Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

121–130 of 266 posts

Re: I found Prezi's source code

#121

Post by dllthomas »

daviddoran wrote: post #48
shawabawa3 wrote: post #32

Earlier quoted context omitted.

> I think they acted pretty fairly They absolutely didn't. I don't get how there seems to be absolutely no human side to these cases. Guy discovers critical vulnerability and could have completely fucked the company over. Instead he responsibly reports it, and he gets back a big fuck you. How can you possibly think that's fair? The fact that it's out of scope only means they should give him an out of scope reward - m…

> Guy discovers critical vulnerability and could have completely fucked the company over. We all frequently have the opportunity to cause damage, but we don't get rewarded for _not_ doing so. I think Prezi may have given the cash reward if the pentester hadn't logged in and browsed around. They probably don't want to set a precedent (take the data you find, get cash reward). > ... because if the credentials were inva…

"and browsed around"

This seems to be key. Did he just verify the credentials, or did he poke around thereafter? If the latter, Prezi has a better case but they should have stated it more clearly.

Re: I found Prezi's source code

#122

Post by moocowduckquack »

[deleted] wrote: post #116
toddmorey wrote: post #53

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

[deleted]

This is a no-brainer. Surely the risk of putting off skilled people from your bug bounty program due to the press from this could cost you a lot more than $500.

Re: I found Prezi's source code

#123

Post by Ensorceled »

AGuyNamedChris wrote: post #109
sophacles wrote: post #103

My $.02 on this is that Prezi should have not awarded the researcher the cash under the bug bounty program, however they should have given him a reward anyway. Awarding the money as part of the bug bounty wouldn't be fair play under the rules of that program, but he potentially saved them a TON of money and problems. As such, he should be rewarded somehow. Further, had he been less than honest, he may have been able…

>Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one. The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.

I think he meant scan the source code for security issues and then report those bugs one by one ...

Re: I found Prezi's source code

#125

Post by mimog »

ollysb wrote: post #58
mimog wrote: post #39

Nexus isn't a source code repository. What you found was their internal artifact server, i.e compiled jar files.

If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.

But.. that can be said about any java (jar) programs class files. It is also not difficult to decipher the asm of a disassembled exe file, but to equate that with finding the source code of the program would be disingenuous.

Re: I found Prezi's source code

#126

Post by dllthomas »

fleitz wrote: post #85
eli wrote: post #59

Earlier quoted context omitted.

Well of course there have to be rules. Does spear phishing employees email accounts and using their password to access control panels count as a bug? I bet I could hack a lot of companies that way. Does being susceptible to a massive DDoS count as a bug? Cutting power to the building? I can't speak for Prezi, but it seems like they want people to test the security of their app, but not of their employees or back offi…

Yes, it does. Customers do not care how the intruder got in only that they got in. Spearfishing is an attack that makes the company look dumb. Leaving the credentials for your source code on the web makes you look even dumber. To qualify for the bug bounty he should have inserted code into their codebase and then exploited that. Fuck these guys.

Flooding communications channels (in particular, mental bandwidth of front-line employees) with attempts to spearfish is an attack that interferes with operations even when unsuccessful. It does not make sense to ask the world at large to persistently try such attacks.

This case is not like that, though.

Re: I found Prezi's source code

#128

Post by sophacles »

Ensorceled wrote: post #123
AGuyNamedChris wrote: post #109

Earlier quoted context omitted.

>Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one. The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.

I think he meant scan the source code for security issues and then report those bugs one by one ...

That is what I meant, I should have been more clear.

Re: I found Prezi's source code

#130

Post by jarrett »

columbo wrote: post #114
toddmorey wrote: post #53

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

I can see why they would want to set up rules instead of allowing anything to happen. For example, if I was to set up a bounty I really wouldn't want people at random contacting current or former clients trying to phish for passwords; I completely understand this is a threat, but I would want to personally manage something like that. With that said, if something like this was found I'd pay the person. There's a point…

Your point is good. I'd solve the problem like this: Instead of whitelisting certain kinds of attacks and parts of the company for bounty eligibility, I'd create a very limited blacklist. This blacklist would consist of actions which, despite being good-faith security research, would cause unacceptable damage to the company. For example, blacklisted actions might include:

- Deleting the company's data.

- Stealing from customers.

- DDoSing the site.

If you find a bug by taking any of the blacklisted actions, you get no bounty.

This approach protects the company without unduly limiting the thoroughness of the review.

Post reply on HN