23 ms·
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
- avaer 9y agoPutting text on a page isn't hard stuff. The hard stuff is teaching computer security to an organization that mistakes responsible disclosure for a hack attempt, and thinks a Twitter block will protect them. It's probably also hard to know what a good security audit looks like, unless you grasp basic security in the first place. I have no idea what the solution is.
- zzzcpan 9y agoI have an idea for a solution. Legalize hacking, let everyone hack each other and spy on each other and what not, make every company out there explicitly aware that the internet is a jungle. This will create a demand for security and force software and hardware manufacturers to actually care about security and so on.
- watwut 9y agoNo, it wont. Because people hack right now too. What it would do however, is that people who have ethical considerations would have to step back against people who dont have them. So, prepare for a lot of insider attacks and back doors. Not that those don't exist now, they do. But your proposal would put more advantage to bad actors as they hAve now, so they would get their way more often.
- uxp 9y agoThe NRA approach to safety and securing yourself and belongings. If everyone has a gun, everyone will be safe. Except for those who once owned guns and after a very scary mishap believe that it's safer to not own guns, and those that have already criminally mishandled guns and used them in commission of serious and violent crimes, and those who after weeks at the shooting range still can't hit the broadside of a barn. Except those people, everyone will be safe. Oh, and children. Screw the children, because they just don't have the mental capacity to understand the consequences that may occur after one shoots another. I like this plan. Can't wait for my father, who can barely figure out how to attach a picture to an email in AOL's webmail to start poking for XSS and CSRF vulnerabilities on the sites his spam mail links to, and changing his username to "1;DROP TABLE users" everywhere.
- zzzcpan 9y agoCyber weapons are already legal to download and posses, it's a very different story from guns. Imagine if your competition could be legally allowed to steal your trade secrets, clients, employees, but only through hacking. Would you not care enough to invest into security?
- curun1r 9y agoPerhaps rather than legalizing hacking, we should inject a common middleman into the vulnerability reporting process. In the US, it could be the Consumer Product Safety Commission. It would ensure that those accepting reports are knowledgeable and treat the report as important and also protect companies from having to deal with random white hats. Serious enough vulnerabilities could result in fines that are partially paid to the reporter as a bounty. It would also protect white hats from threats or retribution since they could remain anonymous if they choose. We already have a process in place to deal with flaws in products produced by unlicensed entrepreneurs. We just need to extend it to apply to software products and services.
- cm2187 9y agoThe internet is already a hostile jungle (look at the logs of any server you control). Legalizing hacking won't change that. It will just add a little more immunity to bad actors. And it's kind of a legalize burglary, so that people will be forced to live in fortified compounds.
- Pxtl 9y agoThe number of times we had terrible vulnerabilities in simple webservers back in the day tells me that even just putting text on a page is hard.
- chii 9y ago> It's probably also hard to know what a good security audit looks like, unless you grasp basic security in the first place. If you replaced security with accounting, the above still makes sense! Why do companies pay through the nose to get an accounting audit done right, but much less willing to do so for a security audit? I say the solution is to put the (legal) responsibility to the company. Once there's financial incentive, it becomes a priority.
- user5994461 9y agoI wonder where you work to NOT have mandatory security audits.
- hxtk 9y agoI'm currently working for a real estate startup and I have to seriously twist their arm to convince them we should authenticate private api requests at all, let alone run vulnerability testing.
- S_A_P 9y agoAll I can imagine that is happening there is panic. Defensive behavior such as this indicates either they don't really know how to fix this quickly, or they just don't care.
- epmaybe 9y agoPanic is the worst response to have in this situation. You have someone who is reporting this in good faith, who probably has an idea as to why the vulnerability exists. Just come out and be like "I don't know what I'm doing" to the individual and see if they can help, and look to hire someone that does know what they're doing.
- confounded 9y agoVery few companies that use technology are technology companies. Is there no open-source standard for authentication and user-data management? Do companies really need to roll their own each time?
- mgkimsal 9y agoit doesn't matter if standards exist. the "right way" to do stuff is "confusing" and "hard to use" for people who are not technology people. "What? I have to check my email for a password reset link? That's confusing?! Our users will not be able to use that! My temporary password is xpJ38@#K1o1n$5@wlo%!pq? This is horrible? My cousin does UX and says this lowers our SEO! Just have it email their password to them! It'll confuse people!" Amalgamation of various reactions I've heard over the years when implementing standard process for password creation/resets.
- JBiserkov 9y agoYou are correct in this universe. But in the universe the grand-parent imagines, none of this is confusing, because EACH AND EVERY WEBSITE on the planet does this, so users (and even managers) have seen this many times already. Jakob's Law of the Internet User Experience (2000): Users spend most of their time on other sites[0]. [Granted, this may not apply to Google/Facebook, it's from an earlier, more civilized, I mean decentralized age.] Also, the standard would use 7-word long pass-phrases [1] which are much more readable, memorable and secure than the abomination above. [0] https://www.nngroup.com/articles/end-of-web-design/ https://www.nngroup.com/articles/end-of-web-design/ [1] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
- jacquesm 9y ago> Very few companies that use technology are technology companies. No, all companies that use technology are technology companies, they just fail to realize this and do not act accordingly.
