Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Impossible-to-hack' security turns out to be no security

jltee.substack.com

Post reply on HN
Print view View original

101–110 of 157 posts

Re: 'Impossible-to-hack' security turns out to be no security

#101

Post by quesera »

DangitBobby wrote: post #88
chrisoverzero wrote: post #82

Earlier quoted context omitted.

> First of all, please do not ignore this email, this is not a scam attempt nor am I trying to sell anything, I am just alerting and looking for help closing down a security issue […] This seems like a good hint.

I can't tell if people are being deliberately dense as a way of punishing me for having a critical opinion, not reading the rest of the comments before responding to me, or genuinely do not understand what I am getting at. A hallmark of a nefarious email (particularly scams but some sales attempts) is that they aim to deceive you. Humans famously have the capability of lying. Someone telling me they are _not_ selling…

FWIW, I get several of these emails per week, as the first-reader of security@ emails, and they're almost always scams, sales pitches, or poorly-disguised bounty sniffers.

I can't even count the number of times I've been informed that Wordpress.com (.com, not self-hosted) has severe vulnerabilities. And those are the plausible reports.

But I always respond professionally and with civility, obviously, because if they have useful information for me, I want to hear it.

In defense of the researcher: Their message was better than most, and explained the issue found directly instead of couching it in BS claims. That's good.

In criticism of the researcher: They should have linked to their website where they publish reports, and been more plain about their modus operandi from the outset. Let the company know exactly who they're dealing with, and what to expect. Stating it in a sentence is "good", but linking to the evidence is much more credible.

I've been on both sides of this relationship. My dumbest experience was with a large bank (HQ in the Netherlands, but operating in several countries including the US and AU, and now acquired by a US bank). I reported a total account compromise vulnerability which would affect 12.5% of their users. I thought my email would be well-received and the (very simple and externally-obvious) issue quickly resolved. Instead I got threats and hostility from some SVP IS nitwit. I told him to go pound sand obviously, and it took them a week to fix the problem. My SO was a customer (which is the only reason I noticed the issue), but not for long. :)

Re: 'Impossible-to-hack' security turns out to be no security

#102

Post by DangitBobby »

ziddoap wrote: post #97
DangitBobby wrote: post #74

Earlier quoted context omitted.

The motivations behind the researcher emailing them.

If my first email contains everything required for you to locate and fix your security issue, my motivations are pretty clear.

Your motivations are clear to you, the person drafting the email. If they were clear to the CEO, he likely would not have responded the way he did. Look, I understand that you reached out with the best of intentions and that my criticism is not welcome, mainly because of that. What you are doing is important. I just think if you added a bit more info to your initial email about what you want, things could have gone differently.

Re: 'Impossible-to-hack' security turns out to be no security

#103

Post by badmintonbaseba »

shitter wrote: post #85
badmintonbaseba wrote: post #66

It looks like the CEO is both clueless and his reports are also probably misleading him. Whoever looked into the security problem probably saw the extent of it. This possibly got downplayed when reported back to the CEO. However rude, the CEO had little reason to lie about the extent of the problem towards the security researcher.

I imagine the conversation between the CEO and his reports included something about "it's no biggie, the passwords were hashed using bcrypt, that's like irreversible encryption" without contextualizing that and mentioning that plaintext auth tokens were also exposed.

I think it was downplayed even more. Supposedly the initial email by the researcher only had evidence for leaking database sizes, and I think it's likely that the CEO only got confirmation for this evidence internally and nothing more.

Re: 'Impossible-to-hack' security turns out to be no security

#104

Post by ziddoap »

quesera wrote: post #101
DangitBobby wrote: post #88

Earlier quoted context omitted.

