisoned not more than one year, or both.

In cases like this one, "bragging rights" are easy to prove as deemed valuable by the blackmailer: they can bring anything from job prospects to donations from activists to free beers at Blackhat.

[1] https://www.law.cornell.edu/uscode/text/18/873

Re: Valve and HackerOne: how not to handle vulnerability reports

#97

Post by chias »

Cpoll wrote: post #86
dsl wrote: post #57

Earlier quoted context omitted.

I've been on both sides of this, and sadly having HackerOne/BugCrowd as intermediaries often hurts more than it helps. On one hand I've had to sort through the never ending stream of "if you bypass the safeguards first" issues and some guy in India copying and pasting open source vuln scanner reports. I get why people don't want to deal with this and outsource it. On the other hand, I have a legitimate exploit agains…

> No amount of back and forth is going to convince them that leaking commit messages on enterprise accounts is serious apparently. If true, this deserves a write-up. I'm sure a few enterprise accounts might agree, if anyone can see their dev-branch commit named "feature xyz" a month before they announce it.

Joke's on you:

    trying to fix bug
    maybe this?
    fuck
    idk
    idk
    idk
    maybe works
    k ready now

Re: Valve and HackerOne: how not to handle vulnerability reports

#98

Post by pgo »

restingrobot wrote: post #61

>For a simple MITM exploit that can be fixed by replacing " http://" with " https://" , this is simply unacceptable. I think the author is really not understanding the complexity of updating to an https:// url inside of a mobile applicaiton. Valve is most likely using a self signed cert so that would require bundling the certification in with the app so that Apple/Android allowed it to load inside of a webview. This…

What you are saying makes no sense, why does android only accept the self signed certificate when it redirects from http and not for direct https connections. Can you provide a source, a stackoverflow link maybe where this problem is discussed ?

Re: Valve and HackerOne: how not to handle vulnerability reports

#99

Post by hinkley »

Hitton wrote: post #70

>This means 1 of 2 things: >They're trying to get out of paying bug bounty money: I guess this is the more extreme perspective to take here, but considering the whole experience, a definitely possible one. I wasn't here for the bug bounty money, I have work by this point, but if there's some younger child trying to get into security research doing this, this could be enough to massively demotivate them if they were p…

I've had or heard quite a few conversations about patent bounties inside of companies that love patents, and there's a very common rule (that ends up being gamed) that each of the first N contributors gets X dollars, and if more than N authors exist then they all split NX dollars.

Unfortunately such a strategy could also be gamed by a bug bounty. If I split 150% of the bounty between all people who reported the bug within a time interval, I could just tell a buddy who has moved out of town about it and end up with a bit more money between the two of us. Either in exchange for him giving me half his bounty, or by returning the favor later.

Re: Valve and HackerOne: how not to handle vulnerability reports

#100

Post by vntok »

thoraway1010 wrote: post #35
vntok wrote: post #20

Earlier quoted context omitted.

> Say you'll be disclosing in 90 days if $company doesn't issue a reply publicly. That's blackmail. An expedient way of getting your door breached.

The idea that your would get a no knock forcible entry for disclosing a bug is appalling and potentially an indictment of our entire criminal justice system. I'm assuming vntok's legal conclusion and claim of the type of law enforcement response is true (please do not make things up on hackernews). In which case my former support for the police and low and order is SERIOUSLY diminished. You have a non-violent offense…

"Hey, @WhiteHouse, while interacting with your systems with the intent to find security flaws and obtain unauthorized access (I wrote scanners and tools and payloads so you know I really wanted to succeed here), I've found a security flaw that allows me to launch nuclear warheads from my garage in Misouri. I will publish this info online if you don't meet my demands. You have less than a month to comply."

Yeah, that kind of bullshit won't fly in any sane criminal justice system. Now replace "launch nukes" with "download every movie you're working on" or "flash-crashing the stocks market at any time", you'll see that the argument doesn't change: it doesn't fly anywhere.

Post reply on HN