Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

201–210 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#201

Post by dvdkon »

lawgimenez wrote: post #75
paxys wrote: post #61

Earlier quoted context omitted.

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

I did the same thing with OP years ago, I tried to contact in every way possible the dev team of the largest telecom company in my country. All channels were ignored, so I have to resort to contacting our government agencies. Luckily, one agency replied to me and had one of the devs contacted me. For this hassle I was only paid $50. You have no idea the effort we go to report this things. So I quit bug hunting after…

I stumbled upon a big vulnerability in an unnamed Czech ministry's web apps around January. It's now July and after trying the appropriate support email, the official "snail mail but digital", and calling various people's office landlines (thankfully they publish those in the org chart), it might get fixed this month.

If there is a next time, maybe I'll try convincing the cybersecurity bureau to take my vulnerability reports instead.

Re: Researcher finds flaw in a16z website that exposed some company data

#202

Post by svnt »

miki123211 wrote: post #17
xyst wrote: post #7

when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”

If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed…

A website is not a house. It is nothing like a house. There is no front door. There is no lock. There is no expectation of privacy. There are only things you can access and things you cannot. There is nothing inappropriate about trying to open the bathroom window from the outside.

If I wanted to try to use such a weak analogy, the analogy to hacked is not robbed. You were only robbed if content was removed and exclusively held by someone else, which in the security world we call a ransom.

You can see how quickly this breaks down.

Re: Researcher finds flaw in a16z website that exposed some company data

#203

Post by rvnx »

davidgay wrote: post #197
mcfedr wrote: post #181

Earlier quoted context omitted.

How can it possibly be a crime? They literally gave the keys to everyone who accessed their website

You (unintentionally) drop your house key in front of your door. Now we can all freely enter your house! It can't be trespassing with the key sitting right there, can it?

Totally agree, and if you think like that, then a SQL injection is just an undocumented public entry-point ¯\_(ツ)_/¯

Re: Researcher finds flaw in a16z website that exposed some company data

#204

Post by spydum »

mcfedr wrote: post #180
wouldbecouldbe wrote: post #8

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…

I think I'd be looking for at least a refund on that pen test. I've never come across one that was anymore than a box ticking exercise.

I've absolutely been involved (conducting, coordinating, and receiving) some high value pen tests over the years.

One problem is there is no hard definition of what is considered a "pen test". I've seen very highly reputable vendors claim essentially out of the box nessus scans as pen tests, automated burpsuite scans as pen tests.

In my own personal definition of a pen test: security practitioners may use those tools amongst others, but they generally leverage them as recon and then try to uncover pathways in from those vulns, in addition to abusing application logic and misconfiguration.

Second problem: paid pen tests have limited scope and time constraints. If the application surface is sufficiently large, that engagement may simply not be big enough to conduct a thorough test. Contrast this with Bug Bounty hunters (and attackers): they have unbounded time and resources. They can literally keep testing until they find something.. and best part, there are so many of them!

So these public bug disclosures are hard to compare to a private/paid for test. You could argue, the app owners didn't pay enough for a comprehensive test.. but the downside is: just because you paid more, doesn't mean the pen tester did a better job :( While they are high noise, I tend to think bug bounty programs are the best fit for the problem space. You end up with much deeper coverage, and a very positive ROI (even factoring in your engineers to triage the bounty reports).

Re: Researcher finds flaw in a16z website that exposed some company data

#205

Post by eZpZpi »

mcfedr wrote: post #180
wouldbecouldbe wrote: post #8

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…

I think I'd be looking for at least a refund on that pen test. I've never come across one that was anymore than a box ticking exercise.

Security is just box checking. Most IT work is. The deployed stack has limited set of parameters to learn and test for.

Leetcode is popular hiring criteria for a reason; that kind of code checks the “KISS/don’t be clever” and DRY rediscovering known algorithms boxes

Except in a few fields, most startups are pretty vanilla config ops and secops tasks.

Recent popularity among the working class has inflated the egos of run of the mill office workers. “Programmers are lazy” has long been waved around like a badge of honor.

Rather than Silicon Valley I’d like to see a Mad Men take on IT. Start in 06-ish with a bunch of entitled first world craft beer drunkards wasting nights on syntax art, framework wars, rise of cloud. End with Covid, launch LLM AI and a bunch of code school burnouts being laid off.

Re: Researcher finds flaw in a16z website that exposed some company data

#206

Post by hluska »

xyzeva wrote: post #126
paxys wrote: post #61

Earlier quoted context omitted.

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

i think you're missing the fact that that indeed is not a security email, and the engineering/security email i found bounced. i had no ill intentions. stop pretending i did.

It’s hard to assume good intentions when you find the site via a set of searches that begin with ‘crypto bullshit’.

Re: Researcher finds flaw in a16z website that exposed some company data

#207

Post by miunau »

paxys wrote: post #141
pavel_lishin wrote: post #116

Earlier quoted context omitted.

They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.

Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.

Lol what a reach

Re: Researcher finds flaw in a16z website that exposed some company data

#209

Post by gcbirzan »

bdowling wrote: post #113
gcbirzan wrote: post #71

Earlier quoted context omitted.

Actually, they posted that a vulnerability existed, https://x.com/xyz3va/status/1807330215955177937 : > someone from @a16z get in touch, now. its bad. security related

What's the relevant difference?

I don't remember what your post originally said, but posting about a vulnerability is not the same as disclosing the vulnerability. Especially when you're asking for a contact.

The difference, in case you really want to know is that one actually tells everyone what the issue is, another tells everyone that there is an issue.

Post reply on HN