7 ms·

Pentester here. If any pentester would download more data than necessary to prove a bug exists, they would be fired. I don't know whether this person download

Pentester here. If any pentester would download more data than necessary to prove a bug exists, they would be fired. I don't know whether this person downloaded 57M user records. Maybe it was a 500kb zip file, which would be totally reasonable to grab in a pentest. And then once you realize what it is, you run `srm` on it to ensure it's wiped, then immediately call the client so they can deploy an emergency hotfix and perform forensic analysis to see if the data had already been nabbed. We know he contacted Uber. We don't know whether he said "Give me $100k and I'll delete the data" or "Give me $100k and I'll keep my mouth shut" or if Uber offered him the $100k or any details at all. In this scenario, it's better to assume the best until proven otherwise. And by "proof" I mean "emails showing what was said," not a second-hand news report that attempts to spin it into an easily clickable form. But I suppose it could have gone the other way too, and maybe he did. The point is, it's totally reasonable for Uber to raise the price until he was willing to keep quiet about it. If I ran into this bug in the wild, I would be ethically obliged to report it to you, dear readers, after a reasonable time period. But I suppose certain ethics would take a back seat to $100k in my pocket, and I'm not ashamed of that. But it depends on the data. If we're talking SSNs, that could really screw up peoples' lives, so I don't think I'd be able to be bought. CC numbers I'd probably overlook, since you can't really mess with someone's life by stealing their CC number. They just get refunded. (edit: On the other hand, businesses eat the cost of fraud, so this would probably need to be reported.) The point is, it's a big complex topic and there are a bunch of things we don't know. But above all, if you are ever holding data hostage and demanding money to destroy it, you're not a pentester, you're a chump. edit2: it occurs to me that maybe the 20yo wanted to hold the data in order to prove to the world that the breach really did happen, i.e. his intent was altruistic. I could picture myself doing something misguided like that back when I was 20. But the trick is to keep only a few records at most, and redact everything sensitive. Then tell the truth. The company can't lie and say it didn't happen, since they don't know whether you can prove that it did. And no one is at risk because the data is gone.

