11 ms·

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can

There needs to exist a legal entity/non-profit or company that acts as a shield and/or escrow for these kinds of situations. Basically, as a researcher you can have them deal with the company/organization for you, including dealing with any threats, collecting any bounties due, and such. The company could have domain expertise of the industry, laws, and generally be a force against these companies -- the analogy would be a lawyer. This is for cases where you want the credit but still want the protections afforded by being somewhat anonymous. Similar to WikiLeaks but more focused on allowing the company or entity to solve their problems and representing fairness on all sides.

runamok 10y ago
Personally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another three letter agency). I wonder if an org like the EFF could add this to their scope.
- archon810 10y ago
  You're thinking CIA and NSA.
  - runamok 10y ago
    And DEA, DHS and many, many more. > The National Security Agency is now able to share raw surveillance data with all 16 of the United States government's intelligence groups, including the Central Intelligence Agency, Federal Bureau of Investigation, Department of Homeland Security and Drug Enforcement Administration. refs: https://www.engadget.com/2017/01/12/obama-expands-the-nsas-ability-to-share-data-with-other-agencie/ https://www.engadget.com/2017/01/12/obama-expands-the-nsas-a... https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Members https://en.wikipedia.org/wiki/United_States_Intelligence_Com... http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...
- user5994461 10y ago
  > However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda. There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.
  - WJW 10y ago
    So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
    - strictnein 10y ago
      It'd be tough to form an international legal entity anyways.
    - user5994461 10y ago
      Then you don't report that to the FBI, it's not their jurisdiction.
    - thecrazyone 10y ago
      It's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)
  - colordrops 10y ago
    What makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.
  - njharman 10y ago
    > They are still here to protect americans That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".
- rz2k 10y ago
  How about the National Institute of Standards and Technology? My impression is that they are less interested in offense compared to the NSA, and more serious than possible private entities like PCI.
- tptacek 10y ago
  Whatever we might think about this idea, neither FBI nor NIST has the staffing to handle vulnerability reports. I've heard good things about reporting incidents to FBI, but there's pretty much no chance FBI (or NIST) is going to help you coordinate disclosure. FBI works cases. NIST is, for security stuff, something like 10 people.
- steamer25 10y ago
  Someone in another forum commented recently that there should be a new top-line federal agency whose mission is to promote the security of America's information infrastructure. They suggested it should be established as an adversarial check/balance against e.g., the CIA and NSA. https://twitter.com/Snowden/status/839168025517522944 https://twitter.com/Snowden/status/839168025517522944 Maybe if they were required by statute to accept anonymous submissions and make FOIA-style responsible disclosures after a reasonably short period of time, they wouldn't end up colluding right away.
  - azernik 10y ago
    The already exists an agency with this mission: the NSA. The problem is that they have two often-conflicting mission statements, WTH the other being to spy on foreign adversaries. Really what this would entail is splitting the NSA into two bureaucracies, with the information-security one then being able to wholeheartedly pursue vulnerabilities that affect American infrastructure. The offensive organization wold probably then still sit on vulnerabilities only it knew about, but at least this would be better than the current situation.
    - nickpsecurity 10y ago
      "The already exists an agency with this mission: the NSA." It's a myth far as I know. I've studied them a long time seeing much conflicting info about this. A declassified, historical document I found at one point about them said their job was SIGINT and COMSEC (just communications security!) for U.S. government. A later provision extended this to protecting COMSEC of defense contractors. The IAD seems to have policy-driven stuff about helping protect INFOSEC in general. There could've been a COTS mandate of some sort at some point but it was clearly toothless. The NSA is mandated to protect communication security of defense sector. That's it. Even then, the defense sector keeps asking them to downgrade the security to let in more quick-moving products from commercial sector that are hacker fodder. They've since started on a program that lets them in after a 90-day evaluation against the lowest standards from Common Criteria. The NSA is the last group that should be responsible for INFOSEC given all this w/ market an utter failure, too. The groups that have done the most are probably NSF and DARPA for funding strong security with NIST and DISA (esp STIGS) at least trying to do something with hardening guides and crypto recommendations. I prefer reputation-driven nonprofits that are funded with combo of donations, licensing of quality software, and consulting fees. They can't get acquired or be destroyed by changes in government policy.
