Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

431–440 of 466 posts

Re: I found a vulnerability. they found a lawyer

#431

Post by bonoboTP »

operator-name wrote: post #375
jdefr89 wrote: post #354

Vulnerability Researcher here… Unless your target has a security bounty process or reward; leave them alone. You don’t pentest a company without a contract that specified what you can and can’t test. Although I would personally appreciate and thank a well meaning security researchers efforts most companies don’t. I have reported 0days for companies that HAVE bounties and they still tried to put me in hot water over d…

This wasn’t a pen test? It was a drive by “oh fuck the platform I’m using is completely insecure”.

You walk past a ministry office and notice that there is nobody at the door checking people entering, you walk in, you find an office door open, many binders on the shelves, nobody present. You read through the binders, pull out the drawers and see private info etc. You then walk out and send a mail about this. What do you think is going to happen?

Re: I found a vulnerability. they found a lawyer

#432

Post by habinero »

DANmode wrote: post #423
habinero wrote: post #217

Earlier quoted context omitted.

Absolutely not. That's not your concern nor your problem. They're perfectly capable of hiring incident response experts, and companies commonly have cyber insurance that'll pay for it. "Demonstrating" is dumb and means you turn an ordinary disclosure into personal liability for you . Blabbing about it on the internet is just the idiot cherry on the stupid cake.

If your goal is to successfully report and resolve, it is your problem. Agree otherwise. In the stories I’ve carefully read, no proof means being ignored by frontline people who are all you can reach, turning an ordinary disclosure into no disclosure at all.

That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.

Re: I found a vulnerability. they found a lawyer

#433

Post by karagenit »

masswerk wrote: post #347
nilslindemann wrote: post #116

AFAIK, what this dude did - running a script which tries every password and actually accessing personal data of other people – is illegal in Germany. The reasoning is, just because a door of a car which is not yours is open you have no right to sit inside and start the motor. Even if you just want to honk the horn to inform the guy that he has left the door open. https://www.nilsbecker.de/rechtliche-grauzonen-fuer-et…

For clarification, here's the actual quote from the article describing the process: > I verified the issue with the minimum access necessary to confirm the scope - and stopped immediately after. No notion of a script, "every password" out of a set of a single default password may be open to interpretation, no mention of data downloads (the wording suggests otherwise), no mention of actual number of accesses (the text…

True, but the article also says:

> That's it. No rate limiting. No account lockout.

To me, if he confirmed that there’s no rate limiting on the auth API, this implies a scripted approach checking at least tens (if not more) of accounts in rapid succession.

Re: I found a vulnerability. they found a lawyer

#434

Post by pr4296 »

bonoboTP wrote: post #431
operator-name wrote: post #375

Earlier quoted context omitted.

This wasn’t a pen test? It was a drive by “oh fuck the platform I’m using is completely insecure”.

You walk past a ministry office and notice that there is nobody at the door checking people entering, you walk in, you find an office door open, many binders on the shelves, nobody present. You read through the binders, pull out the drawers and see private info etc. You then walk out and send a mail about this. What do you think is going to happen?

I think it's more like there's a binder lying in the street outside the ministry office and you pick it up and see that it has private info.

Re: I found a vulnerability. they found a lawyer

#435

Post by RunningDroid »

the_hoffa wrote: post #150
godelski wrote: post #133

Earlier quoted context omitted.

In other industries there are professional engineers. People who have a legal accountability. I wonder if the CS world will move that way, especially with AI. Since those engineers are the ones who sign things off. For people unfamiliar, most engineers aren't professional engineers. There are more legal standards for your average engineer and they are legally obligated to push back against management when they think…

You'd be surprised how many SE's would love for this to happen. The biggest reason, as you said, being able to push back. Having worked in low-level embedded systems that could be considered "system critical", it's a horrible feeling knowing what's in that code and having no actual recourse other than quitting (which I have done on few occasions because I did not want to be tied to that disaster waiting to happen). I…

> 2.) Doing what I wanted would require federal intervention, and the climate has not been ripe for new regulations, let alone governing bodies, in well over a decade.

Unionization could achieve the same end but the propaganda is strong in the US

Re: I found a vulnerability. they found a lawyer

#436

Post by alright2565 »

tracker1 wrote: post #333
alright2565 wrote: post #151

Earlier quoted context omitted.

If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm. For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field: import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}") print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}") MD5: 5f4dcc3b5aa765d61d8327d…

It wasn't done wrong.. A contract requirement for a state deployment required a specific hashing algorithm...

What hash algorithm was required?

Re: I found a vulnerability. they found a lawyer

#437

Post by DANmode »

habinero wrote: post #432
DANmode wrote: post #423

Earlier quoted context omitted.

If your goal is to successfully report and resolve, it is your problem. Agree otherwise. In the stories I’ve carefully read, no proof means being ignored by frontline people who are all you can reach, turning an ordinary disclosure into no disclosure at all.

That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.

Lots of good white and grey hats have used anonymity to report for this exact reason.

Whether or not you feel it’s your concern (or “problem”) depends on your thoughts on moral responsibility to others in your society.

Re: I found a vulnerability. they found a lawyer

#438

Post by DANmode »

habinero wrote: post #432
DANmode wrote: post #423

Earlier quoted context omitted.

If your goal is to successfully report and resolve, it is your problem. Agree otherwise. In the stories I’ve carefully read, no proof means being ignored by frontline people who are all you can reach, turning an ordinary disclosure into no disclosure at all.

That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.

Even if you were selfish: it’s your own data being leaked.

You don’t have to be Batman to want your data secure.

Re: I found a vulnerability. they found a lawyer

#439

Post by joe_mamba »

pjmlp wrote: post #428
joe_mamba wrote: post #394

Earlier quoted context omitted.

Just because you have an engineering degree doesn't mean your code is of better quality and security than someone without an engineering degree. Signed, someone with an CS engineering degree.

It surely means one has the responsibility to be one as such, having had the education that others have not.

Most web dev, gaming jobs don't care about those things, they care if you can ship fast and cheap. There's embedded and safety related SW that need well thought out safeguards but a lot of that slow moving SW has been farmed out to Asia, EE and India.

Re: I found a vulnerability. they found a lawyer

#440

Post by joe_mamba »

pjmlp wrote: post #429
joe_mamba wrote: post #416

Earlier quoted context omitted.

>Now if you mean for own much one is willing to sell themselves to late stage capitalism The government is the one selling you out to late stage capitalism through rampant inflation, business and fiscal regulations and deregulation, offshoring, and various nefarious policies on housing and labor migration. People just adapt to survive by taking the best paying jobs, since voting clearly doesn't help them. Don't tell…

That is the difference between the US mentality of the winner takes it all that has given us late stage capitalism, entshitification and Trump, and most of the world. Quality of life and health matters more than anything else. After a certain point, more money doesn't bring any of that, one is not taking the money into the grave, other than build a mausoleum.

You talk around the issue throwing the blame on others, but you intentionally avoided answering my question, as if you're not part of the problem, and are working for peanuts, virtue signal points and "thank-yous". Sorry but my bank and landlord doesn't accept those, only money and the government makes sure those get more and more expensive.
Post reply on HN