21 ms·
What Happens When You Send a Zero-Day to a Bank?
- jacquesm 9y agoThat's a lot of errors for one document.
- komali2 9y agoI'm also kinda curious why the author didn't run through a simple spell checker before posting. I'm grateful for the article, it was an interesting read, but really why not just paste into google docs real quick or something?
- LanceH 9y agoMaybe his editor is on leave.
- ComodoHacker 9y agoI thought the author is non-native, considering TLD.
- fulldecent 9y agoNative English speaker. Very jet-lagged. Posted from Doha airport and blogspot.com kept redirecting to that other domain. Thank you, I have made many corrections now.
- fulldecent 9y agoThank you for taking the time to reply. @jacquesm, @komali2, @LanceH, I have made many typographical corrections and given you credit where due.
- tlackemann 9y agoAt least it was over http/s Terrible nonetheless. Reminds me of how Mt. Gox used to hand out password resets with plaintext passwords in the query string on their own forums.
- stcredzero 9y agoReminds me of how Mt. Gox used to hand out password resets with plaintext passwords in the query string on their own forums. Sounds like somebody should write a book about all of the missteps in that debacle.
- mkagenius 9y agoWere cookies shared across sites in 2008? It seems pretty odd..
- fenwick67 9y agoImages are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement('img'); i.src= "http://news.ycombinator.com/y18.gif"; http://news.ycombinator.com/y18.gif"; Then look at the cookies sent over the network.
- shiv86 9y agoWhere do I type it ?
- artursapek 9y agoThis is how FB & others track everyone on the web through ad frames, like buttons, etc.
- tdalaa 9y agoWow. Going on with your life as a C-level executive with this knowledge, as if it's just all good, is just insane. I'm sure they're in the clear personally now, but I can certainly see why they would wanna sell their company fast after gaining this knowledge in 2010.
- lisper 9y ago> I'm sure they're in the clear personally now Don't be so sure. If they didn't disclose this to their buyers they are guilty of fraud. The statute of limitations has probably run out (I don't know which state has jurisdiction here), but delayed discovery rules may apply.
- ballenf 9y agoI'm not so sure it's fraud for 2 reasons: 1) how easy it would/should be for the buyer to discover the issue; 2) these transactions generally have very detailed disclaimers / disclosure -- basically making them 'as-is' transactions. If I were a betting man, I'd bet the buyer knew about the issue and basically didn't care.
- dmix 9y agoYet security researchers go to prison for iterating the ID numbers in a URL to access private profile pages :/ This is negligent. If they are running banking ecommerce infrastructure and are unable to deal with 101 security risks then it is absolutely negligent. The "it is too complex for the average person" isn't an adequate defense. The only thing is that there has to be someone who lost something of real value for it to go to court as negligence does it not?
- fulldecent 9y agoThis is good thinking. But you need iron tight wording when spelling this stuff out. In your contact with companies you should say "Failing to fix this issue would be a violation of reasonably assumed security practices as required in LAW..."
- hartator 9y agoKudos for the balls to come public despite NDA.
- Spoom 9y agoMany are questioning the validity of that NDA in an earlier comment due to its complete lack of consideration.
- lisper 9y agoThe NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.
- rpedela 9y agoAre you an IP lawyer?
- lisper 9y agoNo. But I can read.
- notyourwork 9y agoAre you a heart surgeon? No but I can read. I'll stick to advice from subject matter experts, not self appointed experts.
- lisper 9y agoAs you wish. My legal advice comes with a free double-your-money-back guarantee if not completely satisfied.
- LoSboccacc 9y agoThere's a helicopter crashed in a house. I don't need to be a pilot to know it's not supposed to do that.
- jdmichal 9y agoThis is actually pretty close to how I personally define a "professional": A professional is someone whose work can only be judged by other professionals of the same domain. Obvious failure modes are exempted. Anyone can tell you about a bad bridge after it has failed. But it would take a bridge engineer to tell you that before it fails. https://news.ycombinator.com/item?id=8960822#8963307 https://news.ycombinator.com/item?id=8960822#8963307
- whataretensors 9y agoI would not be surprised if this turns into a class action lawsuit. The negligence here is remarkable.
- brianwawok 9y agoYou need damages to have a class action lawsuit. What are your damages? I am not saying no one has damages, but if 100s of people had damages, I expect something would have happened...