- theandrewbailey 9y ago
- ScottBurson 9y agoI have trouble understanding this mindset. It's like, if you were walking away from your car in a parking lot, and someone said "Hey! You've left your car unlocked!", and you yelled at them angrily "Stop looking at my car!!!". It makes no sense at all, and yet it's practically the universal response from people who don't know what they're doing. People occasionally suggest that software engineers should be professionally licensed. I have a different proposal: I think that people who want to manage a business involving software development should have to get trained and licensed. ETA: while my proposal is somewhat facetious when considered about all software development, perhaps it's not completely inconceivable that we could require businesses collecting any personal information from users to be licensed and audited. We already have PCI-DSS compliance rules for businesses using credit cards; this would be analogous, though it would have to be enforced by the government, as credit cards wouldn't necessarily be involved.
- chug 9y agoIt's more like running valet parking and leaving other people's cars unlocked. Yeah, you should update your process so that your drivers lock the cars, but oh man, that's kind of hard. What if we just tell people their cars are locked up nice and safe and ignore anyone who says otherwise? That's much easier. I think this response is pretty awful, but I do understand it. This website was probably either made by contractors who are long gone or an internal team who are too incompetent to fix it. Getting either of those parties to address the problem in a timely manner is a huge hassle (that could potentially cost lots of money). Ignoring the problem is easy and free. There's also likely the fear of "oh god, what have we done, and what kind of liability did this open us up to?" that is hard to stomach. It's incredibly stupid, but people usually are when they're both panicked and got caught doing something bad.
- kbenson 9y ago> This website was probably either made by contractors who are long gone or an internal team who are too incompetent to fix it. If I paid a construction contractor to build my office and someone notified me that parts were unsafe or violated the building code, I would either hire the original contractors or new ones to fix it, because otherwise I would be legally liable is I still used it. If my own employees built it, we would be having an interesting discussion about how it happened, and whether I could trust them to fix it or would need to hire a contractor (or at least fire that manager). Whenever something new is built that people use, care needs to be taken with safety. The sooner average people realize that effects digital constructs the same as physical ones, the better.
- swang 9y agoBBC posted a followup... 1. Kidspass spokeswoman said that it was their off-hours crew that blocked Alex and Troy. They were unblocked 10 hours later. 2. They will institute a vulnerability policy as a result of this. http://www.bbc.co.uk/news/40776512 http://www.bbc.co.uk/news/40776512
- AdmiralAsshat 9y agoAh yes, the unverifiable temp-worker / contractor / person-who-no-longer-works-here scapegoat that skirts the company from any responsibility. It's always amazing how they would have you believe that the bad actor is never a real employee.
- 1_2__4 9y ago> off-hours crew That's a funny way to spell "employee".
- unethical_ban 9y ago"We admittedly hire substandard employees in order to call our SOC '24/7' and they have embarrassed us. We're sending them to SANS training to remedy the situation."
- tarr11 9y agoWhat is a good way to implement responsible disclosure for single developer / side projects? Eg, when you don't have the resources to pay for bug bounties etc.
- hdhzy 9y agoWell the article has one potential answer, create a page just like Tesla: https://www.tesla.com/about/legal#security-vulnerability-reporting-policy https://www.tesla.com/about/legal#security-vulnerability-rep...
- yjftsjthsd-h 9y agoA page that asks for you to give them your real name and promises to not take legal action against you only if you follow very specific rules that could be violated by accident? I wouldn't report to them like that; they've left enough rope to hang you with.
- DanBC 9y agoOne of the benefits of the oppressive regime in the UK is the proliferation of regulators. The Information Commissioner is the regulator for this kind of thing. https://ico.org.uk/ https://ico.org.uk/ They do take action on this kind of thing.
- tolien 9y agoThe ICO was the direct result of the EU Data Protection Durectives of the 80s and are replicated throughout the Union, so I’m not sure they’re the best example of the “oppressive regime” in the UK. They’ve also been quite notably toothless, for example TalkTalk was fined a “record” £400k for their 2015 disaster: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...
- DanBC 9y agoPeople who responsibly disclose don't want fines applied, they want the bug to be fixed. ICO is one path to make that happen.
- tolien 9y agoThat’s true but if there’s very little penalty (continuing the example, TalkTalk made an after-tax profit of £72M [1] so the fine was 0.6% of that) for not fixing it, there isn’t much reason for an already-negligent business to care what the ICO say. https://www.talktalkgroup.com/dam/jcr:04037e42-6a6d-4fcf-9bea-8f339240d0ba/Annual%20Report%202015%20Final.pdf https://www.talktalkgroup.com/dam/jcr:04037e42-6a6d-4fcf-9be...
- rmc 9y agoThere are new Data Protection Regulations (GDPR) coming in soon on 25 May 2018, which will allow EU bodies to fine organisations up to 4% of their global revenue.
