There should exist a vulnerability disclosure intermediary. They can function as a barrier to protect the scientist/researcher/enthousiast and do everything by the book for the different countries.
Who compensates them for the risk?
I found a vulnerability. they found a lawyer
101–110 of 466 posts
Re: I found a vulnerability. they found a lawyer
#102> the portal used incrementing numeric user IDs > every account was provisioned with a static default password Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.
Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers.
* account ids are numeric, and incrementing
* included in the URL after login, e.g. ?account=123456
* no authentication on requests after login
So anybody moderately curious can just increment to account_id=123457 to access another account. And then try 123458. And then enumerate the space to see if there is anything interesting... :face-palm: :cold-sweat:
Re: I found a vulnerability. they found a lawyer
#103This is somewhat related, but I know of a fairly popular iOS application for iPads that stores passwords either in plaintext or encrypted (not as digests) because they will email it to you if you click Forgot Password. You also cannot change it. I have no experience with Apple development standards, so I thought I'd ask here if anyone knows whether this is something that should be reported to Apple, if Apple will do…
I used to say "submit it to Plain Text Offenders: https://plaintextoffenders.com/", but the site appears defunct since… 2012‽ How time flies…
Re: I found a vulnerability. they found a lawyer
#104There should exist a vulnerability disclosure intermediary. They can function as a barrier to protect the scientist/researcher/enthousiast and do everything by the book for the different countries.
Who compensates them for the risk?
That's why you just sell it on the black market and let it be the intermediary.
Re: I found a vulnerability. they found a lawyer
#105This is somewhat related, but I know of a fairly popular iOS application for iPads that stores passwords either in plaintext or encrypted (not as digests) because they will email it to you if you click Forgot Password. You also cannot change it. I have no experience with Apple development standards, so I thought I'd ask here if anyone knows whether this is something that should be reported to Apple, if Apple will do…
FWIW, some types of applications may be better served with encryption over hashing for password access. Email being one of them, given the varying ways to authenticate, it gets pretty funky to support. This is why in things like O365 you have a separate password issued for use with legacy email apps.
Re: I found a vulnerability. they found a lawyer
#106> vulnerability in the member portal of a major diving insurer What are the odds an insurer would reach for a lawyer? They probably have several on speed dial.
What makes you think they don't retain them in-house?
Depends on the usage... in-house counsel may open up various liabilities of their own, depending on how things present.
Re: I found a vulnerability. they found a lawyer
#107Since the author is apparently afraid to name the organisation in question, it seems the legal threats have worked perfectly.
Maybe.
Or maybe they took what they know to sell to the black hats.
Re: I found a vulnerability. they found a lawyer
#108Earlier quoted context omitted.
> These are the sort of things that are supposed to lead to commendations and promotions. Maybe I live in fantasyland. I had a bit of a feral journey into tech, poor upbringing => self taught college dropout waiting tables => founded iPad point of sale startup in 2011 => sold it => Google in 2016 to 2023 It was absolutely astounding to go to Google, and find out that all this work to ascend to an Ivy League-esque emp…
> A horrible design flaw that made ~50% of users take 20 seconds to get a query answered was buried, because a manager involved was the one who wrote the code. Maybe not when it is as much as 20 seconds, but an old manager of mine would save fixing something like that for a “quick win” at some later time! He would even have artificial delays put in, enough to be noticeable and perhaps reported but not enough to be ma…
There is a term for this but I can't remember what it's called.
Effectively you put in on purpose bugs for an inspector to find so they don't dig too deep for difficult to solve problems.
Re: I found a vulnerability. they found a lawyer
#109[dead]
Reply: "sorry, before reaching out to you I already notified a major media organization with a 90 day release notice"