- idbehold 9y agoCouldn't anyone who lost money on a stock be able to claim damages? How would the bank prove the purchase order was legitimate seeing as there's basically no security around the endpoint and the bank knew it?
- bdonlan 9y agoThe bank may be able to demonstrate that the vulnerability was not exploited by, e.g., showing that the order preview page was first loaded with the same parameters, or showing a same domain referer.
- idbehold 9y agoMaybe the bank should've used this method to prevent the problem in the first place by just checking that the referer request header was from their domain.
- brianwawok 9y agoIs it proven anywhere that it wasn't?
- lightbyte 9y agoThe article mentions that unauthorized transactions were indistinguishable from legit ones: >Also their engineers made it clear that unauthorized transactions like this and later shown below would not be distinguishable from other legitemate transactions.
- dvcc 9y agoWould he not have a case of gross negligence against Zecco if he were a customer? Is there something preventing a lawsuit, outside of the possibly non-binding NDA?
- scott00 9y agoNo damages, assuming no unauthorized trades were executed in his account as a result of the unpatched vulnerability.
- idbehold 9y agoCouldn't he simply claim unauthorized trades were executed? How would the bank be able to prove otherwise? Especially considering the bank knew about this huge security hole.
- lr4444lr 9y agoYeah, but presumably he'd claim it on an asset in the red, and for a large enough amount of money to be worth risking lying about under oath. Zecco could have the court subpoena the ISP to prove the IP was in use at the time by the defendant.
- idbehold 9y agoOf course it was from his IP, the only way the transaction works is if your browser has the proper cookies. The whole vulerability is that all someone has to do is put that <img> into ANY webpage you visit and so long as your browser still had the cookies, the transaction would go though without you needing to do anything.
- lr4444lr 9y agoGood point. IANAL, but I would think burden of proof is still on the claimant that the transaction was fraudulent. If it had happened to multiple users around the same time frame who provably visited a similar set of potentially malicious websites, it might work, but then the company could respond that it's strange he conveniently didn't notice anything on the statements or confirmation of purchase e-mails until the exploit was publicized.
- klapinat0r 9y ago> if somebody sent you an email with that code (even if you never open the email) What is he trying to say here? How on earth would it be possible to execute the url in the context of your zecco cookies unless it's openend in a (browser) in which you've logged into zecco?
- cyphar 9y agoI know that MS Messenger used to "pre-fetch" URLs in your system's IE session even if you don't open the conversation. I presume there was some similar issue with 2008-era email clients (it's a "useful feature" after all).
- xyzzy_plugh 9y agoI'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.
- klapinat0r 9y agoPossibly, but you'd still have to (try to) "render" it in your browser by opening the mail. On a similar note, your web mail could fetch images in emails ahead of time, but that would still be out of your browser's context
- raphar 9y agonote that the url is inside an <IMG> tag.
- degenerate 9y agoRemember...... 2008. Many people still had "auto download pictures" enabled in their email.
- beaconstudios 9y agoI'm guessing he meant a webmail client.
- wlk 9y ago
- cyphar 9y agoKudos to the author, and hopefully they don't get sued as a result. This bullshit with corporations trying to cover up security vulnerabilities (rather than fix them) needs to stop. "Sign this NDA or we will send the FBI to arrest you because you found that our banking website's security was completely fucking broken and told us about it." Jesus fucking christ.
- cookiecaper 9y agoNo one should independently contact a company about this type of issue without first obtaining competent legal advice. And I do mean competent advice; most lawyers are very technically illiterate and will not be sympathetic, let alone familiar with the relevant areas of law. The researcher is lucky that TradeKing believed their NDA trick was sufficient. Even if the case here is weak, and I wouldn't necessarily assume it is, it would still seriously damage the researcher's life. Here's how it goes when you get sued by a big company. Their lawyers essentially have a heyday doing everything possible to obstruct and delay the process so that they can maximize their time on the corporate teat. It will go on for years; they won't mind because it's business as usual for them, and they're getting paid big bucks to torment you. Your life will be ruined: assets seized pre-emptively, reputation and credit destroyed, inordinate quantities of time consumed by legal research and tedious paperwork, struggling (if not immediately blatantly failing) to keep your incompetent counsel paid at $250/hr and meet the retainer, and eventually failing to file some document or pay some fee that will cause the court to enter a default judgment against you and permanently confiscate everything you own, leaving you with the albatross of a massive outstanding judgment waiting to be enforced, bank accounts garnished any time you get any money, etc. And that's the short version! And then guess what -- if, by some miracle, you don't lose in the first round, this whole process will repeat as they file appeal after appeal. Hunker down because the proceedings will last at least 5 years. The corporate lawyers will be able to justify all of it to their clients without blinking an eye, who probably forgot that they even asked them to sue you. Everyone at the company and the law firm will go home and sleep soundly on their piles of money, and you'll have learnt your lesson that trying to stop the subterfuge of an online trading platform is a terrible offense. Good reading: http://www.nissan.com/Lawsuit/The_Story.php http://www.nissan.com/Lawsuit/The_Story.php IANAL.
