Websmart, Inc. and 100,000 Vulnerable Websites
samsclass.info
Websmart, Inc. and 100,000 Vulnerable Websites
1–10 of 74 posts
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#2Imagine if the local news outlet did a "consumer watchdog" piece on a contractor going around installing windows or doors in homes and businesses with locks that can be easily opened without a key. Then imagine the contractor acknowledged the issue but threatened to sue the news outlet for hurting their business.
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#3What an idiot, he could have reacted with gratitude and done his part to convince his customers that he would make the situation right.
Instead, he's opened himself up for a flurry of negative attention not only from the public but from the unethical hacking community.
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#4I appreciate that the guy's attitude is just awful, but the author really should have given him a chance to respond/react before contacting his clients. Doing so doesn't preclude notifying them eventually. It's just common courtesy.
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#5Contact the vendor, give them time to fix it. Wtf are your contacting his customers?
Sam, you are truly a moron.
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#6Re: Websmart, Inc. and 100,000 Vulnerable Websites
#7Contact the vendor, give them time to fix it. Wtf are your contacting his customers? Sam, you are truly a moron.
It doesn't seem that he felt like taking any action since 2010
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#8I find Websmart's attempt at trying to put this man out of a job absolutely disgusting. No doubt, Sam Bowne will think twice before reporting vulnerabilities next time. Even though I'm not in any way related to this incident, I've send Sam a thank you note because I think the web community needs more people like him. If you want to do the same, his e-mails are in the link, but for ease of access: sam(dot)bowne at gmail, sbowne at ccsf(dot)edu .
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#9This is all fine and dandy but I actually find the approach taken by the professor in the first email to be quite unfriendly and perhaps even unprofessional. The guy from Websmart is actually right, there was no need to immediately contact his customers directly. You let the vendor handle the delicate subject with their customers and then take action directly (with a public disclosure) only if the vendor ignores you.
Re: Websmart, Inc. and 100,000 Vulnerable Websites
#10Rule #1 - Don't be an asshole.
You found a vulnerability in lots of sites so you contacted the vendor who was responsible for it. Cool. They replied and said they would fix it.
Going around and e-mailing their customers is kinda odd. Sure it may result in you feeling great but in the end the customers probably don't have a clue. Better to be mature about it and contact the vendor (who actually responds!)
If they stop responding or tell you to peeter off, then it might be reasonable to do some type of disclosure. But not before you actually give them a chance to respond.