- reitanqild 9y agoRelated - but only to the blocking: A friend of mine who works with one of the really expensive consulting companies witnessed someone lashing out on twitter about how bad such and such people where. So he answered along the lines of: I grew up in such and such home, my experience is totally different and I'll be happy to buy you lunch. Answer: blocked. Blocking is a power thing for some people. IIRC it used to be a thing in the old Usenet and of course it existed before that in other forms.
- mdpopescu 9y agoI do that (blocking people) as an energy-saving device. Reading messages from people with a completely different worldview than mine (e.g., communists) is extremely annoying. It raises my blood pressure. So, I block them and become happier as a result.
- deleted 9y ago[deleted]
- tomjen3 9y agoBlocking has improved my Twitter presence, but I limit blocking to annoying people. I wish I could do that in real life too.
- coldcode 9y agoAfter so many decades in this industry nothing surprises me at all. Security is usually an afterthought that barely warrants spending more that a token amount. I once did a contract at a public university and found the app that every department used to verify with the state that money was appropriately spent used incrementing id's in the url and used GET to handle the delete button. I wound up fixing it for them on the way out (after weeks of telling me it wasn't a concern). A simple command line script would have deleted the entire database leaving the university with no budget for the upcoming year. Another place I worked kept production passwords in the code repository; when I complained they told me they passed their audits every year so it didn't matter. HIPAA company in the US no less.
- sam_goody 9y agoHeh! Nothing new in the behavior. Mr. Feynman famously found you could lift the combo off a safe [with the a-bomb's secrets] when it was empty. When he alerted the Colonel not to leave his safe open, the response was to: send a note around to everyone in the plant which said, “During his last visit, was Mr. Feyman at any time in your office, near your office, or a walking through your office?” Some people answered yes; others said no. The ones who said yes got another note: “Please change the combination of your safe. That was his solution. _I_ was the danger!”
- __s 9y agoDug up reference on Feynman tale: http://www.cs.virginia.edu/cs588/safecracker.pdf http://www.cs.virginia.edu/cs588/safecracker.pdf
- notyourday 9y agoThe solution to this is simple. Disclose everything. Have these companies destroyed. Have everyone who works for them fired and become unhirable. Have their houses foreclosed on because they cannot afford to pay the mortgages or rent. That's the only way to ensure that the security is taken seriously.
- mdpopescu 9y ago> Have everyone who works for them fired and become unhirable. Huh. I didn't think there was anyone even more "kill them all and let God sort them out" than I am. I think the janitors or the accountants are clearly not at fault in this case, and including them would be wrong.
- z3t4 9y agoWriting "They have a serious vuln" on twitter is not responsible. Try to hack those who have bounties, please leave the others alone, or at least contact them privately when you find a vuln. Give them a chance to fix it, and if you want to be helpful also tell them what the issue is.
- btb 9y agoAgreed. Especially considering how easy it would have been to contact them privately and directly. A 2 second google search for kidspass uk shows a sitelink for their "Contact Us" page, listing both a phone number and email address: https://www.kidspass.co.uk/contact-us https://www.kidspass.co.uk/contact-us So unless that page was added post-incident, then IMO both Alex and Troy did not do responsible disclosure.
- manarth 9y agoThe initial contact was reportedly via private DM.
- z3t4 9y agoHopefylly they where give more then a few weeks time to fix it. But by reading the article it seems they where impatient and didn't even wait for the weekend to be over before publicly announcing that the site had a vuln. And he didn't give instructions on how to repeat the "bug" in the DM (Twitter Direct Message).
- Accacin 9y agoThey didn't say what the vulnerability was, just that there was one.
- z3t4 9y agoConsidering his follower base there might have been a number of people interested to know what it was, and capable of finding out by themselves. And from the article it seems the tweet did set off a "hacker feast" against the site.
- bvv 9y agoThis seems like an area where a trusted organization (perhaps the EFF?) could do a lot of good by creating a "for dummies" webpage where the vulnerability disclosure process is explained in layman's terms (i.e. with suitable car analogies...) from a website owner's perspective. Those who discover a vulnerability in a company's IT infrastructure can then submit a link to this page with their reports.
- rmellow 9y agoSometimes we forget the entrepreneurs behind these services can be technologically illiterate. When they realize they have a problem they don't understand, they get scared, and can easily get confrontational and try to dodge any liability (e.g. by getting the police involved). How can we teach these entrepreneurs to act? Perhaps by creating an accessible and gently worded guide on how to act; an FAQ from a reputable organization that you can link to every time you disclose a vulnerability? IEEE, EFF I'm looking at both of you.
- jamiethompson 9y agoHaving used Kids pass. It's a pointless product anyway. Snake oil. All the "deals" are just links to PDFs, many of which have no barcodes and the ones that do are just generic barcodes that don't relate to a particular Kids Pass account. Also more often than not, when you redeem the vouchers they aren't scanned. There's nothing to stop you downloading all the PDFs you'll ever need and then ending your free trial. Other than the fact that that's technically fraud.