mseebach 10y ago
There's no analogy - what you're describing is literally a lawyer.
- astrodust 10y ago
  The EFF, ACLU, CBLDF all exist even though they act as lawyers for many people. Safety in numbers, plus trusted reputation.
amenghra 10y ago
Or you can just post your findings to full disclosure and call it a day.
- stagbeetle 10y ago
  What incentive, besides good-boy points and experience/publicity/etc (for more funding), do researchers have to do this?
  - logfromblammo 10y ago
    It's "broken window" community policing. The more unpatched vulnerabilities there are in existence, the more lucrative it is to be involved in any part of the computing crimes community. It's like reglazing a broken window in your neighbor's garage at your own expense, because you don't want burglars to see it and start casing other properties in the same neighborhood based on the conditional probability that a visible broken window indicates a higher incidence of other exploitable vulnerabilities. It's also important to pursue the very easily exploited vulnerabilities, because when you get rid of all the low-hanging fruit, the people who can't already climb the tree won't survive long enough to learn how. You're cutting a lot of bootstraps so that immature criminals can't pull themselves up by them.
    - andai 10y ago
      This was fascinating. Can I read more somewhere?
      - logfromblammo 10y ago
        https://en.wikipedia.org/wiki/Broken_windows_theory https://en.wikipedia.org/wiki/Broken_windows_theory New York City based their increased focus on petty crimes on it. I don't think it is useful as the basis for a model of policing, though. In some ways, it is an embodiment of the slippery slope fallacy, where if security is not perfect, it's worthless, in the same sense that a roof with one leak in it is worthless, because that one leak becomes the beachhead for further damage to the roof.
dheera 10y ago
Why didn't they just give him $10K to shut up and then go fix the issue? It would be cheaper than all the lawyer fees.
- jessaustin 10y ago
  Spending money is part of the point, since that's the way one gains power in large organizations. Even better if one can spend lots of money doing something self-evidently stupid and also rather mean. Large firms wouldn't survive at high enough rates to dominate public life as they do, if they weren't underwritten by the state at every turn.
- Natanael_L 10y ago
  Scare people away from looking. Security by obscurity
- anigbrowl 10y ago
  Because if the vulnerability turns into a problem down the line and ends up in court, the record of the payment could come out during discovery, which could be made to look bad for the defendant firm. Have you heard of Elizabeth Kubler-Ross's '5 stages of grief' model that summarizes people's typical responses to bereavement? EKR argued that people generally go through a cycle of denial, anger, bargaining, depression and acceptance. IME this is a good rule of thumb for how people typically handle any kind of unwelcome news. In this case: o There is no such problem o Grr why did you hack us I'll call the police o How about you take this pittance and STFU o We're just trying to run a business and you ruined everything o OK we'll fix it and alert our customers
- tptacek 10y ago
  Vulnerabilities like these aren't likely to cost anything close to $10K, even if they stay open for years. But stipulate that there's some number here, and the answer is: because nobody in management at Zecco ever built a plan for how to handle incoming vulnerability reports, and so nobody who got the report was empowered to do anything but escalate the issue --- and halfheartedly, at that, because nobody in management at Zecco ever build a policy that ensures anyone cares about vulnerabilities, so this is for them the moral equivalent of a WONTFIX. How diligently would you escalate a WONTFIX?
sytse 10y ago
It sounds like you need HackerOne Disclosure Assistance https://support.hackerone.com/hc/en-us/articles/115001936043-What-is-Disclosure-Assistance-and-how-does-it-work- https://support.hackerone.com/hc/en-us/articles/115001936043... This was introduced 3 days ago https://twitter.com/martenmickos/status/854321634404061185 https://twitter.com/martenmickos/status/854321634404061185 HackerOne will work with friendly hackers on a best effort basis to verify the legitimacy of a vulnerability, reach out to and verify the identity of an individual at the affected organization, then share the vulnerability with the organization so it can be resolved. Seems like it address most of the problems of educating the organization so they don't threaten you.