I can't tell if people are being deliberately dense as a way of punishing me for having a critical opinion, not reading the rest of the comments before responding to me, or genuinely do not understand what I am getting at. A hallmark of a nefarious email (particularly scams but some sales attempts) is that they aim to deceive you. Humans famously have the capability of lying. Someone telling me they are _not_ selling…

FWIW, I get several of these emails per week, as the first-reader of security@ emails, and they're almost always scams, sales pitches, or poorly-disguised bounty sniffers. I can't even count the number of times I've been informed that Wordpress.com (.com, not self-hosted) has severe vulnerabilities. And those are the plausible reports. But I always respond professionally and with civility, obviously, because if they…

>They should have linked to their website where they publish reports, and been more plain about their intentions from the outset.

I don't get this. Their intentions should be clear by the fact that they reveal the entirety of the issue (what's wrong, why it's wrong, where to find it) in the first email. They don't ask for money, hide information behind further correspondence, or anything else that would raise suspicion.

The company has everything they need to locate, verify, and fix the issue without having to ever interact with the security researcher again. That's about as obviously well-intentioned as you can get.

Re: 'Impossible-to-hack' security turns out to be no security

#105

Post by oskarkk »

mind-blight wrote: post #69
JayeLTee wrote: post #24

Earlier quoted context omitted.

Not a journalist or a reporter, posts aren't meant to be professional. The only reason I even write any of my posts is because companies DO NOT disclose incidents at all, so I have to do it for them.

I thoroughly enjoyed the post and thought your tone was appropriate, entertaining, and kind of kethartic. You didn't call them names, engage in ad hominem, or do anything click-batey. You were understandably irritated at how they talked to you and how they were clearly trying to hide a massive exposure from their users. And then you shredded them with data. A+ - And thanks for trying to keep folks like this honest!

> You didn't call them names, engage in ad hominem

Well, the author wrote:

> Teammate App CEO, Sean Banayan, who has the reading comprehension and IT knowledge of a toddler

So it wasn't very nice, but deserved imo.

Re: 'Impossible-to-hack' security turns out to be no security

#106

Post by DangitBobby »

margalabargala wrote: post #100
DangitBobby wrote: post #79

Earlier quoted context omitted.

No, I'm simply trying to say the researcher would have more pleasant interactions with the people they email if they helped the person understand what they _do_ want out of the interaction instead of just saying they aren't being scammed. If the researcher placed themselves in the shoes of the CEO, they could understand why the CEO responded that way. That's not the same thing as thinking the CEO _should_ have respon…

The author did just that, though. They said they wanted to write up a post about the incident. I think both I and the author understand why the CEO responded as they did; it's because the CEO doesn't care about security, and when a security issue was raised, they viewed the reporter as a threat to the blanket of lies they wanted to use to brush the whole thing under the rug. In light of that, I think the author's res…

The CEO's reasons for not liking the situation are quite obvious, yes, they were caught with their pants down, it makes them look bad (the company was bad). I'm not advocating for letting them off the hook, I'm advocating for better communication. That's pretty much it.

Re: 'Impossible-to-hack' security turns out to be no security

#107

Post by JayeLTee »

JayeLTee wrote: post #83
tptacek wrote: post #63

Earlier quoted context omitted.

He writes as if he has access to large quantities of data after the CEO responded to him, which implies that it was after the exposed database was fixed, as the author acknowledges in the email he sent to the CEO.

No I did not query the database after it was exposed. The information I had was from when the database was publicly exposed. I don't want to be too specific about the links for the files as I don't know if others accessed this information and could exploit it but they had the website path to download the files exposed on the database, you just needed to know what to add to it, I tried a few things from the informatio…

No I did not query the database after it was fixed.*

Re: 'Impossible-to-hack' security turns out to be no security

#108

Post by grayhatter »

DangitBobby wrote: post #98
grayhatter wrote: post #90

Earlier quoted context omitted.

