Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

81–90 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#81

Post by crngefest »

Lvl999Noob wrote: post #46
crngefest wrote: post #34

Earlier quoted context omitted.

Well it could be this person that is professional and does not sell all your data to North Korean ransomware gangs - or it could be the one that does. Which one do you prefer?

I (we) would obviously prefer the professional person who is doing good for society. The problem is, this behaviour isn't good for them. I am not an expert or anything but from what I know, pentesting without explicit prior permissions can easily lead to huge lawsuits. I would rather that the careless people get their cars stolen than the good people all lose heart completely.

Sure there is no perfect solution here. I guess it’s a good idea to only pentest companies that do have a bug bounty program and an expressed interest in you pentesting.

While I enjoyed the article that GP referenced and agreed with most thing I thought the “hacking bad” take was a bit off.

Re: Researcher finds flaw in a16z website that exposed some company data

#82

Post by IshKebab »

wouldbecouldbe wrote: post #8

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…

> it was in their docs. So not blaming them. We glossed over it.

You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.

Re: Researcher finds flaw in a16z website that exposed some company data

#83

Post by duggan »

krig wrote: post #70
duggan wrote: post #19

Earlier quoted context omitted.

Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys. It's obviously not foolproof, but it's a good effort.

That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.

That's a fair point! It definitely feels easier to make that mistake, and anything where context and discipline is required is a good candidate for making some horrifying blunders :)

Re: Researcher finds flaw in a16z website that exposed some company data

#84

Post by YeahThisIsMe »

IshKebab wrote: post #74
rvnx wrote: post #68

Earlier quoted context omitted.

Let's imagine your backpack is open. It's polite to say thanks if someone informs you that you accidentally left your backpack open. But in no way you are supposed to give them anything. Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.

Terrible analogy. This is more like someone returning your wallet full of cash, on live TV. You aren't legally obligated to give them anything, but it sure is a dick move not to and good luck getting your wallet back next time you drop it if you don't.

>You aren't legally obligated to give them anything,

Acktchually, depending on where you live, you might be.

Re: Researcher finds flaw in a16z website that exposed some company data

#85

Post by rdedev »

rvnx wrote: post #68
paxys wrote: post #61

Earlier quoted context omitted.

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

Let's imagine your backpack is open. It's polite to say thanks if someone informs you that you accidentally left your backpack open. But in no way you are supposed to give them anything. Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.

It's not the same. Figuring out a bagpack is open takes no effort. Finding a backdoor takes a lot of effort.

Re: Researcher finds flaw in a16z website that exposed some company data

#86

Post by VTimofeenko »

ndriscoll wrote: post #57
davidchang wrote: post #47

Earlier quoted context omitted.

my guess is internal tool that wasn't expected to be exposed publicly. additionally, i didn't realize there are tools to automatically discover unreferenced subdomains like this. i would have just assumed security by obscurity

Presumably it's from certificate transparency logs. That's one reason I do not use TLS for my personal hosting.

Let's Encrypt allows issuing wildcards which is what quite a number of folks use for self-hosted services

Re: Researcher finds flaw in a16z website that exposed some company data

#88

Post by dmix »

mynameisvlad wrote: post #73
nlh wrote: post #31

Earlier quoted context omitted.

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

Why should it be an onus on the researcher to find this information? It should be plainly provided in the first place. Someone shouldn’t have to jump through hoops to help the company secure its resources. That is not how this works.

Trying more than one email is not jumping through hoops when it's one of the worst possible vulnerabilities hitting all of their databases/platforms. Being a research means being an adult and having a basic level of responsibility. Just like being a gun owner, it's a powerful tool that needs to be treated with utmost respect.

A lot of pentesters are just kids who are angry at the world and the poor state of security, which I get, but it's not a huge barrier to try a bit more. He would have been rewarded if he did.

Re: Researcher finds flaw in a16z website that exposed some company data

#89

Post by [deleted] »

Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

[deleted]

Re: Researcher finds flaw in a16z website that exposed some company data

#90

Post by [deleted] »

llmblockchain wrote: post #69

It's pretty shocking how many commenters are blaming the individual for not "trying harder" to find contact information. It's pretty clear a16z didn't want to pay anything or appreciate the disclosure at all. Finding random email addresses and sending them a notice would have gone no where other than spam folders. I get dozens of "disclosures" every week from mostly script kiddies that think my DKIM setting is someho…

[deleted]
Post reply on HN