Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

141–150 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#141

Post by paxys »

pavel_lishin wrote: post #116
paxys wrote: post #102

Earlier quoted context omitted.

> So you’d rather researchers reach out to black hats with this information instead? That is pretty much what they did. Posting publicly about the vulnerability most certainly meant that every hacker in the world tried (and probably succeeded) at reproducing it, all before the company had enough time to act.

They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.

Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.

Re: Researcher finds flaw in a16z website that exposed some company data

#142

Post by spookie »

IshKebab wrote: post #82
wouldbecouldbe wrote: post #8

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…

> it was in their docs. So not blaming them. We glossed over it. You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.

We always need to do our due diligence when using someone else's project. It's an open source project, available for free.

If they weren't very clear in the docs is one thing, but it doesn't appear so. Anyway, we won't combat these types of shenanigans by assuming others did everything up to snuff. We gotta be more careful ourselves.

Re: Researcher finds flaw in a16z website that exposed some company data

#143

Post by nlh »

mynameisvlad wrote: post #105
nlh wrote: post #94

Earlier quoted context omitted.

I don't think the onus should be on the researcher, and I think A16Z should have paid them. But if they actually wanted to get in touch, I'm just saying they could have. If they're putting the effort into vuln scanning the site, they can also put in the effort to get in touch like a professional. You could just as easily say "why should the onus be on the researcher to find vulnerabilities when it's A16Z's job to sec…

> You could just as easily say "why should the onus be on the researcher to find vulnerabilities when it's A16Z's job to secure their own site". The researcher is in this to find holes and make a few bucks (which is fine!). The job is complete when you get in touch. Presumably, the company wants to be as secure as possible. It’s in their best interest to make this process as painless as possible. A security researche…

I understand where you're coming from, but you're using "should" a lot. Companies should do a lot of things! They should make their sites secure. They should have a formal bug bounty program. They should have security@ and engineering@ and lots of other emails easily visible. We agree.

But many don't. And a lot of things in the business world are not as they should be. And in this real world of imperfection, others sometimes need to put in effort (and be paid for that effort) to make up for the failings of companies. This is one of those cases of imperfection.

Re: Researcher finds flaw in a16z website that exposed some company data

#144

Post by pixl97 »

Deathmax wrote: post #63
spyspy wrote: post #30

Earlier quoted context omitted.

The next time someone finds their keys, they're going to find this article and commit them to a public github repo instead...

You don't want to push secrets in their raw form on GitHub, secret scanning would disable keys from supported providers.

Yea, they aren't going up on GH, they are going up on sketchy-site . ru

Re: Researcher finds flaw in a16z website that exposed some company data

#145

Post by leerob »

krig wrote: post #70
duggan wrote: post #19

Earlier quoted context omitted.

Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys. It's obviously not foolproof, but it's a good effort.

That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.

If you add `import “server-only”` to the file, it will fail to compile if you to use it on the client. React also has more fine grained options where you can “taint” objects (yes that’s the real name).

Re: Researcher finds flaw in a16z website that exposed some company data

#146

Post by pavel_lishin »

paxys wrote: post #141
pavel_lishin wrote: post #116

Earlier quoted context omitted.

They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.

Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.

> No one was looking

It's a16z, not Grandpappy's Model Railroad Museum Showcase ("Come see a photo of the tiniest steam wagon in Sheboygan!").

Re: Researcher finds flaw in a16z website that exposed some company data

#147

Post by mynameisvlad »

nlh wrote: post #143
mynameisvlad wrote: post #105

Earlier quoted context omitted.

> You could just as easily say "why should the onus be on the researcher to find vulnerabilities when it's A16Z's job to secure their own site". The researcher is in this to find holes and make a few bucks (which is fine!). The job is complete when you get in touch. Presumably, the company wants to be as secure as possible. It’s in their best interest to make this process as painless as possible. A security researche…

I understand where you're coming from, but you're using "should" a lot. Companies should do a lot of things! They should make their sites secure. They should have a formal bug bounty program. They should have security@ and engineering@ and lots of other emails easily visible. We agree. But many don't. And a lot of things in the business world are not as they should be. And in this real world of imperfection, others s…

Of course I’m using “should” a lot. Because “should” clearly didn’t happen.

That doesn’t change anything. Just because a company has shitty security reporting practices doesn’t suddenly mean the onus is on the researcher to do the company’s job.

Re: Researcher finds flaw in a16z website that exposed some company data

#148

Post by internetter »

paxys wrote: post #141
pavel_lishin wrote: post #116

Earlier quoted context omitted.

They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.

Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.

what do you want them to do? nothing? we've already established that they tried to make contact.

Re: Researcher finds flaw in a16z website that exposed some company data

#149

Post by mynameisvlad »

dmix wrote: post #133
TheRealPomax wrote: post #114

Earlier quoted context omitted.

Alright then: you go to Andreessen Horowitz's website[1] and see if you can find a SINGLE email address in any of the normal places a business would list the (not-social-media) contact information. Because they did their damnedest to make sure you won't find any. [1] https://a16z.com/

I already linked to them in my comment below Click nav click “how to connect with us” -> https://a16z.com/connect/ See 4 emails at the bottom for each office See 4 links to social media pages where every single one has DMs open Wait at least a couple business days to see if anyone replies, if no one does or it’s not being taken seriously then you can announce it publicly on social media you found something but can’t…

> Huge effort, I know

Okay. There’s 4 front office emails and 4 social media accounts, both presumably manned by non-technical folks.

So now you have to go back and forth just to get routed to the right place. Which may not even happen if this is the first time that employee handled a security incident.

You’re making it sound like sending the email or DM is the end of the work. That is usually far from the case.

Re: Researcher finds flaw in a16z website that exposed some company data

#150

Post by [deleted] »

tux3 wrote: post #3

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears…

[deleted]
Post reply on HN