- komali2 9y agoWhy did the author post in 2017, so long after? He said in early conversations he was going to go public much sooner.
- wyldfire 9y agoHe was afraid that he was bound by the NDA not to disclose it. Now, in 2017, he flouts the NDA and acts in the public interest.
- idbehold 9y agoBut why now? What changed?
- orf 9y agoThe year?
- ComodoHacker 9y agoPerhaps author gained some age and wits.
- syncsynchalt 9y agoI like to think that the world's view on network security has changed, even in just the past few years. Companies seem more educated on proper disclosure, network security is now seen as a part of national security and/or common good, and society seems to be shifting the blame for insecurity away from the exploiter and more toward the exploited. For example, if you'd stolen millions of credit cards in 1983 you'd have a special session of Congress dedicated to going after you, whereas now we (rightly) blame Target.
- fulldecent 9y agoI realized that life is shorter than I expected and I started putting some affairs in order. This is something I had wanted to do for a while and now any consequences are less important to me.
- deleted 9y ago[deleted]
- alistproducer2 9y agoOn a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while leaving my credentials (password and all) in the sign-in form. Not so bad when signing in from home - horrific if you're signing in from a public computer. I tweeted to the bank and spoke to someone on the phone about it. It's been 3 months and the bug is still there. [EDIT] I decided to log in today just to see if it's still there (was a couple days ago), and it's finally been patched. If I had used a throwaway I would gladly let you guys know the bank, but I won't since it's trivial to find out who I am from my handle.
- diogenescynic 9y agoTell us what bank so we can avoid them.
- nothrabannosir 9y agoThis deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.
- jbpetersen 9y agoBetter yet: Short their stock, then write a scary blog post about the problem.
- goda90 9y agoI feel like someone would try to sue over such an action, but would they have any ground to stand on?
- got2surf 9y agoJust curious, what would the legal implications of something like that be? It seems like you're still benefitting from criminal activity that you enable, but what would the specific charge (if any) be? And any examples where people have tried this? Although I guess it could help align customer and business goals, since no one wants to lose money
- wyldfire 9y agoLesson learned: when reporting a vulnerability, record all discussions from first contact with the vendor. At least in cases where the vendor doesn't have a clear, easy to find policy and/or bounty for disclosures. I think it's totally fair to reject an NDA but I don't blame him for fearing an overzealous reaction on their part. Even being on the right side of criminal and civil law, you really do have to be willing to spend time and money to mount an affirmative defense.
- rabidonrails 9y agoI believe that you'd need to tell them that they were being recorded or you could get yourself into trouble. Edit: looks like this could be possible without getting into trouble depending on the state you're in: http://lifehacker.com/5491190/is-it-legal-to-record-phone-calls http://lifehacker.com/5491190/is-it-legal-to-record-phone-ca...
- mcbits 9y agoI think it may be enough to play a beep every few seconds to indicate that the call is recorded. At least that's what a bank I used to work for would do when I called offices in a two-party state.
- jdmichal 9y agoFirst, IANAL but I would be very surprised if beeps alone would be considered a legal notification of recording. Second, those beeps probably exist to reinforce that the audio is unmolested. A beep every 5 seconds means you would have to cut audio in five-second increments, which is not likely to be convenient to whatever segment of audio you actually want to cut.
- mcbits 9y agoApparently the legalese is "recorder warning tone" and it should be a 1400 Hz beep every 15 seconds. https://en.wikipedia.org/wiki/Recorder_warning_tone https://en.wikipedia.org/wiki/Recorder_warning_tone I mentioned it because someone working for a big organization and making a lot of interstate calls probably hears these beeps all day and would be less likely to protest than if someone verbally announced that they're recording the call.