- summarite 10y ago
  Just that they have a name that will immediately be without any trust at any non -tech company. Basically mentioning "hacking" will make any non-technical CEO shiver and call the lawyers.
  - anigbrowl 10y ago
    OK, let the lawyers handle it. You don't make progress by catering to other people's ignorance and insecurities.
    - mcmarables 10y ago
      You are right, that isn't how you make progress: it's how you make money.
  - sytse 10y ago
    The name is not ideal. I've heard a story of it also not being great for employees when talking to custom officers :/ But any person looking at their homepage would be a lot less concerned. Impressive logo's and a clear story for an enterprise audience.
  - tptacek 10y ago
    It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. They're kind of a big deal. Since they're the ones handling the first contact in these situations, you can safely let their name be their problem; they know how to explain themselves. The more realistic concern here is that for these kinds of findings --- CSRFs in random web applications --- there simply isn't going to be a contact at the target company, and H1 isn't going to find one for you. That's why they point out they can't promise a contact.
phoneyphone 10y ago
There's a service called Synack that does something similar to what you describe
aanm1988 10y ago
Professional association of security researchers? Come up with a good set of guiding principles for members. This would help avoid waiting 7 years and then sticking it online. Not criticising, I'm saying the situation here is pretty screwed up. Members pay dues, the association provides backing. Company threatens to call the FBI and the association is the one they can deal with. An organized group can help to provide the needed political pressure so that a properly disclosed vulnerability doesn't ever lead to the FBI and trumped up charges. A respected group can lend credibility to a researcher. A bank may not give 2 shits about even a well respected member of the community. They will care if it's a group well known for finding and disclosing vulnerabilities. This seems like an easier problem than the general case of software engineers because the community is smaller and you don't have the conflicting interests of "I can negotiate better on my own". Plus things like membership can be handled more easily, start with a small group of people who absolutely should be members. Extend via application and invite.
- nullc 10y ago
  > Professional association of security researchers It's next door to the military intelligence folks. (ba-da-bump)
- fulldecent 10y ago
  Thank you. This seems like a great idea. I would be more open about it. Rather than fees and membership, I would have a list of contributors and cross-checked publications. Basically like a resume. I.e. if you want to announce a vuln we would help you timestamp it, and optionally have a person you trust vouch for its authenticity. And if having that timestamp and cross check is valuable to you then you can brag about it when you contact the vendor. I'd like to work in an organization like this. I'm not sure if anyone would want to join. It seems like everyone else is either completely independent like my own IDJGAF strategy or they are full corporate like HackerOne and other brokers.
vellum 10y ago
CERT and the Zero Day Initiative handle disclosure for you, in some cases. https://vulcoord.cert.org/VulReport/ https://vulcoord.cert.org/VulReport/ http://www.zerodayinitiative.com/about/ http://www.zerodayinitiative.com/about/
- tptacek 10y ago
  Both of these organizations might be "helpful" if you have a new Internet Explorer vulnerability, but neither will likely help you with a CSRF bug in a bank website.
  - fulldecent 10y ago
    Still, thanks for sharing. Research ethics is always something I'm interested to read.
Animats 10y ago
There is. Carnegie-Mellon University's CERT. Here's the form for reporting a vulnerability.[1] For this kind of problem, select "Request Vulnerability Coordination Assistance". You can even do this anonymously. The report isn't public yet, but it's on record. You've reported it to the organization funded by Homeland Security to take such reports. In 45 days, CERT will disclose it to the public.[2] CERT may contact the bank themselves. If you do, you can cite the CVE vulnerability number they give you. This gives you some advantages when talking to a bank. "Have your technical people contact Homeland Security's US-CERT at (888) 282-0870 regarding CVE-NNNN" will usually deal with a bank's people. They can't make the problem disappear. [1] https://vulcoord.cert.org/VulReport/ https://vulcoord.cert.org/VulReport/ [2] http://www.cert.org/vulnerability-analysis/vul-disclosure.cfm http://www.cert.org/vulnerability-analysis/vul-disclosure.cf...
