6 ms·

My sympathies for the guy, and I'm not blaming the victim, but there is a basic safety rule that every aspiring hacker needs to understand, right now, right up

My sympathies for the guy, and I'm not blaming the victim, but there is a basic safety rule that every aspiring hacker needs to understand, right now, right up there with 'fasten your seatbelt' and 'don't feed the bears': DON'T DISCLOSE SECURITY FLAWS TO UNWILLING OWNERS. If you stumble across a security flaw in a proprietary system, check whether they have a bug bounty. If so, great. If not, keep your mouth shut and get on with your life. (Unless, of course, you've decided to sell it on the black market; if you're okay with the ethics of that, so be it. But my advice, that needs to become the standard advice to everyone, is to just keep your mouth shut.) Don't bite the hand that feeds you - and don't feed the mouth that's going to bite you.

nickpsecurity 10y ago
I'll add to disclose it anonymously tied to a pseudonym and/or public key. You can give them data and time to fix it with assurances it will be more public after a reasonable period of time. Thanks to anonymity, they're not going to do shit like in the article.
jwdunne 10y ago
Key is "unwilling". Hackers must also remember some companies willingly pay for this info. Based on the numbers I've seen doing contract work for a big blue chip in the UK, you could see it as an opportunity to sell penetration testing services. If this one is unwilling, there could be 5 more willing to pay a good sum to have these sorts of flaws identified and fixed. I get the feeling a lot of pen. testing companies run a standard set of checks for vulnerabilities. The report I saw was simply a bunch of metasploit results. They were charging some many thousands for this. Offering above and beyond could be a good opportunity.
crispyambulance 10y ago
I think the problem here is that the hacker's "responsible disclosure practice" never filtered down to a part of the organization that was in a position to care, understand and respond. Merely sending a emails and awaiting a response (if that's what happened) is an ineffectual tactic as it depends on a chain of unaccountable people within the org making the right decision about who to forward the email to.
saalweachter 10y ago
So let's suppose I'm a clever computer guy and I enjoy finding out how systems work and don't work, and I uncover lots of security problems. But I'm also lazy and/or not very good at dealing with large corporations to find the right person to report these things to, even if they have a bug bounty. Are there any organizations -- uhh, non-criminal organizations -- that will take a security report, find the right person at the company to report it to, see that it is addressed, and maintain my anonymity, so that I can wash my hands of it and go back to what I prefer to do with my time?
- y4mi 10y ago
  that sounds like a nice idea! but just imagine such a thing to exist... they'd need to document these security holes so that the same bug isn't reported several times simultaniously. so, they'll have a database of security holes a documented way to break into them... this would be more than just a honeypot for every black-hat hacker out there. they'd be swarming them
- wlonkly 10y ago
  Journalists are the first that come to mind. Use Secure Drop to maintain anonymity.

nickpsecurity 10y ago

I'll add to disclose it anonymously tied to a pseudonym and/or public key. You can give them data and time to fix it with assurances it will be more public after a reasonable period of time. Thanks to anonymity, they're not going to do shit like in the article.

jwdunne 10y ago

Key is "unwilling". Hackers must also remember some companies willingly pay for this info. Based on the numbers I've seen doing contract work for a big blue chip in the UK, you could see it as an opportunity to sell penetration testing services. If this one is unwilling, there could be 5 more willing to pay a good sum to have these sorts of flaws identified and fixed. I get the feeling a lot of pen. testing companies run a standard set of checks for vulnerabilities. The report I saw was simply a bunch of metasploit results. They were charging some many thousands for this. Offering above and beyond could be a good opportunity.

crispyambulance 10y ago

I think the problem here is that the hacker's "responsible disclosure practice" never filtered down to a part of the organization that was in a position to care, understand and respond. Merely sending a emails and awaiting a response (if that's what happened) is an ineffectual tactic as it depends on a chain of unaccountable people within the org making the right decision about who to forward the email to.

saalweachter 10y ago

So let's suppose I'm a clever computer guy and I enjoy finding out how systems work and don't work, and I uncover lots of security problems. But I'm also lazy and/or not very good at dealing with large corporations to find the right person to report these things to, even if they have a bug bounty. Are there any organizations -- uhh, non-criminal organizations -- that will take a security report, find the right person at the company to report it to, see that it is addressed, and maintain my anonymity, so that I can wash my hands of it and go back to what I prefer to do with my time?

y4mi 10y ago
that sounds like a nice idea! but just imagine such a thing to exist... they'd need to document these security holes so that the same bug isn't reported several times simultaniously. so, they'll have a database of security holes a documented way to break into them... this would be more than just a honeypot for every black-hat hacker out there. they'd be swarming them
wlonkly 10y ago
Journalists are the first that come to mind. Use Secure Drop to maintain anonymity.