- Sujan 9y agoFor anyone being as confused as me in the timeline bit: The author is called Will(iam) Entriken. So "Will" and "Entriken" is the same as "I" and passive voice.
- ralfd 9y agoYes, this was needlessly confusing in the blog post.
- fulldecent 9y agoThank you, I have posted an update to address this, including credit to you.
- cosinetau 9y agoI think they're regarding these things as weapons, because that's how they or others are using them. It doesn't matter how we regard CVEs as a community, this is the truth of the matter outside of it. We're handing them over a bomb, and they want to know why. It feels very Spy vs Spy to me, as silly as that sounds.
- knodi123 9y agoThat was my experience when I stumbled across a text file with several thousand credit card numbers, which included tons of details about each card holder, including SSN. I tried reporting it to the credit card, and to the issuing bank, and to the FBI. The only thing I asked was that they cancel the credit card accounts and put a "potential fraud source" note on each customer's account. Each party I called was more concerned with threatening me, and trying to find out what kind of criminal angle I was playing, and what my ulterior motive was, etc etc. I honestly expected to hear "Oh dang, that sucks, we'll close the accounts and contact the victims", and was depressed at the hostility I encountered.
- platz 9y agoSuppose they granted your plan to "cancel the credit card accounts" and "potential fraud source" note on each account. That's pretty much trying to shut down business with their customers. You don't see how they'd interpret that as hostile? Future actors would know how to apply similar techniques if the outcome was in their favor (e.g. Anonymous suddenly produces a large file of cc#'s and threatens bank!) > The only thing I asked.. In fact, why were you making demands about how they handle their customer relationships, instead of simply presenting what you'd found?
- joshuamorton 9y agoWhen you come across a single credit card number (say, by finding someone's card on the ground), the response by most financial institutions is to invalidate that card and mail them a new one. Why shouldn't the response be the same if you come across a stack of 100 credit cards?
- alexchamberlain 9y agoNitpick: was this disclosed to a bank or a broker? Not sure it matters tbf
- scott00 9y agoI believe you have picked an actual nit. He reported to Zecco (his actual broker) and Penson (Zecco's clearing firm). Both were SEC-registered broker-dealers at the time, neither were banks.
- fulldecent 9y agoYes, you are correct. I am guilty as charged. Motivation was clickbait and/or fear that people would not understand the latter.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- deadrobot 9y agoLeft your local file path causing a broken image on the page. Was expecting I just executed a Zecco trade ;) file:///Users/fulldecent/Desktop/2008-10-27%20Will%20Entriken%20NDA%20Final.png?lastModify=1492757183
- jwilk 9y agoArchived copy, which can be read without JS enabled: https://archive.fo/8ZpDJ https://archive.fo/8ZpDJ
- fulldecent 9y agoThank you and I am sorry that my blog has offended your browser. Would you like to recommend a better hosting service I could use instead of the wildly antiquated Blogger? I would like to migrate to my own domain with Jekyll or something. But I would not look forward to implementing commenting and trackbacks even though the blog is pretty modest any way in terms of using those features.
- jwilk 9y agoAccording to https://news.ycombinator.com/item?id=13355531 https://news.ycombinator.com/item?id=13355531 , JS requirement is not a problem with Blogger per se, but with some of its themes.
- kharms 9y agoAbout a month ago I noticed that my bank had a vulnerability - I could access the details and photos of every remotely deposited check. I sent them an email, they took the feature offline in about 2 hours. No bug bounty but oh well.
- shuri 9y agowhich bank?
- kharms 9y agoIt was a credit union, not one of the massive ones, but beyond that I'd rather not say.
- mcescalante 9y agoMy bank used to show deposited check photos in a popup with the URL viewable iirc, and sometime they switched to a modal window with base64 data as the source instead of a URL that might be manipulated. I wonder how many small banks still may have bugs like that
- fulldecent 9y agoModifying a data: url is a feature not a bug.
- teamhappy 9y agoIn Germany you can contact the CCC to walk you through the process of reporting vulns like this one. I'm sure the EFF does similar things for US citizens. A quick Google search brought up this FAQ: Coders' Rights Project Vulnerability Reporting FAQ (https://www.eff.org/issues/coders/vulnerability-reporting-faq https://www.eff.org/issues/coders/vulnerability-reporting-fa...)