- tptacek 10y ago
  I don't recommend submitting to CERT unless you genuinely don't care about the outcome of reporting. Yes, reporting to CERT is "safe"; you almost certainly aren't going to get sued for doing it. But don't count on CERT coordinating a fix or even figuring out how to report flaws to. It's unlikely that anyone at CERT knows who "Zecco" is. CERT themselves ask you not to submit to CERT unless your vulnerability fits some specific criteria. "Unresponsive vendor" is one of those, but CERT's fine print says that they prioritize severe, multi-vendor vulnerabilities. Anyone who runs a bug bounty program can tell you how unrealistic it is to rely on CERT for this stuff: triaging reports for just one vendor is a full-time job. CERT wants to get early warnings of things like OS and platform vulnerabilities. I don't think it's a good idea to report those to CERT either, but regardless, CERT isn't set up to handle your CSRF report in some random website.
  - Animats 10y ago
    Even if CERT doesn't do much actively, you've put the problem on record and can refer to that record when dealing with vendors. Most companies can ignore security vulnerability reports if they choose, but a bank cannot. They have an obligation to report the vulnerability to their auditors. It triggers certain Sarbanes-Oxley reporting requirements.[1] It's easier to fix the problem than deal with the problems of having a logged, unfixed vulnerability. [1] https://www.a2q2.com/blog/sox/29-cyber-security-and-sox/ https://www.a2q2.com/blog/sox/29-cyber-security-and-sox/
yeukhon 10y ago
How about Google? If you discover a big vulnerability, perhaps? Someone ought to have some connection somewhere. Ask your colleagues around.
nullc 10y ago
> the analogy would be a lawyer. You can use a lawyer for this, this is a standard piece of advice for other kinds of bounties-- e.g. reporting criminal tax evasion.
daveheq 10y ago
What, more government spending and taxes and regulation? That's anti-American! Are you a traitor? Get the government out of our lives! Let the free market fix this. If you don't like it, just don't buy it. We don't need more acronyms! Just a bunch of bureaucrats! Drop more bombs! /sarc
jart 10y ago
There was a guy who got thrown in prison for bringing a vulnerability to the attention of AT&T. He was thrown in solitary confinement for over a year. Then his sentence got vacated. What did he do as soon as he was released from prison? He went on CNBC to argue that independent security researchers should start a hedge fund that short sells the stocks of companies affected by vulnerabilities. https://youtu.be/jxUWRRDdhVI https://youtu.be/jxUWRRDdhVI He seems to be of the opinion that this would be a less risky strategy than bringing those issues to the attention of many companies. He also believes that profit incentives for researchers will serve the public interest, because it creates economic disincentives against big companies having insecure software.
- spectrum1234 10y ago
  This is brilliant. And if companies are going to be so resistant this is the obvious solution.
  - netsharc 10y ago
    Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
    - pbhjpbhj 10y ago
      Then the company could contact the fund holders for information and they could tell them "we'll let you know about the vulnerability in a month or two".
- noir_lord 10y ago
  Company name is TRO LLC. That is hilarious.
- 3pt14159 10y ago
  He didn't "bring the vulnerability to the attention of AT&T" he fucking told Gawker first. Furthermore, he's part of a number of black hat hacker groups, including an anti-semitic one despite the fact that he's Jewish. There are examples of honest people getting fucked over, but this isn't one of them.
i336_ 10y ago
I was thinking of exactly this as I read the article. In a situation like this I'd probably directly ping taviso or someone else from the Google Project Zero team. Their contact information (email, G+, twitter (DM)) is not impossible to get at. From there, I could get advice about next steps (the Project Zero team are going to know a few people) or maybe they could run with it themselves (depending on the bug; I don't know what the response would have been in this case).
- fulldecent 10y ago
  Thank you, going forward this looks like a great start. And I have always had great experience reaching directly to Googlers when needing connections or technical advice.
  - i336_ 10y ago
    > I have always had great experience reaching directly to Googlers when needing connections or technical advice. Mind sharing how you've achieved this? I haven't had the same level of success, with my couple of attempts (thus far) to try to resolve various issues falling flat.

