Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

231–240 of 466 posts

Re: I found a vulnerability. they found a lawyer

#231

Post by Dylan16807 »

nilslindemann wrote: post #116

AFAIK, what this dude did - running a script which tries every password and actually accessing personal data of other people – is illegal in Germany. The reasoning is, just because a door of a car which is not yours is open you have no right to sit inside and start the motor. Even if you just want to honk the horn to inform the guy that he has left the door open. https://www.nilsbecker.de/rechtliche-grauzonen-fuer-et…

> running a script which tries every password

This isn't directly applicable to your point, but I need to correct this. They weren't guessing tons of passwords, they were were trying one password on a large number of accounts.

Re: I found a vulnerability. they found a lawyer

#232

Post by vaylian »

Mustafabei wrote: post #223

I am a lawyer and my field do cross this area which the events have transpired. First, yes, everyone should acknowledge that this matter has been handled poorly by their corporate in-house and external lawyers. These should not have happened. The company should face consequences. I advise my data controller corporate clients to reach out to the reporter/whistleblower immediately and have the IT team collaborate, at t…

> 3. Sadly, your e-mail, especially the line below is actually a threat that is actionable under many EU juristictions;

I suppose the choice of words is the problem here? How should one announce an embargo period?

Re: I found a vulnerability. they found a lawyer

#234

Post by h33t-l4x0r »

makr17 wrote: post #102
undebuggable wrote: post #48

> the portal used incrementing numeric user IDs > every account was provisioned with a static default password Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.

Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…

You might as well make them sequential if they're numeric, making them non-sequential just puts more load on your server when the brute force happens.

Re: I found a vulnerability. they found a lawyer

#235

Post by h33t-l4x0r »

josephg wrote: post #128
makr17 wrote: post #102

Earlier quoted context omitted.

Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…

I did some work ~15 years ago for a consulting company. The company pushes their own custom opensource cms into most projects - built on top of mongodb and written by the ceo. He’s a lovely guy, and good coder. But he’s totally self taught at programming and he has blind spots a mile wide. And he hates having his blind spots pointed out. He came back from a react conference once thinking the react team invented funct…

Being self-taught isn't the problem. I've self-taught myself 10x more than I learned in school (and yes I was CS in school).

Re: I found a vulnerability. they found a lawyer

#236

Post by fuzzy2 »

kolinko wrote: post #222
kwanbix wrote: post #137

Earlier quoted context omitted.

Same with me. I started to get spam from the email I used for a Portuguese airline. They didn't even respond.

always cc the local GDPR office when reporting such things

They won't do anything. Had this exact scenario with two Shopify-based sites where my address somehow ended up with the second shop. Reported it, shop 1 investigated themselves and found themselves to be innocent, case closed.

Re: I found a vulnerability. they found a lawyer

#237

Post by necovek »

josephg wrote: post #128
makr17 wrote: post #102

Earlier quoted context omitted.

Years ago I worked for a company that bought another company. Our QA folks were asked to give their site a once-over. What they found is still the butt of jokes in my circle of friends/former coworkers. * account ids are numeric, and incrementing * included in the URL after login, e.g. ?account=123456 * no authentication on requests after login So anybody moderately curious can just increment to account_id=123457 to…

I did some work ~15 years ago for a consulting company. The company pushes their own custom opensource cms into most projects - built on top of mongodb and written by the ceo. He’s a lovely guy, and good coder. But he’s totally self taught at programming and he has blind spots a mile wide. And he hates having his blind spots pointed out. He came back from a react conference once thinking the react team invented funct…

A person who is like that is rarely called a "lovely person": how does that lovely interaction look like when you point such an egregious flaw out to them?

And tbh, this has nothing to do with being self-taught: by the time I enrolled in CS program, I was arguably self-taught and could spot issues like this myself. But I pride myself in learning from my mistakes and learning fast.

So it's more likely a character thing: if you are willing to admit when you are wrong, you'll learn much faster!

Re: I found a vulnerability. they found a lawyer

#238

Post by atmosx »

janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

Another missing link is here is the stock price relationship to security vulnerability history of the corporation. Somehow, I don't know how, but somehow stock prices should reflect the corporation's social responsibility posture, part of which is information security obviously.

Re: I found a vulnerability. they found a lawyer

#239

Post by dented42 »

cryptonector wrote: post #208

Hey TFA, other people have gone to prison for finding monotonic user/account IDs and _testing_ their hunch to see if it's true. See, doing that puts you at great risk of violating the CFAA. Basically, the moment you knew they were allocating account IDs monotonically and with a default password was the moment you had a vulnerability that you could report without fear of prosecution, but the moment you tested that vul…

That feels fundamentally broken. How can you expect an organisation to respond appropriately if you don’t provide them any kind of proof?

Re: I found a vulnerability. they found a lawyer

#240

Post by progbits »

vaylian wrote: post #228
chuckadams wrote: post #119

Earlier quoted context omitted.

Getting them to agree to your terms pretty much nullifies their domination strategy, and in fact becomes legally binding on them.

It's clear that the intentions of the insurance company are selfish and they want to gain leverage over the reporter. Even if the reporter managed to add a clause about data deletion, the company could still make the reporter's life hell with the remaining clauses that were signed. This is not worth the risk.

He didn't add a clause, he replaced their entire declaration with a single clause of his choice. At least that is how I read it.
Post reply on HN