- pmiller2 9y agoSeems to me that given the way it's likely to be received, the proper way to disclose a vulnerability like this is anonymously, through a lawyer.
- lr4444lr 9y agoWhat about XFRS, CORS protection, …? This was 2008. We still had the <blink> tag back then. Heh.
- jeremyt 9y agoI wrote this a couple years ago about Schwab's embarrasing security. Most of the issues are still there. https://jeremytunnell.com/2014/12/22/swab-password-policies-and-two-factor-authentication-a-comedy-of-errors/ https://jeremytunnell.com/2014/12/22/swab-password-policies-...
- oogali 9y agoFYI, Password + token is a common pattern in systems where hardware/software/OTP tokens were bolted on after the fact. Not just that, but on certain systems (think a Windows login screen, or a POP3/IMAP login for your e-mail client), you can't have a 3rd "token" field -- they're hardcoded to ask for just a username and password. So vendors came up with the idea of appending the token value onto the password, and their middleware (say, a PAM module) splits the provided value into password and token and validates both. EDIT: That's not to say that Schwab is doing it right (in the front-end, seriously???), but just pointing it it's not as uncommon as you think.
- jodrellblank 9y agoRADIUS backend to network equipment as well. Since RADIUS is old, it doesn't have great password hash/encryption support (afaik), so you don't use it over open networks already, and it's well entrenched / widely supported. So have it with no encryption, and the back-end can pull the password and 2FA code apart and verify both of them, for all kinds of systems which have only a username/password prompt for logins.
- raybb 9y agoWow, how has this not gotten more attention?
- Atheros 9y agoIt has. It's just been like that for years.
- asafira 9y agoAre most of these actually still there? The password requirements have changed dramatically in the last 6 months.
- exabrial 9y agoSheesh... From a personal liability standpoint, better to just post these things to the company anonymously. Give them the standard window (90 days) then go public.
- kevin_thibedeau 9y agoThere was no value in discussing this over the phone. Clearly their only motivation was to trick him into signing the NDA or foolishly becoming an employee to keep him silenced. Just send in the bug report and empty your account. If the bug persists after 6 months then close the account and go to public disclosure.
- fulldecent 9y agoYes, this is my new IJDGAF policy. The phone call was a losing proposition from the beginning. However if the FBI and NCFTA were /genuinely/ interested in disclosing this in their forum for other banks then maybe my phone call with them may have been a win-win. But I think they were not genuinely interested.
- iamleppert 9y agoThere needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy would be a lawyer. This is for cases where you want the credit but still want the protections afforded by being somewhat anonymous. Similar to WikiLeaks but more focused on allowing the company or entity to solve their problems and representing fairness on all sides.
- runamok 9y agoPersonally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another three letter agency). I wonder if an org like the EFF could add this to their scope.
- archon810 9y agoYou're thinking CIA and NSA.
- runamok 9y agoAnd DEA, DHS and many, many more. > The National Security Agency is now able to share raw surveillance data with all 16 of the United States government's intelligence groups, including the Central Intelligence Agency, Federal Bureau of Investigation, Department of Homeland Security and Drug Enforcement Administration. refs: https://www.engadget.com/2017/01/12/obama-expands-the-nsas-ability-to-share-data-with-other-agencie/ https://www.engadget.com/2017/01/12/obama-expands-the-nsas-a... https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Members https://en.wikipedia.org/wiki/United_States_Intelligence_Com... http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...
- user5994461 9y ago
- bluetwo 9y agoWell, good luck.
- briankwest 9y agoOr they call the FBI and bust your ass and you have to file bankruptcy and get probation.
- walrus01 9y agoI recently dropped a credit union because they can't be bothered to secure their mobile app (in the official google play store!) to use anything better than TLS1.0. TLS1.2 and proper crypto schemes should be mandatory at this point.
- web007 9y agoThey were going to be required by 2016, but then PCI-DSS decided to give companies an extra 2 years to implement the changes. https://cdn2.hubspot.net/hubfs/281302/Resources/Migrating_from_SSL_and_Early_TLS_-v12.pdf https://cdn2.hubspot.net/hubfs/281302/Resources/Migrating_fr...
