[deleted]
Ask HN: Maybe found huge security problem, unsure what to do
11–20 of 52 posts
Re: Ask HN: Maybe found huge security problem, unsure what to do
#12When it comes to vulnerability reporting and/or disclosure, there are two schools of thought; "responsible disclosure" and "full disclosure". Unfortunately, what "full disclosure" and "responsible disclosure" actually mean can vary a whole lot. For example, some define "full disclosure" as immediately publishing/disclosing the vulnerability and/or with working exploit code, but more level-headed folks define "full di…
Thank you so much for this. (xpto123 as well). I tried calling but just got bounced around and I'm not sure anyone actually understood/cared. I've got a nice early season cold going so not really interested in sitting on the phone for hours so I've given up on that. I'm going to email blast as many of the emails I can get and if I don't hear anything back from them by Monday I'll pass it onto CERT.
1) Be careful, people who submit proof-of-concept exploits to websites have been arrested for circumventing digital security measures.
2) It's HIGHLY unlikely that you are the first person to discover this, especially if it's a top 100 site. Those sites are constantly probed by attackers looking for exploits precicely because they are so valuable. Something like XSS due to unsanitized input would he found quickly as there are automated tools that do exactly that. Just report it to CERT, as suggested.
3) You may have hit a honeypot.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#13Once you get the bugs fixed, kill the curiosity and disclose the website name. They aren't running their program on BugCrowd or HackerOne, are they?
Re: Ask HN: Maybe found huge security problem, unsure what to do
#14Security bugs are just bugs. Use your own judgement on reporting. And do not make the mistake of violating the law in attempting to test on remote systems (that you may have limited access rights to).
"So I personally consider security bugs to be just "normal bugs". I don't cover them up, but I also don't have any reason what-so-ever to think it's a good idea to track them and announce them as something special."
Linus Torvalds Tue, 15 Jul 2008
Re: Ask HN: Maybe found huge security problem, unsure what to do
#15[deleted]
Re: Ask HN: Maybe found huge security problem, unsure what to do
#16Earlier quoted context omitted.
Thank you so much for this. (xpto123 as well). I tried calling but just got bounced around and I'm not sure anyone actually understood/cared. I've got a nice early season cold going so not really interested in sitting on the phone for hours so I've given up on that. I'm going to email blast as many of the emails I can get and if I don't hear anything back from them by Monday I'll pass it onto CERT.
1) Be careful, people who submit proof-of-concept exploits to websites have been arrested for circumventing digital security measures. 2) It's HIGHLY unlikely that you are the first person to discover this, especially if it's a top 100 site. Those sites are constantly probed by attackers looking for exploits precicely because they are so valuable. Something like XSS due to unsanitized input would he found quickly as…
A couple of years ago in Australia a security consultant noticed that firststatesuper.com.au had a gaping security hole in that he could manually change an ID in the URL and gain access to other users' account information.
He kindly notified First State like any good samaritan, and so what do First State do in return? Disable his account, report the "offence" to the police, demand that their IT dept examine his computer, demanded that he sign a letter to admit liability and threaten to pursue any costs related to the matter.
Luckily the Police had more common sense, realised what had actually happened and decided not to take any action.
Reference: http://www.theage.com.au/technology/security/super-bad-first...
Re: Ask HN: Maybe found huge security problem, unsure what to do
#17With all due respect, most of the replies here are missing the most important point.
Does the company have a bug bounty policy?
No?
Then keep your mouth shut and get on with your life.
A significant percentage of people in power will react to unsolicited warnings of security vulnerabilities by attacking you as though you were their enemy. Worse, the law is at least not clearly on your side. This is not theoretical: people have come to significant harm in this way. Being a hero is great. Being a martyr? Not so much. You don't want next week's top HN story to be an appeal for donations to the legal defense fund of sah88.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#18With all due respect, most of the replies here are missing the most important point. Does the company have a bug bounty policy? No? Then keep your mouth shut and get on with your life . A significant percentage of people in power will react to unsolicited warnings of security vulnerabilities by attacking you as though you were their enemy. Worse, the law is at least not clearly on your side. This is not theoretical:…
This cannot be emphasized enough.
Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore.
If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#19I'd anonymously email and tell them they had 7 days to acknowledge having received your message. After that they get a month or maybe two to fix it. Then public disclosure. All anonymous over Tor, because you can always attach your name later but you cannot remove it if you already gave it.
Or if they don't respond at all, immediate public disclosure. If that's how they want to play the game, then let's play.
Be wary if they ask for your name straight away because companies have been known to sue.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#20With all due respect, most of the replies here are missing the most important point. Does the company have a bug bounty policy? No? Then keep your mouth shut and get on with your life . A significant percentage of people in power will react to unsolicited warnings of security vulnerabilities by attacking you as though you were their enemy. Worse, the law is at least not clearly on your side. This is not theoretical:…
This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore. If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?