The OP/researcher looks fine. They tried twice to help someone who would eventually prove they didn't deserve they help. They then, after being disrespected, still upheld all the ethical requirements from a security researcher, redacting sensitive information. The CEO looks like a twat waffle, but the researcher is clean, and just looks like someone intolerant of overt disrespect. Being willing to stand up to bullies…

I don't know how you could see the CEO as a bully in this situation. The researcher clearly has "power" in this situation over the CEO, he pretty much has caught him with his pants down, so in this case the CEO is lashing out at a perceived threat. You are entitled to the opinion that the researcher responded proportionately in this situation, I happen to disagree. I would not want my friends or coworkers responding…

> I don't know how you could see the CEO as a bully in this situation.

someone tried to help him, he responded by making threats, and being rude. This is bully behavior. Why do you think responding to either email with a direct threat is reasonable?

> The researcher clearly has "power" in this situation over the CEO

You don't work in, or around information security do you? You're the first person to ever make any claim remotely close to saying any "researcher" has any kind of power. Without the context, if I told any of my security friends about researchers having power, I'd get a laugh about how absurd that idea is.

> he pretty much has caught him with his pants down, so in this case the CEO is lashing out at a perceived threat. You are entitled to the opinion that the researcher responded proportionately in this situation, I happen to disagree. I would not want my friends or coworkers responding this way in their daily dealings,

Much stronger than the expectations I have for security researchers, I wouldn't want my CEO to respond to them like a petty twat. Because when you piss off a researcher, just like the cyclist and the car. We can *both* lose https://gr.ht/i/both-lose.png

> I would want to give someone a chance to make amends instead of escalating, because this is not a playground and the stakes for the CEO are very real and potentially very damaging.

yeah, couldn't agree more... maybe you should raise your expectations for the CEO who's paid not to be a POS, and actually has a duty to protect users, instead of the random trying to stop bad things happening to people he doesn't know?

> I hope maybe we can agree, though, that with a few simple modifications to his approach, he is likely to reduce the probability of negative responses to the initial email. For example, he seems to already understand that people will take this email as a scam or sales attempt. But much is left to the imagination of the (uninformed) recipient about what the auth truly _does_ want. By filling in those blanks, the imagination need not be active.

It's not his responsibility to do any of that, that's the CEOs. Across all your replies, you defend the CEO like he's your brother. Hold *THEM* to the higher standard.

Re: 'Impossible-to-hack' security turns out to be no security

#109

Post by wellthisisgreat »

Usually like reading such posts but the author’s approach did seem very blackmail-like.

The CEO is surely coming off as a crazy guy but the author isn’t a white knight or good Samaritan either.

The company closed the database access and the guy says “now I will disclose it or you can do X” Would he have not disclosed it if they offered hush money? We won’t know, for his case I hope not. In any case - what was he expecting?

I’d imagine there is 50%+ chance that any smaller company without a dedicated security team will take this disclosure as a threat and blackmail. Especially that on the first second and third thought it seems the disclosure would be a way for the author to boost their blog and content marketing for their consulting.

If there was a bug bounty or something on their site it would have been different.

Re: 'Impossible-to-hack' security turns out to be no security

#110

Post by iandanforth »

catapart wrote: post #26
iandanforth wrote: post #19

The tone of the article is unprofessional to say the least. You could remove the argumentative tone, vitriol, and insults and have a more impactful article that reflected well on the author while appropriately warning people against this company. Please, don't choose team troll.

Personally, I find the tone of the article appropriate for the response received. The first email clearly set the tone as cordial and friendly while still being urgent. The response was in a clearly adversarial tone. So the prompter adjusted their tone accordingly. It wasn't necessary to match tones with the person whom wanted to be uncharitable, but it definitely feels more human to me, which is who the writing is f…

While there's a large audience for Jerry Springer style content, verbal abuse and stooping to the level of someone you're criticizing are not required. I don't read HN for name calling or childish taunting. It is always dispiriting to read, and even more so to read people defending. Humans, as you note, have base instincts, but giving into them and catering to them should be left to X and other sites devoted to pandering.
Post reply on HN