Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.
It's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.
How I hacked Github again
41–50 of 202 posts
Re: How I hacked Github again
#42Seeing stuff like this, I want to get into comp-sec. It always sounded interesting, and it looks like it pays well...
I'd put this in the same category as mobile app dev. There are a few people making money by the truckload, plenty of people making a decent living, and lots of folks who strike out.
If it's something you're interested in, go for it. I just worry that people see this like the promise of gold in a faraway land and go rushing in, not thinking about the real distribution of success.
Re: How I hacked Github again
#43Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.
Sorry, but this is a terrible approach to thinking about progressive and open security practices...
Re: How I hacked Github again
#44Earlier quoted context omitted.
At least in my experience, I donate to groups that do good work but aren't getting paid for it. I wouldn't donate to people who are being paid (quite handsomely, in this case) for their labor. Especially when he's already clarified that GitHub paid him more than he thought his time was worth.
95% of my security research is not paid. I fix gems, libraries, websites etc. Donated money go right there, through beers and coffee I need.
This makes sense then for sure.
You are giving people that you have helped an opportunity to pay you without having any kind of contract with them.
Nothing wrong with that at all.
Re: How I hacked Github again
#45How can I start learning about how to identify exploits like this? I know some basics about web application security and work as a software engineer on a day-to-day basis but security has always been a passion of mine and I have always wanted to be able to support myself through working on security alone (by collecting rewards through bounty programs, self-employed security consulting, working at a security consultin…
Like a lot of other things, practice matters. OWASP has some deliberately insecure webapps which are meant to give people practice spotting and exploiting vulnerabilities (WebGoat, RailsGoat, PyGoat, probably others). There are also "capture the flag" competitions of the sort run every so often by Stripe; Matasano currently has one going as well, focused on embedded systems:
http://www.matasano.com/matasano-square-microcontroller-ctf/
Re: How I hacked Github again
#46How do you find all this stuff? Where do you even start?
Re: How I hacked Github again
#47Earlier quoted context omitted.
8 hours at 400$/hour will still only be 3200$ and he can presumably spend the remaining 4-3 hours doing more security analysis with less overhead, so it might still be cheaper to hire him as a consultant.
Exactly. + if github would really ask me for consulting I'd consider working for free, just for a testimonial.
I have a question for you! Roughly how many hours do you think you've spent looking for bugs on github before you found these stream of exploits?
Re: How I hacked Github again
#48Github uses ruby on rails, which is a pretty mature framework, perhaps covering most of the common security pitfalls. Additionally, I assume github has excellent programmers because of the nature of their job.
Could someone explain in simple english, how did they overlook known & well documented bugs that got them hacked (e.g. Bug 3 about cross domain injection). I'm wondering if someone of Github's caliber can be hacked so easily, what about the rest of the masses developing web apps. Especially all those new crypto-currency exchanges popping up left & right.
I've been toying with Django. Reading through the docs makes me feel that as long as I follow the safety guidelines, my app should be safe. It feels as if they've got you covered. But this post rattles my confidence.
Re: How I hacked Github again
#49@homakov, have you thought about selling screencasts ?
Re: How I hacked Github again
#50Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.
It's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.
Nice work Egor. I hope to see a GitHub client testimonial on sakurity.com sometime soon.