I found Prezi's source code • Hacker News Board

Re: I found Prezi's source code

#51

Post by Systemic33 » Tue, Dec 03, 2013, 4:28 PM UTC

What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.-

The only thing this causes is exceptionally bad PR, or even worse for the company; someone just got access and you don't know. Access to source code is like the gold mine of finding an exploit, because you will know exactly where a vulnerability is, and you won't even have to blindly test it.

Re: I found Prezi's source code

#52

Post by jpatokal » Tue, Dec 03, 2013, 4:28 PM UTC

thrillgore wrote: post #30

Dude needs to lawyer up right now. Doing the remote login has been seen as a violation of the CFAA.

Prezi the company is in Hungary, not the US, and intra.prezi.com (70.38.38.86) seems to be in Montreal, Canada.

Re: I found Prezi's source code

#53

Post by toddmorey » Tue, Dec 03, 2013, 4:30 PM UTC

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning.

In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

Re: I found Prezi's source code

#54

Post by eli » Tue, Dec 03, 2013, 4:31 PM UTC

nowayman wrote: post #27

eli wrote: post #10

It was out of scope. The rules are pretty clear: http://prezi.com/bugbounty/ and he broke at least two of them. And it seems like he knew it was out of scope when he submitted it too: "I had spent a total of 2 hours sifting and crawling through their services which were in scope , but wanted to see if I could locate any other subdomains..." Now I think Prezi should probably have paid him anyway because that's a prett…

Sometimes people and companies have their heads stuck so far in procedures and policies that they can't see the forests from the trees. The Finder provided tremendous value by discovering this issues and reporting it responsibly. He certainly should be rewarded with something more substantial than swag. Would Prezi have preferred that the Finder just not report this issues?

It's not like they got him on some legalistic technicality. The bug bounty clearly doesn't cover the bug he reported.

And I don't usually go looking for them, but if I come across a security problem (e.g. someone left login credentials unsecured in bitbucket) I would let them know because it's the right thing to do, not because I expect cash.

Re: I found Prezi's source code

#55

Post by Vivtek » Tue, Dec 03, 2013, 4:33 PM UTC

jrochkind1 wrote: post #23

What this guy describes doing (using accidentally exposed credentials to log in to somewhere) is quite a bit more than what other people have been successfully prosecuted for violations of the CFAA for. I'd be careful.

You mean that Prezi, a Hungarian company, would prosecute the author, an Australian, under an American law?

The Internet isn't just something happening in the United States.

Re: I found Prezi's source code

#56

Post by Vivtek » Tue, Dec 03, 2013, 4:34 PM UTC

nezza-_- wrote: post #2

Bad judgement call on the site of Prezi imho. He didn't abuse it and notified them immediately after verifying his finding as it seems.

And they sat on the decision until he pestered them. Not good at all.

Re: I found Prezi's source code

#57

Post by swalkergibson » Tue, Dec 03, 2013, 4:34 PM UTC

I suspect that the biggest reason is that this amazingly gigantic, critical vulnerability was so ridiculously easy to find that they cannot stand the idea of paying someone a large amount of money to "fix" it, when the fix is to simply deny access to that service from outside a LAN or whatever. Prezi thought that they found all of the easy ones. Not quite.

Re: I found Prezi's source code

#58

Post by ollysb » Tue, Dec 03, 2013, 4:35 PM UTC

mimog wrote: post #39

Nexus isn't a source code repository. What you found was their internal artifact server, i.e compiled jar files.

If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.

Re: I found Prezi's source code

#59

Post by eli » Tue, Dec 03, 2013, 4:36 PM UTC

toddmorey wrote: post #53

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

Well of course there have to be rules. Does spear phishing employees email accounts and using their password to access control panels count as a bug? I bet I could hack a lot of companies that way. Does being susceptible to a massive DDoS count as a bug? Cutting power to the building?

I can't speak for Prezi, but it seems like they want people to test the security of their app, but not of their employees or back office infrastructure. Maybe you disagree, but it's their bounty and I think those are fair rules.

Re: I found Prezi's source code

#60

Post by brown9-2 » Tue, Dec 03, 2013, 4:36 PM UTC

ansible wrote: post #47

So the question I haven't seen asked in this thread is: Why is anyone still using something other than SSH to connect to their version control system? Why is any software still using usernames and passwords stored in plain text anywhere? With SSH, you create SSH key pairs and set a passphrase on the private key... which shouldn't end up in any public place, ever.

Well the credentials in the properties file shouldn't have ended up in a public place ever. So if you replace username/password with a key, a human can still accidentally publicize the key.