I found Prezi's source code

#1

Post by psychboo » Tue, Dec 03, 2013, 2:31 PM UTC

I found Prezi's source code
blog.shubh.am

Re: I found Prezi's source code

#2

Post by nezza-_- » Tue, Dec 03, 2013, 3:10 PM UTC

Bad judgement call on the site of Prezi imho. He didn't abuse it and notified them immediately after verifying his finding as it seems.

Re: I found Prezi's source code

#3

Post by ddoolin » Tue, Dec 03, 2013, 3:11 PM UTC

"Out of scope". Wow. Even more worthwhile that such a huge out of scope bug was found. These companies seem to try anything to keep from paying bug bounties.

Re: I found Prezi's source code

#4

Post by gnu8 » Tue, Dec 03, 2013, 3:11 PM UTC

There should be a database of these bounty programs that can tell you if a company pays or not, sort of like a credit bureau.

Re: I found Prezi's source code

#5

Post by colinbartlett » Tue, Dec 03, 2013, 3:14 PM UTC

There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste.

Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.

Re: I found Prezi's source code

#6

Post by hablahaha » Tue, Dec 03, 2013, 3:29 PM UTC

"We're pretty sure your actions were taken in good faith". Ouch, their email response contained barely an iota of gratitude and it was almost on the verge of passing judgement on his character.

Re: I found Prezi's source code

#7

Post by wodow » Tue, Dec 03, 2013, 3:30 PM UTC

colinbartlett wrote: post #5

There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste. Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.

Do it!

Re: I found Prezi's source code

#8

Post by dutchbrit » Tue, Dec 03, 2013, 3:31 PM UTC

Finder should receive the highest bounty possible IMO.

Re: I found Prezi's source code

#9

Post by terhechte » Tue, Dec 03, 2013, 3:32 PM UTC

colinbartlett wrote: post #5

There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste. Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.

That could be done with Bitcoin contracts, too.

Re: I found Prezi's source code

#10

Post by eli » Tue, Dec 03, 2013, 3:34 PM UTC

It was out of scope. The rules are pretty clear: http://prezi.com/bugbounty/ and he broke at least two of them.

And it seems like he knew it was out of scope when he submitted it too: "I had spent a total of 2 hours sifting and crawling through their services which were in scope, but wanted to see if I could locate any other subdomains..."

Now I think Prezi should probably have paid him anyway because that's a pretty boneheaded error and I'd be very grateful if someone politely pointed it out to me... but they aren't obligated to. You can put your pitchforks down.