Similar to this, I recently found out I could put an iframe in the Dreamhost admin panel if I put it as a TXT record for a domain. It screws up the page, but I'm not sure I can get to actually load the iframe; seems to do a half-job of sanitizing the input. I pulled up the online chat feature and told them about the problem; I don't know if they did anything yet.
Ask HN: Maybe found huge security problem, unsure what to do
21–30 of 52 posts
Re: Ask HN: Maybe found huge security problem, unsure what to do
#22Always conduct business like this anonymously. Public WiFi, separate browser, pastebin, free email provider, public forum.
Give them 28 days, then pastebin it and stick on reddit.
But now you can't do a thing because they know who you are and will sue you so forget about it and stop using their products.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#23Just move along and don't use the website. The computer fraud and abuse act is not a joke.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#24Earlier quoted context omitted.
Thank you so much for this. (xpto123 as well). I tried calling but just got bounced around and I'm not sure anyone actually understood/cared. I've got a nice early season cold going so not really interested in sitting on the phone for hours so I've given up on that. I'm going to email blast as many of the emails I can get and if I don't hear anything back from them by Monday I'll pass it onto CERT.
1) Be careful, people who submit proof-of-concept exploits to websites have been arrested for circumventing digital security measures. 2) It's HIGHLY unlikely that you are the first person to discover this, especially if it's a top 100 site. Those sites are constantly probed by attackers looking for exploits precicely because they are so valuable. Something like XSS due to unsanitized input would he found quickly as…
I'll add to this. Be careful in the future. You stated that you are an amateur at this and aren't entirely sure on what to do. That's the quickest way to set yourself up for some long term hurt.
The problem is, when you start poking at server-side flaws as opposed to ones that might exist in applications you run client side like mobile apps, you are entering some very dangerous territory as you are engaged in what is generally considered to be hacking someone else's infrastructure. In the last few years a lot of people in the security community have been probing sites for XSS, SQLi and many other server side vulnerabilities but they are doing so at fairly high risk and as such many use multiple techniques to remain anonymous. All it takes is someone on the receiving end to decide to call the FBI and it doesn't matter how good your intentions were, your life is most likely going to change. I've seen this happen first hand to people I know. One guy I know reported an XSS flaw, offered to help fix it, and was accused of extortion as the receiving company figured his offer to "fix it" came at some cost. Luckily they backed down & he only lost about a weeks worth of pay after being suspended while an investigation took place.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#25Earlier quoted context omitted.
This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore. If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
Defamation/libel/etc. is only when you claim something false to be a fact.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#26Earlier quoted context omitted.
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
Defamation/libel/etc. is only when you claim something false to be a fact.
Depends on the country. In UK truth is no defense for libel.
Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#27In cases like this I adopted a best effort policy,
look for contact information on the site and via google ("company-name security"). If I find a (simple and quick) way to contact the company I send them a simple report. If there is no way or no easy way to contact them, I am done and they get nothing.
You stated that you send them two messages via a form dedicated to reporting securities vulnerabilities and even tried to call them. I think you have done more than enough and can relax and wait. (Don't bombard them with too many emails.)
Some in these comments say that you might get sued. As long as you don't publish or threaten to publish the vulnerability, I don't see that happening (but than again IANAL).
It is always exciting when you find (your first) vulnerabilities on "high value" targets, but in the end of the day a laymen might not realize that most of the websites even in the Top 100 on Alexa have some security problems.
If you personally use the site and fear for your security, you may want to try a bit harder. For example I have tried multiple times to let my bank know about a vulnerability, but never got a satisfactory answer.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#28Earlier quoted context omitted.
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
Defamation/libel/etc. is only when you claim something false to be a fact.
Is there an anonymous means by which this can be done?
Re: Ask HN: Maybe found huge security problem, unsure what to do
#29BTW, the Hacker News team is super-duper grateful to people who report security bugs. Report directly to hn@ycombinator.com.
Re: Ask HN: Maybe found huge security problem, unsure what to do
#30I don't know if the timing applies here, but if you starting notification on Friday night...be patient and wait for a business day.