- abalone 9y agoSerious question: Would the FBI actually come to your door if you went full disclosure with a banking zero day? Is there real legal exposure here or was that just bluster from Zecco/TradeKing?
- fulldecent 9y agoSurely Raneri had no authority to speak for FBI. BUT actually this vuln may have been from upstream with Penson. And then it may affect many broker-dealers. They have many clients in US and Canada. (Don't laugh that such a ridiculous vuln could be in so many places.) At the time, considering this (and Penson was on the phone) I understood that irresponsible disclosure could have serious consequences. FBI would have been warranted to knock on my door. That's why I'm now publishing 10 years after the fact.
- noonespecial 9y agoThe craziest thing is how hard they work to cover it up and not fix it vs how blindingly easy it always seems that fixing it would be. It's like circumnavigating the globe backwards in order to avoid using a crosswalk.
- galdosdi 9y agoNote to self: The right thing to do, if you find a serious vulnerability, apparently, is consult an attorney. Geez, what a world.
- Havoc 9y ago>Geez, what a world. *America
- mtempm 9y ago>if somebody sent you an email with that code (even if you never open the email) then you would be the unwitting owner of one share of Krispy Kreme Donuts Pardon my ignorance, but how would this work?
- grav 9y agoI felt ignorant first when reading it as well. But looking at the "FAQ" at the bottom, it says: "But this only affects people that are logged in, right? Yes ..." So I suppose what happens is, that the user is already logged into the service and thus has a cookie for the service in his browser. If the user then somehow executes a request to the URL in the article with the same browser (eg viewing a malicous email with the IMG tag in a webmail client), the browser will enclose the cookie in the header of the request. This makes the request automatically authenticated.
- mtempm 9y ago>eg viewing a malicous email with the IMG tag in a webmail client The article mentions it would occur even without opening the email.
- palunon 9y agoWell, it is possible your email client is doing prefetching. I wouldn't rate it as probable, since you're unlikely to have a client with the same cookies than your web browser, but still. You could also abuse Firefox and Chrome prefetching links. I'm not sure Gmail for example remove prefetching attributes in spam links. They do block images though.
- mtempm 9y agoGood point. Anyways, how would it work with the server receiving any data from the client just by viewing the link in your browser?
- 3JPLW 9y agoSurely one acquisition and 9 years later this isn't still an open vulnerability… right? It'd be nice if the author discussed that.
- xigency 9y agoHopefully, he closed his account in that time, so he wouldn't know.
- fulldecent 9y agoI have closed my account and do not know the answer. Also, please if someone would be able to confirm in the affirmative in this or any other Penson site, then please start a new round of responsible disclosure.
- fulldecent 9y agoOnly briefly mentioned in the article: > 2017 I have yet hear from FINRA that any action has been taken. I have yet to hear from ZECCO / TradeKing that the issue has been resolved.
- alkonaut 9y agoI'm not quite following the timeline: why did he end up under an NDA and the too-long wait to get it fixed? Why not say "I'm publishing this on my blog in 30 days so it better be fixed by then"? Would you risk getting in legal trouble for publishing a way to do bank fraud (for example) - assuming you gave some reasonable timeframe for disclosure?
- alexbecker 9y ago> Would you risk getting in legal trouble for publishing a way to do bank fraud (for example) - assuming you gave some reasonable timeframe for disclosure? Of course you would. The bank would call the FBI and tell them you're hacking the bank, and the FBI would then knock down your door, tear up your house and drag you away. The system would then do everything it could to represent what you did as a crime, and if you are lucky you get away with only a year in court, many thousands in debt and your name dragged through the mud. tl;dr The actual legality of an action is only tangentially related to how the legal system will be used against you in response to it.
- alkonaut 9y agoSo basically what's needed is a place to send these notices anonymously and a place to anonymously publish the exploit after responsible disclosure - at least for countries where legislation works like you describe. I still hope this is not the case in most places outside the US - that is, I hope the responsible disclosure is complete proof you are in fact not hacking anyone.
- fulldecent 9y agoThat's how I started the discussion with Zecco. The next phone call had the FBI on the line. Then I signed the NDA. Next time I would change 30 to a reasonable number. In this case (multiple vendors and a large installed base) maybe even 180 days may have been fair. And then I would stick to my guns.
- alkonaut 9y agoThanks for the follow up and good luck next time!