zitterbewegung 9y ago
The issue though would be that this person is an proper pentester but the fact that are these things obviously under reported when someone extorts you. Sure the person is the chump but we don't know how much data has been exfiltrated if they go the way of extortion.
inetknght 9y ago
It's also possible that he discovered it, reported it, got paid the bounty, and all after someone else discovered it, didn't report it, and got paid elsewhere. (note: clear conjecture, I only read half of the article before becoming more interested in the HN discussion)
foobaw 9y ago
I doubt the man resorted to extortion. 100k seems pretty reasonable for the severity of this issue and given Uber's budget it could've been a reasonable initial offer.
- ajross 9y ago
  There's clearly a spectrum between "reward" and "extortion", but... come on. The point to a bug bounty is to make it worthwhile for smart hackers to report their findings to the company in a ethical way, which broadly means that it should be comparable to the kind of money they can make for their labor on the open market. A hundred grand for a few weeks or a month of work is way, way above that level. This is a jackpot, not a reward. Whether Uber threw out the number or the guy demanded probably won't ever be known, but I know where I'd put my bet.
  - Simon_says 9y ago
    You may be right, but you can't just compare to the market rate of a month's labor. You have to price in the rather high probability that no serious bug would be found and the risk-adjusted rate of return.
  - BoorishBears 9y ago
    If we were talking about any other company I'd probably agree with you, but I definitely think it would be Uber's style to offer 100k as hush money without being asked for hush money. "Just throw money at it" seems to be a more integral strategy of their corporate playbook than most companies.
  - varenc 9y ago
    If you consider the value of such a hack on the open market, $100k makes more sense. The bug bounty program is supposed to make it more lucrative to be a white hat then to be a black hat so $100k for something this severe is in the realm of possibility. Whether it took the hacker hours or months isn't really a factor...it's just about the value of the hack. For comparison, Apple's bug bounty program says they'll pay $100k for a hack to extract data from the secure enclave. (Bug bounty programs are often probably underpaying compared to what something would be worth on the black market, but clean money is worth lots more than dirty money with a prison risk)
deleted 9y ago
[deleted]
paganel 9y ago
> CC numbers I'd probably overlook, since you can't really mess with someone's life by stealing their CC number. They just get refunded This doesn't happen in my parts of the world (Eastern European country) where most of the people still use debit-cards. Card cloning (https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming) is a frequent crime around here, and it absolutely and negatively affects those who end up on the wrong side of it all (i.e. the card-holders). A former friend of mine had her money stolen from her bank account when someone had cloned her card and the procedure of her getting the money back was to go to the police, file a police report, and then go to the bank and complain about it with said police report in hand and hoping that she'd receive a refund in the next 6 months.
- bkor 9y ago
  > This doesn't happen in my parts of the world (Eastern European country) where most of the people still use debit-cards. In Netherlands banks are still responsible, no matter debit or credit card. It's pretty common for the bank to have refunded someone before the customer notices anything. The skimming bit only worked super easily with the swipe system. With the chip it reduced the amount of fraud considerably. Plus they only allow the card to be used in Europe by default (you can easily change this setting in any bank). People now moved to social engineering (pretending to be the bank and telling people to transfer money).
- kuschku 9y ago
  And that’s why there used to be a card system in Europe that didn’t rely on numbers, but used good cryptography. Nowadays EC is mostly dead, though, except for Germany.
  - thesimon 9y ago
    >Nowadays EC is mostly dead, though, except for Germany. It's dead in Germany as well. For quite a long time the banks rebranded their scheme as "electronic cash" and reused the logo. But a few years back they changed their brand to "girocard" [2] and MasterCard bought the famous "ec" trademark [1]. I especially like the consorsfinanz card, which is just a regular Debit MasterCard. https://www.mastercard.de/content/dam/mccom/de-de/privatkunden/cards/consors-finanz-dmc-card2.jpg https://www.mastercard.de/content/dam/mccom/de-de/privatkund... [1]: https://www.mastercard.de/de-de/privatkunden/produkte-features/produkte/debit-mastercard.html https://www.mastercard.de/de-de/privatkunden/produkte-featur... [2]: https://die-dk.de/zahlungsverkehr/zulassungsverfahren/electronic-cash-system/ https://die-dk.de/zahlungsverkehr/zulassungsverfahren/electr... (in German)
roel_v 9y ago
"if you are ever holding data hostage and demanding money to destroy it, you're not a pentester, you're a chump." If you're not getting paid up front, regardless of the outcome, you're not a 'pentester' in the first place - you're just doing free work for a company who will then (in some cases) not hesitate to sue you just for telling them they have a problem. Fuck that. You're taking some sort of moral high ground here; which is to be expected, as you're in the industry, or as we say in Dutch - "whose bread one eats, whose word one speaks". But just because a bunch of people with security services to sell says it's so, doesn't make it true. "Responsible disclosure" is bullshit. These "bug bounty" programs are just a cover up - a way to retroactively say "but we had procedures!". The real chumps are the people spending days or weeks looking for issues and then being send off with a $250 Starbucks coupon and a pat on the head. The days of 'playing nice' or 'doing the 'ethical' rollseyes thing' are over. Today's internet is an all-out, free for all warzone (security-wise). "Responsible disclosure" is a PR scapegoat, a smoke curtain devised by companies unwilling to spend what it takes to make our eye-wateringly bad state of infrastructure seem... if not good, then at least less crap. I don't have a horse in this race; I stopped caring about infosec 15+ years ago when the full contact spirit of the scene began to wade. I just assume that anything with a keyboard I type on is compromised and adapt my behavior to match. But it does still make me angry that so many people bought into this whole spiel of blaming whoever finds the issue, instead of holding those that caused it in the first place responsible. It's morally equivalent to the GFC bailouts, except that there's not even a 'too big to fail' argument to be made.