runamok 10y ago

Personally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another three letter agency). I wonder if an org like the EFF could add this to their scope.

archon810 10y ago
You're thinking CIA and NSA.
- runamok 10y ago
  And DEA, DHS and many, many more. > The National Security Agency is now able to share raw surveillance data with all 16 of the United States government's intelligence groups, including the Central Intelligence Agency, Federal Bureau of Investigation, Department of Homeland Security and Drug Enforcement Administration. refs: https://www.engadget.com/2017/01/12/obama-expands-the-nsas-ability-to-share-data-with-other-agencie/ https://www.engadget.com/2017/01/12/obama-expands-the-nsas-a... https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Members https://en.wikipedia.org/wiki/United_States_Intelligence_Com... http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...
user5994461 10y ago
> However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda. There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.
- WJW 10y ago
  So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
  - strictnein 10y ago
    It'd be tough to form an international legal entity anyways.
  - user5994461 10y ago
    Then you don't report that to the FBI, it's not their jurisdiction.
  - thecrazyone 10y ago
    It's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)
- colordrops 10y ago
  What makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.
- njharman 10y ago
  > They are still here to protect americans That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".
rz2k 10y ago
How about the National Institute of Standards and Technology? My impression is that they are less interested in offense compared to the NSA, and more serious than possible private entities like PCI.
tptacek 10y ago
Whatever we might think about this idea, neither FBI nor NIST has the staffing to handle vulnerability reports. I've heard good things about reporting incidents to FBI, but there's pretty much no chance FBI (or NIST) is going to help you coordinate disclosure. FBI works cases. NIST is, for security stuff, something like 10 people.
steamer25 10y ago
Someone in another forum commented recently that there should be a new top-line federal agency whose mission is to promote the security of America's information infrastructure. They suggested it should be established as an adversarial check/balance against e.g., the CIA and NSA. https://twitter.com/Snowden/status/839168025517522944 https://twitter.com/Snowden/status/839168025517522944 Maybe if they were required by statute to accept anonymous submissions and make FOIA-style responsible disclosures after a reasonably short period of time, they wouldn't end up colluding right away.
- azernik 10y ago
  The already exists an agency with this mission: the NSA. The problem is that they have two often-conflicting mission statements, WTH the other being to spy on foreign adversaries. Really what this would entail is splitting the NSA into two bureaucracies, with the information-security one then being able to wholeheartedly pursue vulnerabilities that affect American infrastructure. The offensive organization wold probably then still sit on vulnerabilities only it knew about, but at least this would be better than the current situation.
  - nickpsecurity 10y ago
    "The already exists an agency with this mission: the NSA." It's a myth far as I know. I've studied them a long time seeing much conflicting info about this. A declassified, historical document I found at one point about them said their job was SIGINT and COMSEC (just communications security!) for U.S. government. A later provision extended this to protecting COMSEC of defense contractors. The IAD seems to have policy-driven stuff about helping protect INFOSEC in general. There could've been a COTS mandate of some sort at some point but it was clearly toothless. The NSA is mandated to protect communication security of defense sector. That's it. Even then, the defense sector keeps asking them to downgrade the security to let in more quick-moving products from commercial sector that are hacker fodder. They've since started on a program that lets them in after a 90-day evaluation against the lowest standards from Common Criteria. The NSA is the last group that should be responsible for INFOSEC given all this w/ market an utter failure, too. The groups that have done the most are probably NSF and DARPA for funding strong security with NIST and DISA (esp STIGS) at least trying to do something with hardening guides and crypto recommendations. I prefer reputation-driven nonprofits that are funded with combo of donations, licensing of quality software, and consulting fees. They can't get acquired or be destroyed by changes in government policy.

