Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

221–230 of 266 posts

Re: I found Prezi's source code

#221

Post by infosec_au »

Hi, I just thought I would update everyone on my experience and the last 12 hours.

At the time in which I found the bug and was not awarded for it, I was quite upset, evident from my tone in the email in which I decided that I did not want to receive any of their "swag", but rather give them some constructive criticism.

I wasn't expecting the blog post to get as noticed as it did, but as it has, I was able to observe great points on both sides of the argument of whether or not I should be received the bug bounty. These discussions were definitely required as they brought out some important issues with bug bounties today and how security issues should really be dealt with.

Prezi, has now both apologised to me and also have offered to pay me for my findings. I have updated my blog post to show this, as well as the emails exchanged between us. I'm glad that it ended this way - all within the last 12 hours.

Initially, I did not redact the developers names, and after the blog post became I had to rush to make sure that I had removed them from all places which were indexed by Google. My intention was not to negatively affect the careers of the Prezi developers affected from my findings.

I thank everyone here, and generally on the internet, for looking closer into my findings.

Thank you, Shubham

Re: I found Prezi's source code

#222

Post by mendicantB »

hysan wrote: post #220
mendicantB wrote: post #172

Earlier quoted context omitted.

Sure, in that possibility, that is very true in that nobody could build a full fledged knockoff product. But, what concepts or features that could result in cheap knockoffs? Designed attacks? Password leaks and user privacy breaches? Customer information that can be sold to competitors? All of the bad PR and loss of business as a result?

You would also have access to their development branches which would give insight into future product features and bug fixes that have not yet been released. The former would be useful information to give to competitors and really put the company into a tough position to compete down the line while the latter could be used to find possible critical holes to exploit.

My point exactly. There are numerous situations that could doom their product.

Re: I found Prezi's source code

#225

Post by smtddr »

hsod wrote: post #209
sherjilozair wrote: post #178

Earlier quoted context omitted.

> ethically Double standards.

Can you expand?

I think he means that if we're not holding Prezi ethically responsible to pay the bounty, then we can't then start saying the researcher is ethically bound not to sell the exploit.

Re: I found Prezi's source code

#226

Post by meowface »

shawabawa3 wrote: post #28
eli wrote: post #21

Earlier quoted context omitted.

Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.

> Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil". i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black

You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code.

Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.

Re: I found Prezi's source code

#227

Post by meowface »

psychboo wrote: post #101

I'm noticing yet another instance of HN modifying post titles. I originally titled this post "Finding Prezi's Source Code" specifically because I did not write the article. Now the post title reads (at first glance) as if I'm taking credit for the author's hard work.

So, you found Prezi's source code huh? How does it feel?

(I kid.)

Re: I found Prezi's source code

#228

Post by dllthomas »

lifeisstillgood wrote: post #179
RyanZAG wrote: post #176

Earlier quoted context omitted.

No. But if the site gets hacked, I failed. If I asked users for their credits cards and stored it in a publicly accessible plain text file or in a secure system that still gets hacked the end result is still the same. My users are having unauthorized payments coming off their credit cards. I've failed. Maybe I can sleep better at night if I didn't go storing them in plain text and I can make up excuses easier, but I…

This is a fascinating discussion because it betrays two fundamental attitudes of society to risk. RyanZAG is "correct". If someone breaks into my house and steals my TV, then my security was a failure. This leads to the next problem - its not a catastrophic failure in today's (western) society . I am probably out at work, and I am insured, and the burglar is unlikely to be waiting when I get home to murder me. Howeve…

Great perspective!

"So its not a judgement on the resources of the attacker that matters, it is the expected consequences of the breach - the expected value of damage."

I nodded at this when I mentioned resiliency and recovery, but I still think resources of the attacker matters. A determined attacker could doubtless breach your front door with a battering ram or axe and enough time. Part of the reason you don't worry about this, I assert, is that it's not likely because the costs to the attacker (in terms of chances of getting caught and penalties if they are) are too high. Part of it, as you say, is that we have some amount of resiliency against the threats posed. And probably part of it is that most of us are not terribly inclined to do damage to each other without provocation and there are many possible targets for the few who are - I'm not really sure the degree to which we should legitimately consider that bit a part of "security" but it certainly merits weight in calculating risks.

Re: I found Prezi's source code

#229

Post by fleitz »

smtddr wrote: post #225
hsod wrote: post #209

Earlier quoted context omitted.

Can you expand?

I think he means that if we're not holding Prezi ethically responsible to pay the bounty, then we can't then start saying the researcher is ethically bound not to sell the exploit.

Exactly, it's just a URL.

Why not sell it? People sell URLs all the time, and bitbucket is clear written intent from the company that they wanted their source control systems accessible to the public else they would not have provided written notice to the world of their passwords.

Surely the creators of the software are competent software experts who fully understood the implications of making their repository public. Surely, they are not asserting that they were so negligent in the performance of their duties as to not check whether the repository would be made public.

Also, they've made numerous written affirmations that the issue found is not a bug, and would not qualify as part of their bug bounty for security flaws.

They are morons and deserve to be hacked because they are negligent and make affirmations that leaving their source control system passwords on public computers is not a security issue worthy of payment. They deem the risk to be so insignificant as to not even be worth $500.

Re: I found Prezi's source code

#230

Post by xerophtye »

grannyg00se wrote: post #190
RyanZAG wrote: post #155

Earlier quoted context omitted.

I disagree here - you've either lost the data or you haven't. You can make guesses as to the expected resources of the attacker, but if you're wrong and the attacker has more resources, then you might as well have not even bothered. As an example, you have some fairly non-sensitive private health records. Here are three approaches: (1) No security at all. You hope nobody is going to bother taking them and using them…

How do you relate this to something like home security? You have valuables at your home. People can come in and take it with varying degrees of force. Are you prepared for the maximum force attack, or do you accept the typical security features which you know to be minimally effective?

hahah was just gonna write about this, but you beat me to it.

Either way, the point is, there's a trade off. Kinda like the 80-20 rule. It obviously taken 20% effort to protect against 80% attacks (the casual opportunistic attacks. like preventing sql injections, or locking your front door) and it takes 80% effort to prevent those last 20% attacks (actual Pros). SO "you might as well not have bothered" is somewhat naive in my opinion

Post reply on HN