- speedplane 9y ago
  There are a lot of people who do this type of work for status rather than money. The bug bounty programs are a way for otherwise would-be hackers to gain recognition, and a small chunk of change for stuff they would be doing anyway, which would likely net them less money and more legal trouble.
- rando444 9y ago
  I agree with you, however when you get paid is irrelevant. It's just a matter of having a clear objective and guidelines scoped out in a contract.
lawnchair_larry 9y ago
"If any pentester would download more data than necessary to prove a bug exists, they would be fired." I disagree, sticking to that would even be foolish in a full scope pentest. It depends what the data is. I would, and have, download any data of operational value using a bug that was found. If I can dump the entire company's employee password hashes, I'm going to. And after the engagement, a company-wide email is going out to roll those credentials, which, whether I personally viewed them or not, are now considered compromised. There are some exceptions if there is reason to have high confidence that no one else ever exploited the bug, but that's taking a big chance. Data of no operational value would be difficult to explain, and customer data or credentials would be off limits beyond proving the bug. Even though it's likely legally fine in most cases (note: a work-for-hire contract or an internal pen test team have very different rules of engagement than bug bounty spec work), it would be highly unprofessional. You're going to be putting the customer in a very awkward position at best. But if you're hired to perform services on behalf of the company, breach disclosure laws don't apply any more than if you are hired as a contractor to migrate their database from one system to another.
- sillysaurus3 9y ago
  You're quite right, and I winced at my imprecision. Thanks for calling that out. I clarified here: https://news.ycombinator.com/item?id=15872824 https://news.ycombinator.com/item?id=15872824
PeterisP 9y ago
57M user records can't possibly be a 500kb zip file. Even if you could decompress a single byte to a whole user record (i.e. there could be at most 256 different user records possible) then the compressed size would be 57 Mb, but because you can't, it would be at least half a gigabyte compressed. It's not something you can download as a side effect of exploring, you'd get it only intentionally or if you're fetching a whole database dump or disk/VM image.
- sillysaurus3 9y ago
  I was assuming middle-out compression. It's routine during a netpen to download very large unlabeled files, especially VM images. You don't know whether they're a security threat until you check, and your goal is to escalate as much as possible. Even if it's named backup-20141120, you don't know what it's a backup of, or whether it's encrypted. You need to at least start downloading it to check the file headers. A good pentester will try to suck down as may different things as possible and sort ruthlessly for anything that could be useful: keys, passwords, notes, bash histories, logs, everything. But that's why we do so on an encrypted, isolated drive. The data never leaves the partition, and it's deleted at the conclusion of the test. People working on HackerOne don't have that kind of discipline, so it's important to err on the side of caution. But it's totally valid to grab a VM snapshot and look through it to check how to pivot elsewhere. But the moment you realize it's super sensitive data, you want to wipe it and contact them immediately. (Perhaps after checking whether there's anything you can use to escalate privileges.) If it's named "ssns.txt", you probably still want to download it just to check it really is SSNs before you go running to them about their exposed text file. The point is, it sounds very dramatic to say "Hacker downloaded 57M user records in 1GB of data", but sometimes you don't know they're user records until you look, and sometimes you can't look until it's fully downloaded. And your goal is to safely simulate what a real hacker would do. That's the point of a pentest, and why ethics and trust are so important. I've snagged several VM image files during pentests at various companies. I don't remember whether any of them turned out to be useful, but I do remember poking through them in vmware fusion to see what the devs had littered around. Now: I was under strict NDA. That isn't true for HackerOne finders. Every company has different rules. Some tell you up front not to do this, e.g. https://hackerone.com/deptofdefense https://hackerone.com/deptofdefense ("You do not exfiltrate any data under any circumstances.") https://hackerone.com/square https://hackerone.com/square ("Never attempt to view, modify, or damage data belonging to others.") Crucially, Uber does not: https://hackerone.com/uber https://hackerone.com/uber Searching for "data" shows that everything is in scope. So it's really tricky to say there was malicious intent here. edit: Usually it's the other way around, though: You find an exploit that gives you a little drip of data, so you know that you could technically enumerate the entire dataset if you wanted to. Obviously, don't do that, because you already know from the first drip whether there will be anything useful if you keep going.