mseebach 10y ago

There's no analogy - what you're describing is literally a lawyer.

astrodust 10y ago
The EFF, ACLU, CBLDF all exist even though they act as lawyers for many people. Safety in numbers, plus trusted reputation.

amenghra 10y ago

Or you can just post your findings to full disclosure and call it a day.

stagbeetle 10y ago
What incentive, besides good-boy points and experience/publicity/etc (for more funding), do researchers have to do this?
- logfromblammo 10y ago
  It's "broken window" community policing. The more unpatched vulnerabilities there are in existence, the more lucrative it is to be involved in any part of the computing crimes community. It's like reglazing a broken window in your neighbor's garage at your own expense, because you don't want burglars to see it and start casing other properties in the same neighborhood based on the conditional probability that a visible broken window indicates a higher incidence of other exploitable vulnerabilities. It's also important to pursue the very easily exploited vulnerabilities, because when you get rid of all the low-hanging fruit, the people who can't already climb the tree won't survive long enough to learn how. You're cutting a lot of bootstraps so that immature criminals can't pull themselves up by them.
  - andai 10y ago
    This was fascinating. Can I read more somewhere?
    - logfromblammo 10y ago
      https://en.wikipedia.org/wiki/Broken_windows_theory https://en.wikipedia.org/wiki/Broken_windows_theory New York City based their increased focus on petty crimes on it. I don't think it is useful as the basis for a model of policing, though. In some ways, it is an embodiment of the slippery slope fallacy, where if security is not perfect, it's worthless, in the same sense that a roof with one leak in it is worthless, because that one leak becomes the beachhead for further damage to the roof.

dheera 10y ago

Why didn't they just give him $10K to shut up and then go fix the issue? It would be cheaper than all the lawyer fees.

jessaustin 10y ago
Spending money is part of the point, since that's the way one gains power in large organizations. Even better if one can spend lots of money doing something self-evidently stupid and also rather mean. Large firms wouldn't survive at high enough rates to dominate public life as they do, if they weren't underwritten by the state at every turn.
Natanael_L 10y ago
Scare people away from looking. Security by obscurity
anigbrowl 10y ago
Because if the vulnerability turns into a problem down the line and ends up in court, the record of the payment could come out during discovery, which could be made to look bad for the defendant firm. Have you heard of Elizabeth Kubler-Ross's '5 stages of grief' model that summarizes people's typical responses to bereavement? EKR argued that people generally go through a cycle of denial, anger, bargaining, depression and acceptance. IME this is a good rule of thumb for how people typically handle any kind of unwelcome news. In this case: o There is no such problem o Grr why did you hack us I'll call the police o How about you take this pittance and STFU o We're just trying to run a business and you ruined everything o OK we'll fix it and alert our customers
tptacek 10y ago
Vulnerabilities like these aren't likely to cost anything close to $10K, even if they stay open for years. But stipulate that there's some number here, and the answer is: because nobody in management at Zecco ever built a plan for how to handle incoming vulnerability reports, and so nobody who got the report was empowered to do anything but escalate the issue --- and halfheartedly, at that, because nobody in management at Zecco ever build a policy that ensures anyone cares about vulnerabilities, so this is for them the moral equivalent of a WONTFIX. How diligently would you escalate a WONTFIX?

sytse 10y ago

It sounds like you need HackerOne Disclosure Assistance https://support.hackerone.com/hc/en-us/articles/115001936043-What-is-Disclosure-Assistance-and-how-does-it-work- https://support.hackerone.com/hc/en-us/articles/115001936043... This was introduced 3 days ago https://twitter.com/martenmickos/status/854321634404061185 https://twitter.com/martenmickos/status/854321634404061185 HackerOne will work with friendly hackers on a best effort basis to verify the legitimacy of a vulnerability, reach out to and verify the identity of an individual at the affected organization, then share the vulnerability with the organization so it can be resolved. Seems like it address most of the problems of educating the organization so they don't threaten you.