- mathattack 9y agoPalo Alto's school district just got hit by similar. https://www.paloaltoonline.com/news/2017/04/20/pausd-student-data-exposed-in-data-breach https://www.paloaltoonline.com/news/2017/04/20/pausd-student...
- campuscodi 9y agoHasn't this guy ever heard of CERT?
- konceptz 9y agoI think that an important point in this vulnerability is that it does not violate the CFAA. From my, albeit limited, understanding of the CFAA, it requires access breach. Imagine this conversation were the user to have discovered a parameter which let the user execute trades on behalf of another user.
- PeterisP 9y agoThis vulnerability does allow to execute trades on behalf of another user. For example, a realistic exploit would be to slowly buy up a bunch of a random penny stock; and then post an image link to some forum frequented by users of that software with the order "buy 10000 units of stock_x, okthxbye". The order will be executed by users viewing that forum and will bump up the price as you dump it.
- kelvin0 9y agoJust to be clear I also find it appalling that any important institution would take their time in fixing such a simple exploit. But it seems the reason why these cases don't get resolved quickly is purely for economic reasons: the perceived cost of fixing the issue seems (to them) is far greater than the cost of dealing with the (remote?) possibility of the exploitation of the vulnerability. I also think the security researchers have an 'overgrown' sense of the urgency upon having discovered such exploits, and it never seems to get fixed fast enough from their point of view. But understanding the forces that are at play, also helps understanding such an 'irrational' decision. Big institutions are not known to be proactive and the political climate in such environments does not incentive the 'doers' but does get people in panic mode to try to stop the leak, instead of the root cause (the exploit).
- fulldecent 9y agoYES. Many authors love to write more than the readers love to read them. FIRST, be reasonable. This is a good life axiom. Don't expect a large organization to confirm, engineer, test certify, and deploy a change that requires external documentation in less than 14 days. Even if the ship's on fire. SECOND, be valuable. If you are reporting a vuln that is a bug report. When's the last time you got thanked for /any/ buy report for a non-GitHub project? If your report explains the cost and liability for lawsuit if they fail to fix your reported vuln then you are speaking their language. --- I have a confirmed vuln reported to Apple under their "responsible disclosure" program since 2015. They have yet to fix it or provide credit as they promised. If you thought Apple was a magic company that "does the right thing", then I hope this dispels that myth.
- tomrod 9y agoWhat bank or financial firm has 100k branches? That's a HUGE presence.
- fulldecent 9y agoPenson created the system that multiple brokers use for multiple branches. I cannot verify that number but I am quoting it from a phone call with a Penson engineer.
- brilliantcode 9y agothis is a major bombshell. I'd hate to be those guys running zecco. The fact that they coerced an NDA to hide the millions of customer transactions that now have no way of proving were legitimate or not. I'm pretty sure the author wasn't the only guy looking for vulnerability. I'm pretty certain criminal minded folks would've already used it....with no way of finding out which are real or manipulated. Which further raises the question, why they would go to extreme length to cover their tracks? They could've easily saved themselves trouble by coming clean but because they've gone such great length to hide it and threaten anyone who tries to expose it makes this a hollywood type story. That just seems so over the top like they are protecting something much bigger.
- justinclift 9y agoWorst case (?) scenario, they were abusing the system themselves or were being pressured to allow others to do so. It's unlikely, but my point is it's a hole in their system which would allow this to happen and it seems like they've deliberately let it continue. :(
- fulldecent 9y agoThanks for understanding. I was writing this up and wasn't sure anyone would really connect with the story or care about one line of code against a now non-existing broker. I'm so happy to hear this support.
- patmcguire 9y ago> October 2008 This may be a lot of it. In October 2008, a massive security breach affecting all accounts was maybe a solid #2 on their list of problems.
- fulldecent 9y agoVery nice LOL here.
- a3n 9y ago> What Happens When You Send a Zero-Day to a Bank? The police rappel down the sides of your house in full gear and shoot your dog. Or, per the article, the company pressures you to sign an NDA, and mentions "FBI" to instill fear of rappelling.
- anon263626 9y agoMudge at DefCon IIRC had a good point about MIC contractors having Intellectual Property repeatedly stolen, govt gives more money each time and disincentives to root-cause analysis and patching vulns/0days.
- samplonius 9y agoWhen you submit a zero day to a bank, maybe let us know. I this case, you submitted a zero-day to a trader-broker, not a bank.
