Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

131–140 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#131

Post by hpeter »

tux3 wrote: post #3

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears…

It only gets worse when the company that published their environment variables sues the security researchers for finding it. It happens.

Re: Researcher finds flaw in a16z website that exposed some company data

#132

Post by pixl97 »

abejfehr wrote: post #79
IshKebab wrote: post #74

Earlier quoted context omitted.

Terrible analogy. This is more like someone returning your wallet full of cash, on live TV. You aren't legally obligated to give them anything, but it sure is a dick move not to and good luck getting your wallet back next time you drop it if you don't.

Why will giving someone a cash reward mean you have a better chance of getting your wallet back in the future?

You're using the wrong line of thought on the analogy here.

The value of the wallet is not the cash you'd directly lose inside of it. The value is getting your ID and cards back without them being copied by someone else, along with any other identifying information.

The value of having and up front and easy to use bug bounty system is it's easier to use then selling it off to some blackhats (hopefully). Those blackhats may otherwise scrape all your s3 buckets or somehow otherwise run up a zillion dollars of charges over a holiday with your keys.

Being cheap gets expensive.

Re: Researcher finds flaw in a16z website that exposed some company data

#133

Post by dmix »

TheRealPomax wrote: post #114
dmix wrote: post #88

Earlier quoted context omitted.

Trying more than one email is not jumping through hoops when it's one of the worst possible vulnerabilities hitting all of their databases/platforms. Being a research means being an adult and having a basic level of responsibility. Just like being a gun owner, it's a powerful tool that needs to be treated with utmost respect. A lot of pentesters are just kids who are angry at the world and the poor state of security,…

Alright then: you go to Andreessen Horowitz's website[1] and see if you can find a SINGLE email address in any of the normal places a business would list the (not-social-media) contact information. Because they did their damnedest to make sure you won't find any. [1] https://a16z.com/

I already linked to them in my comment below

Click nav

click “how to connect with us” -> https://a16z.com/connect/

See 4 emails at the bottom for each office

See 4 links to social media pages where every single one has DMs open

Wait at least a couple business days to see if anyone replies, if no one does or it’s not being taken seriously then you can announce it publicly on social media you found something but can’t reach them

Re: Researcher finds flaw in a16z website that exposed some company data

#134

Post by oasisbob »

miki123211 wrote: post #17
xyst wrote: post #7

when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”

If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed…

Well, other legal distinctions aside, robbery is taking things by threat of force.

If someone doesn't know they've been a victim of larceny until later, it wasn't a robbery.

Re: Researcher finds flaw in a16z website that exposed some company data

#135

Post by fanf2 »

nlh wrote: post #31
Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

They said they got in contact via Twitter, but a16z didn’t like that.

Re: Researcher finds flaw in a16z website that exposed some company data

#136

Post by largbae »

IshKebab wrote: post #74
rvnx wrote: post #68

Earlier quoted context omitted.

Let's imagine your backpack is open. It's polite to say thanks if someone informs you that you accidentally left your backpack open. But in no way you are supposed to give them anything. Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.

Terrible analogy. This is more like someone returning your wallet full of cash, on live TV. You aren't legally obligated to give them anything, but it sure is a dick move not to and good luck getting your wallet back next time you drop it if you don't.

Also the wallet had "please return me, cash reward" written on it. (Bug bounty advertised)

Re: Researcher finds flaw in a16z website that exposed some company data

#137

Post by llmblockchain »

mrcode007 wrote: post #101
llmblockchain wrote: post #69

It's pretty shocking how many commenters are blaming the individual for not "trying harder" to find contact information. It's pretty clear a16z didn't want to pay anything or appreciate the disclosure at all. Finding random email addresses and sending them a notice would have gone no where other than spam folders. I get dozens of "disclosures" every week from mostly script kiddies that think my DKIM setting is someho…

I’m surprised there is almost no discussion about the severity of reputational damage caused by an extremely amateur bug not expected of a prominent VC firm

Yes... In my mind, there are three kinds of security bugs.

1. Caused by pure ignorance and completely avoidable (this bug).

2. Caused by subtle configurations, workflows, programming (mostly avoidable, secret scanning, security linters, code reviews, general intelligence, etc). This is where 99% of security bugs are.

3. Caused by a malicious actor aligning planets with a single intent to maximize their cause. You'll never stop these people (three letter agencies, state actors).

edit:

A must watch talk https://vimeo.com/95066828

Re: Researcher finds flaw in a16z website that exposed some company data

#138

Post by Ukv »

paxys wrote: post #61
Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

> not responsible disclosure.

The researcher found an email address, tried it, it bounced, then reached out over Twitter with:

> someone from @a16z get in touch, now. its bad. security related.

https://x.com/xyz3va/status/1807330215955177937

That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what they did instead.

Re: Researcher finds flaw in a16z website that exposed some company data

#139

Post by newyankee »

tux3 wrote: post #3

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears…

Any legal basis to challenge this practice ? If a company claims that they pay bug bounties but use flimsy reasons like this to chicken out of seemingly genuine cases like these

Re: Researcher finds flaw in a16z website that exposed some company data

#140

Post by pixl97 »

dmix wrote: post #111
mynameisvlad wrote: post #99

Earlier quoted context omitted.

A researcher should not have to “try different emails”. Period. There should be a clearly disclosed email provided by the company to report such issues. Very obviously plastered. Or just use the standard abuse@, security@, infosec@, etc. It is by far in the company’s best interests for this to happen because the alternative is public disclosure or disclosure to black hats instead. Anything more is jumping through hoo…

Yes of course company's should do that, but in the real world a lot of companies don't think to do that, especially a marketing site for a VC firm. Any dev knows what it's like having a million responsibilities, a lot of things get put on TODO lists that never get completed. Them being owned by a wealthy company doesnt mean they have a huge dev team running 247 to handle this stuff. Which is probably why such a obvio…

WTF is this thinking?

>Any dev knows what it's like having a million responsibilities,

Any airplane mechanic has a million responsibilities, and if they are not followed people fucking die. Maybe software devs should step up and take a little responsibility for their lack of action that can have consequences for their users.

Security researchers owe you nothing. If you make the path of least resistance selling sploits to blackhat groups the world will be a worse place.

Post reply on HN