summarite 10y ago
Just that they have a name that will immediately be without any trust at any non -tech company. Basically mentioning "hacking" will make any non-technical CEO shiver and call the lawyers.
- anigbrowl 10y ago
  OK, let the lawyers handle it. You don't make progress by catering to other people's ignorance and insecurities.
  - mcmarables 10y ago
    You are right, that isn't how you make progress: it's how you make money.
- sytse 10y ago
  The name is not ideal. I've heard a story of it also not being great for employees when talking to custom officers :/ But any person looking at their homepage would be a lot less concerned. Impressive logo's and a clear story for an enterprise audience.
- tptacek 10y ago
  It is unlikely that there is a company in the US that has a security team that hasn't heard of H1. They're kind of a big deal. Since they're the ones handling the first contact in these situations, you can safely let their name be their problem; they know how to explain themselves. The more realistic concern here is that for these kinds of findings --- CSRFs in random web applications --- there simply isn't going to be a contact at the target company, and H1 isn't going to find one for you. That's why they point out they can't promise a contact.

phoneyphone 10y ago

There's a service called Synack that does something similar to what you describe

aanm1988 10y ago

Professional association of security researchers? Come up with a good set of guiding principles for members. This would help avoid waiting 7 years and then sticking it online. Not criticising, I'm saying the situation here is pretty screwed up. Members pay dues, the association provides backing. Company threatens to call the FBI and the association is the one they can deal with. An organized group can help to provide the needed political pressure so that a properly disclosed vulnerability doesn't ever lead to the FBI and trumped up charges. A respected group can lend credibility to a researcher. A bank may not give 2 shits about even a well respected member of the community. They will care if it's a group well known for finding and disclosing vulnerabilities. This seems like an easier problem than the general case of software engineers because the community is smaller and you don't have the conflicting interests of "I can negotiate better on my own". Plus things like membership can be handled more easily, start with a small group of people who absolutely should be members. Extend via application and invite.

nullc 10y ago
> Professional association of security researchers It's next door to the military intelligence folks. (ba-da-bump)
fulldecent 10y ago
Thank you. This seems like a great idea. I would be more open about it. Rather than fees and membership, I would have a list of contributors and cross-checked publications. Basically like a resume. I.e. if you want to announce a vuln we would help you timestamp it, and optionally have a person you trust vouch for its authenticity. And if having that timestamp and cross check is valuable to you then you can brag about it when you contact the vendor. I'd like to work in an organization like this. I'm not sure if anyone would want to join. It seems like everyone else is either completely independent like my own IDJGAF strategy or they are full corporate like HackerOne and other brokers.

vellum 10y ago

CERT and the Zero Day Initiative handle disclosure for you, in some cases. https://vulcoord.cert.org/VulReport/ https://vulcoord.cert.org/VulReport/ http://www.zerodayinitiative.com/about/ http://www.zerodayinitiative.com/about/

tptacek 10y ago
Both of these organizations might be "helpful" if you have a new Internet Explorer vulnerability, but neither will likely help you with a CSRF bug in a bank website.
- fulldecent 10y ago
  Still, thanks for sharing. Research ethics is always something I'm interested to read.

Animats 10y ago

There is. Carnegie-Mellon University's CERT. Here's the form for reporting a vulnerability.[1] For this kind of problem, select "Request Vulnerability Coordination Assistance". You can even do this anonymously. The report isn't public yet, but it's on record. You've reported it to the organization funded by Homeland Security to take such reports. In 45 days, CERT will disclose it to the public.[2] CERT may contact the bank themselves. If you do, you can cite the CVE vulnerability number they give you. This gives you some advantages when talking to a bank. "Have your technical people contact Homeland Security's US-CERT at (888) 282-0870 regarding CVE-NNNN" will usually deal with a bank's people. They can't make the problem disappear. [1] https://vulcoord.cert.org/VulReport/ https://vulcoord.cert.org/VulReport/ [2] http://www.cert.org/vulnerability-analysis/vul-disclosure.cfm http://www.cert.org/vulnerability-analysis/vul-disclosure.cf...