- emmelaich 9y agoWith some hindsight perhaps the Term of the NDA could have been improved by adding 'until ten years have passed' Is that a common element of an NDA's term?
- tjpnz 9y agoA strong argument can be made against revealing your name when disclosing information like this - especially if you're dealing with banks (often litigious and technically illiterate) and even more so if you're in the United States. If I was the OP I would've found a way of reporting this information to the bank anonymously. Possibly followed up with a promise of media disclosure if not fixed in a timely manner.
- jvdh 9y agoThings have progressed quite a bit since 2008 fortunately. Vulnerability disclosures have become much more acceptable, and are handled in a much better way. Lots more information about disclosure: * https://www.ee.oulu.fi/research/ouspg/Disclosure_tracking https://www.ee.oulu.fi/research/ouspg/Disclosure_tracking * https://www.ntia.doc.gov/blog/2016/improving-cybersecurity-through-enhanced-vulnerability-disclosure https://www.ntia.doc.gov/blog/2016/improving-cybersecurity-t... * https://www.thegfce.com/initiatives/r/responsible-disclosure-initiative-ethical-hacking https://www.thegfce.com/initiatives/r/responsible-disclosure...
- homakov 9y agoExactly what happened to me with Starbucks (https://sakurity.com/blog/2015/05/21/starbucks.html https://sakurity.com/blog/2015/05/21/starbucks.html) - threats, signing NDA, they disappear.
- fulldecent 9y agoThanks for sharing, I remember seeing this before. Fun to read again!
- fixxer 9y agoUgh, I hate hearing about crap like this. Unfortunately, the incentives at large, public, consumer-facing companies always drives this behavior. I would have done the following: 1. Shut down my account. 2. Send the exploit to the company anonymously with a deadline to fix. 3. Upon deadline, post exploit and cc the company. The inability to publish is a rub, but I think we need a cultural shift to drive back corporate idiocy and protect consumers.
- jupenur 9y agoIn Finland, most online stores allow you to pay for your shopping directly using your online bank. The way it works is the online store calls the bank's e-payment API, which in turn lets the user authenticate using their normal online bank credentials and accept the payment. A few months back I did some research [1] on these e-payment APIs and noticed that one of the major banks had a serious flaw in their API implementation. It was possible for the end-user to manipulate the signed API calls to change the payment amount, effectively paying less than the actual price for products they buy. I reported the issue to the bank and got a swift response where they acknowledged my report and said they were looking into it more closely. A few days later I got another email where they basically said "ok, this looks bad, and we can see it's pretty trivial to exploit, but... it's too expensive to fix, so we won't do anything". I wasn't comfortable with this, so next I reported it to NCSC-FI/CERT-FI. They also agreed that it looked bad, but said that they had no way of forcing the bank to take action. So that got me nowhere either. I haven't heard from either NCSC-FI or the bank since, but the issue does appear to be partially mitigated now. I've since found several other issues in the same bank's systems but haven't bothered to report them since they don't really seem to care. [1] https://www.slideshare.net/JuhoNurminen/the-sorry-state-of-finnish-epayment-apis https://www.slideshare.net/JuhoNurminen/the-sorry-state-of-f...
- noir_lord 9y agoPost them anonymously and see how fast they become too expensive to not fix.
- Jweb_Guru 9y agoUnless you think this would actually lead to banks taking such vulnerabilities more seriously in general--which I don't believe is the case--taking an action like that is pure spite. Consider the possible outcomes for this particular vulnerability: [1] nothing happens, [2] it gets heavily exploited, customers lose money, and it doesn't get fixed, [3] the same thing happens and it does get fixed. In all three cases, the outcome is at least as bad as it would have been had you done nothing, except possibly earlier and worse. I really take issue with the notion that security is important, so you're fully justified in screwing people and companies over as much as possible to prove a point. That seems to be a common attitude in the security community. I get the frustration people have with the intransigence of corporations and programmers, and people's general stubborn unwillingness to understand the severe impact of vulnerabilities, but if just security-shaming companies into fixing bugs actually worked we would have a much more secure internet today than we actually do. Unless you can get regulatory agencies to start holding companies and individuals legally accountable for security issues (that is, making it more expensive not to fix than to fix), nothing will change, even if you have all the technical solutions and social pressure in the world.
- stefek99 9y agoBalls. Made of steel.