zitterbewegung 9y ago

The issue though would be that this person is an proper pentester but the fact that are these things obviously under reported when someone extorts you. Sure the person is the chump but we don't know how much data has been exfiltrated if they go the way of extortion.

inetknght 9y ago

It's also possible that he discovered it, reported it, got paid the bounty, and all after someone else discovered it, didn't report it, and got paid elsewhere. (note: clear conjecture, I only read half of the article before becoming more interested in the HN discussion)

foobaw 9y ago

I doubt the man resorted to extortion. 100k seems pretty reasonable for the severity of this issue and given Uber's budget it could've been a reasonable initial offer.

ajross 9y ago
There's clearly a spectrum between "reward" and "extortion", but... come on. The point to a bug bounty is to make it worthwhile for smart hackers to report their findings to the company in a ethical way, which broadly means that it should be comparable to the kind of money they can make for their labor on the open market. A hundred grand for a few weeks or a month of work is way, way above that level. This is a jackpot, not a reward. Whether Uber threw out the number or the guy demanded probably won't ever be known, but I know where I'd put my bet.
- Simon_says 9y ago
  You may be right, but you can't just compare to the market rate of a month's labor. You have to price in the rather high probability that no serious bug would be found and the risk-adjusted rate of return.
- BoorishBears 9y ago
  If we were talking about any other company I'd probably agree with you, but I definitely think it would be Uber's style to offer 100k as hush money without being asked for hush money. "Just throw money at it" seems to be a more integral strategy of their corporate playbook than most companies.
- varenc 9y ago
  If you consider the value of such a hack on the open market, $100k makes more sense. The bug bounty program is supposed to make it more lucrative to be a white hat then to be a black hat so $100k for something this severe is in the realm of possibility. Whether it took the hacker hours or months isn't really a factor...it's just about the value of the hack. For comparison, Apple's bug bounty program says they'll pay $100k for a hack to extract data from the secure enclave. (Bug bounty programs are often probably underpaying compared to what something would be worth on the black market, but clean money is worth lots more than dirty money with a prison risk)

deleted 9y ago

[deleted]

paganel 9y ago

> CC numbers I'd probably overlook, since you can't really mess with someone's life by stealing their CC number. They just get refunded This doesn't happen in my parts of the world (Eastern European country) where most of the people still use debit-cards. Card cloning (https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming https://en.wikipedia.org/wiki/Credit_card_fraud#Skimming) is a frequent crime around here, and it absolutely and negatively affects those who end up on the wrong side of it all (i.e. the card-holders). A former friend of mine had her money stolen from her bank account when someone had cloned her card and the procedure of her getting the money back was to go to the police, file a police report, and then go to the bank and complain about it with said police report in hand and hoping that she'd receive a refund in the next 6 months.

bkor 9y ago
> This doesn't happen in my parts of the world (Eastern European country) where most of the people still use debit-cards. In Netherlands banks are still responsible, no matter debit or credit card. It's pretty common for the bank to have refunded someone before the customer notices anything. The skimming bit only worked super easily with the swipe system. With the chip it reduced the amount of fraud considerably. Plus they only allow the card to be used in Europe by default (you can easily change this setting in any bank). People now moved to social engineering (pretending to be the bank and telling people to transfer money).
kuschku 9y ago
And that’s why there used to be a card system in Europe that didn’t rely on numbers, but used good cryptography. Nowadays EC is mostly dead, though, except for Germany.
- thesimon 9y ago
  >Nowadays EC is mostly dead, though, except for Germany. It's dead in Germany as well. For quite a long time the banks rebranded their scheme as "electronic cash" and reused the logo. But a few years back they changed their brand to "girocard" [2] and MasterCard bought the famous "ec" trademark [1]. I especially like the consorsfinanz card, which is just a regular Debit MasterCard. https://www.mastercard.de/content/dam/mccom/de-de/privatkunden/cards/consors-finanz-dmc-card2.jpg https://www.mastercard.de/content/dam/mccom/de-de/privatkund... [1]: https://www.mastercard.de/de-de/privatkunden/produkte-features/produkte/debit-mastercard.html https://www.mastercard.de/de-de/privatkunden/produkte-featur... [2]: https://die-dk.de/zahlungsverkehr/zulassungsverfahren/electronic-cash-system/ https://die-dk.de/zahlungsverkehr/zulassungsverfahren/electr... (in German)

roel_v 9y ago

"if you are ever holding data hostage and demanding money to destroy it, you're not a pentester, you're a chump." If you're not getting paid up front, regardless of the outcome, you're not a 'pentester' in the first place - you're just doing free work for a company who will then (in some cases) not hesitate to sue you just for telling them they have a problem. Fuck that. You're taking some sort of moral high ground here; which is to be expected, as you're in the industry, or as we say in Dutch - "whose bread one eats, whose word one speaks". But just because a bunch of people with security services to sell says it's so, doesn't make it true. "Responsible disclosure" is bullshit. These "bug bounty" programs are just a cover up - a way to retroactively say "but we had procedures!". The real chumps are the people spending days or weeks looking for issues and then being send off with a $250 Starbucks coupon and a pat on the head. The days of 'playing nice' or 'doing the 'ethical' rollseyes thing' are over. Today's internet is an all-out, free for all warzone (security-wise). "Responsible disclosure" is a PR scapegoat, a smoke curtain devised by companies unwilling to spend what it takes to make our eye-wateringly bad state of infrastructure seem... if not good, then at least less crap. I don't have a horse in this race; I stopped caring about infosec 15+ years ago when the full contact spirit of the scene began to wade. I just assume that anything with a keyboard I type on is compromised and adapt my behavior to match. But it does still make me angry that so many people bought into this whole spiel of blaming whoever finds the issue, instead of holding those that caused it in the first place responsible. It's morally equivalent to the GFC bailouts, except that there's not even a 'too big to fail' argument to be made.