tptacek 10y ago
I don't recommend submitting to CERT unless you genuinely don't care about the outcome of reporting. Yes, reporting to CERT is "safe"; you almost certainly aren't going to get sued for doing it. But don't count on CERT coordinating a fix or even figuring out how to report flaws to. It's unlikely that anyone at CERT knows who "Zecco" is. CERT themselves ask you not to submit to CERT unless your vulnerability fits some specific criteria. "Unresponsive vendor" is one of those, but CERT's fine print says that they prioritize severe, multi-vendor vulnerabilities. Anyone who runs a bug bounty program can tell you how unrealistic it is to rely on CERT for this stuff: triaging reports for just one vendor is a full-time job. CERT wants to get early warnings of things like OS and platform vulnerabilities. I don't think it's a good idea to report those to CERT either, but regardless, CERT isn't set up to handle your CSRF report in some random website.
- Animats 10y ago
  Even if CERT doesn't do much actively, you've put the problem on record and can refer to that record when dealing with vendors. Most companies can ignore security vulnerability reports if they choose, but a bank cannot. They have an obligation to report the vulnerability to their auditors. It triggers certain Sarbanes-Oxley reporting requirements.[1] It's easier to fix the problem than deal with the problems of having a logged, unfixed vulnerability. [1] https://www.a2q2.com/blog/sox/29-cyber-security-and-sox/ https://www.a2q2.com/blog/sox/29-cyber-security-and-sox/

yeukhon 10y ago

How about Google? If you discover a big vulnerability, perhaps? Someone ought to have some connection somewhere. Ask your colleagues around.

nullc 10y ago

> the analogy would be a lawyer. You can use a lawyer for this, this is a standard piece of advice for other kinds of bounties-- e.g. reporting criminal tax evasion.

daveheq 10y ago

What, more government spending and taxes and regulation? That's anti-American! Are you a traitor? Get the government out of our lives! Let the free market fix this. If you don't like it, just don't buy it. We don't need more acronyms! Just a bunch of bureaucrats! Drop more bombs! /sarc

jart 10y ago

There was a guy who got thrown in prison for bringing a vulnerability to the attention of AT&T. He was thrown in solitary confinement for over a year. Then his sentence got vacated. What did he do as soon as he was released from prison? He went on CNBC to argue that independent security researchers should start a hedge fund that short sells the stocks of companies affected by vulnerabilities. https://youtu.be/jxUWRRDdhVI https://youtu.be/jxUWRRDdhVI He seems to be of the opinion that this would be a less risky strategy than bringing those issues to the attention of many companies. He also believes that profit incentives for researchers will serve the public interest, because it creates economic disincentives against big companies having insecure software.

spectrum1234 10y ago
This is brilliant. And if companies are going to be so resistant this is the obvious solution.
- netsharc 10y ago
  Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
  - pbhjpbhj 10y ago
    Then the company could contact the fund holders for information and they could tell them "we'll let you know about the vulnerability in a month or two".
noir_lord 10y ago
Company name is TRO LLC. That is hilarious.
3pt14159 10y ago
He didn't "bring the vulnerability to the attention of AT&T" he fucking told Gawker first. Furthermore, he's part of a number of black hat hacker groups, including an anti-semitic one despite the fact that he's Jewish. There are examples of honest people getting fucked over, but this isn't one of them.

i336_ 10y ago

I was thinking of exactly this as I read the article. In a situation like this I'd probably directly ping taviso or someone else from the Google Project Zero team. Their contact information (email, G+, twitter (DM)) is not impossible to get at. From there, I could get advice about next steps (the Project Zero team are going to know a few people) or maybe they could run with it themselves (depending on the bug; I don't know what the response would have been in this case).

fulldecent 10y ago
Thank you, going forward this looks like a great start. And I have always had great experience reaching directly to Googlers when needing connections or technical advice.
- i336_ 10y ago
  > I have always had great experience reaching directly to Googlers when needing connections or technical advice. Mind sharing how you've achieved this? I haven't had the same level of success, with my couple of attempts (thus far) to try to resolve various issues falling flat.