Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

51–60 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#51

Post by asopd »

nlh wrote: post #31
Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.

Re: Researcher finds flaw in a16z website that exposed some company data

#52

Post by bee_rider »

crngefest wrote: post #29
miki123211 wrote: post #17

Earlier quoted context omitted.

If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed…

If you put all your stuff on your front porch with a sign “please take what you want” and it’s all gone the next day - then you can’t say you were robbed. I think this is a more apt analogy to what az16 did here

IMO these sorts of analogies to houses and porches don’t really work because there are just different cultural norms between websites and porches.

If there were a convention of leaving stuff on your porch to donate it, and a general assumption that when people left stuff on their porch it was up for grabs, somebody started storing their groceries there, and they were taken… they would just be stupid and not sympathetic.

If somebody just moved to a neighborhood where this was tradition and didn’t know about it, they would rightly be a little bit annoyed when the groceries they stored on their porch were taken, but really they only have themselves to blame for not understanding the local conventions.

If somebody opens up a storage company and then just put all the customers’ stuff on one of these porches, they are just dangerously, unethically incompetent. Even if there isn’t a convention of taking stuff from porches, actually. Because there are also armed gangs (nation-states) that go check out people’s porches for secrets.

Re: Researcher finds flaw in a16z website that exposed some company data

#53

Post by hugoromano »

Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

This what you expect from VCs. I always prefer to report these incidents to GDPR authorities if user data is leaked. Then they pay the fines and some get a criminal record. Money is something VCs “print” and manipulate.

Re: Researcher finds flaw in a16z website that exposed some company data

#54

Post by Capricorn2481 »

From the techcrunch article:

> “On June 30th, a16z addressed a misconfiguration in a web app that is used for the specific use case of updating publicly available information on our website such as company logos and social media profiles. The issue was resolved quickly and no sensitive data was compromised,”

What the fuck is this? They are blatantly lying here. There was a lot of sensitive data compromised. Anyone who inspected the site could have had access to everyones emails.

Re: Researcher finds flaw in a16z website that exposed some company data

#55

Post by rootusrootus »

miki123211 wrote: post #17
xyst wrote: post #7

when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”

If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed. There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed…

> might have some impact on whether the act was illegal or not

Only the burglary, trespassing, or B&E parts. Theft is still theft even if you leave your doors unlocked and/or open.

Re: Researcher finds flaw in a16z website that exposed some company data

#56

Post by bee_rider »

pavel_lishin wrote: post #15
ko_pivot wrote: post #9

Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.

It only takes a single mistake. A little tired because you didn't sleep well, or worried about a relative in the hospital, or you stubbed your toe that morning and it's distracting... and whoops.

Perhaps some processes should be put into place to make exposing the entire company into a multi-step failure?

Re: Researcher finds flaw in a16z website that exposed some company data

#57

Post by ndriscoll »

davidchang wrote: post #47
ko_pivot wrote: post #9

Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.

my guess is internal tool that wasn't expected to be exposed publicly. additionally, i didn't realize there are tools to automatically discover unreferenced subdomains like this. i would have just assumed security by obscurity

Presumably it's from certificate transparency logs. That's one reason I do not use TLS for my personal hosting.

Re: Researcher finds flaw in a16z website that exposed some company data

#58

Post by [deleted] »

Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

[deleted]

Re: Researcher finds flaw in a16z website that exposed some company data

#59

Post by [deleted] »

asopd wrote: post #51
nlh wrote: post #31

Earlier quoted context omitted.

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.

[deleted]

Re: Researcher finds flaw in a16z website that exposed some company data

#60

Post by [deleted] »

Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

[deleted]
Post reply on HN