speedplane 9y ago
There are a lot of people who do this type of work for status rather than money. The bug bounty programs are a way for otherwise would-be hackers to gain recognition, and a small chunk of change for stuff they would be doing anyway, which would likely net them less money and more legal trouble.
rando444 9y ago
I agree with you, however when you get paid is irrelevant. It's just a matter of having a clear objective and guidelines scoped out in a contract.

lawnchair_larry 9y ago

"If any pentester would download more data than necessary to prove a bug exists, they would be fired." I disagree, sticking to that would even be foolish in a full scope pentest. It depends what the data is. I would, and have, download any data of operational value using a bug that was found. If I can dump the entire company's employee password hashes, I'm going to. And after the engagement, a company-wide email is going out to roll those credentials, which, whether I personally viewed them or not, are now considered compromised. There are some exceptions if there is reason to have high confidence that no one else ever exploited the bug, but that's taking a big chance. Data of no operational value would be difficult to explain, and customer data or credentials would be off limits beyond proving the bug. Even though it's likely legally fine in most cases (note: a work-for-hire contract or an internal pen test team have very different rules of engagement than bug bounty spec work), it would be highly unprofessional. You're going to be putting the customer in a very awkward position at best. But if you're hired to perform services on behalf of the company, breach disclosure laws don't apply any more than if you are hired as a contractor to migrate their database from one system to another.

sillysaurus3 9y ago
You're quite right, and I winced at my imprecision. Thanks for calling that out. I clarified here: https://news.ycombinator.com/item?id=15872824 https://news.ycombinator.com/item?id=15872824

PeterisP 9y ago

57M user records can't possibly be a 500kb zip file. Even if you could decompress a single byte to a whole user record (i.e. there could be at most 256 different user records possible) then the compressed size would be 57 Mb, but because you can't, it would be at least half a gigabyte compressed. It's not something you can download as a side effect of exploring, you'd get it only intentionally or if you're fetching a whole database dump or disk/VM image.

sillysaurus3 9y ago
I was assuming middle-out compression. It's routine during a netpen to download very large unlabeled files, especially VM images. You don't know whether they're a security threat until you check, and your goal is to escalate as much as possible. Even if it's named backup-20141120, you don't know what it's a backup of, or whether it's encrypted. You need to at least start downloading it to check the file headers. A good pentester will try to suck down as may different things as possible and sort ruthlessly for anything that could be useful: keys, passwords, notes, bash histories, logs, everything. But that's why we do so on an encrypted, isolated drive. The data never leaves the partition, and it's deleted at the conclusion of the test. People working on HackerOne don't have that kind of discipline, so it's important to err on the side of caution. But it's totally valid to grab a VM snapshot and look through it to check how to pivot elsewhere. But the moment you realize it's super sensitive data, you want to wipe it and contact them immediately. (Perhaps after checking whether there's anything you can use to escalate privileges.) If it's named "ssns.txt", you probably still want to download it just to check it really is SSNs before you go running to them about their exposed text file. The point is, it sounds very dramatic to say "Hacker downloaded 57M user records in 1GB of data", but sometimes you don't know they're user records until you look, and sometimes you can't look until it's fully downloaded. And your goal is to safely simulate what a real hacker would do. That's the point of a pentest, and why ethics and trust are so important. I've snagged several VM image files during pentests at various companies. I don't remember whether any of them turned out to be useful, but I do remember poking through them in vmware fusion to see what the devs had littered around. Now: I was under strict NDA. That isn't true for HackerOne finders. Every company has different rules. Some tell you up front not to do this, e.g. https://hackerone.com/deptofdefense https://hackerone.com/deptofdefense ("You do not exfiltrate any data under any circumstances.") https://hackerone.com/square https://hackerone.com/square ("Never attempt to view, modify, or damage data belonging to others.") Crucially, Uber does not: https://hackerone.com/uber https://hackerone.com/uber Searching for "data" shows that everything is in scope. So it's really tricky to say there was malicious intent here. edit: Usually it's the other way around, though: You find an exploit that gives you a little drip of data, so you know that you could technically enumerate the entire dataset if you wanted to. Obviously, don't do that, because you already know from the first drip whether there will be anything useful if you keep going.