6 ms·

Ask HN: Found security flaws but vendor seems not to care. What should I do?

I've found some web app vulnerabilities to some high profile services in my country, but the vendor doesn't seem interested in fixing them as 6 months have passed and they claim to have other things to do, which, judging by the announcements on the main page, is finishing missing features. The fixes to the flaws that allow for iterative exfiltriation of PII are trivial to implement as well. The others are simple reflected XSS's. What is the most appropriate course of action here?

SAI_Peregrinus 9y ago
IMO, post to the Full Disclosure mailing list[1]. I'd do it anonymously if worried about legal action, but sign the message with a new PGP key. That way I can claim the discovery later if that becomes advisable. [1] http://seclists.org/fulldisclosure/ http://seclists.org/fulldisclosure/
- dogma1138 9y ago
  This is a very good way to end up paying damages or going to jail, please do not post it to any public sources without seeking legal counsel.
  - sp332 9y ago
    What argument would they use to put you in jail?
    - dogma1138 9y ago
      Violating what ever computer crime acts are relevant to the OP. Responsible disclosure isn’t codified in law, even bug bounties do not somehow exempt you from criminal prosecution they just make it less likely as long as you follow their guidelines at least.
      - sp332 9y ago
        Finding a vulnerability is not a crime.
        dogma1138 9y ago
        Finding a vulnerability in a website and PoCing can be very much a crime. Finding a vulnerability in a product you own can also be constituted a crime under the DMCA or any other legislation that protects intellectual property and specifically prohibits reverse engineering. The only difference is that companies elect not to file complaints which lead to charges being filed when this is done properly. I've handled bug bounty payouts on both sides, I've sat on a advisory board for a national CERT (my employer held the seat not by name), and I've seen quite a few cases of bug bounty and reported submissions go wrong really fast for as something as silly as poorly constructed language or someone being overly pushy. The OP here found a vulnerability that discloses PII of other users, if this is actual PII as defined by law in their jurisdiction well then they again just potentially commited a crime. By the nature of the vulnerability "iterative exfiltriation of PII" I'm assuming they found some direct access to a resource like a profile page, invoices, or something similar which means that they've found a vulnerability, exploited it during a proof of concept and retrieved PII data, all of this falls under unauthorized and criminal access if not handled correctly. Usually when you have a vulnerability which requires actionable exploitation to prove and you access any type of information especially one that is regulated by law you want to document everything you've accessed and provide those details in the disclosure as they would have to notify the people whose information has been exposed in the least if not their entire customer base.
        deleted 9y ago
        [deleted]
      - nkkollaw 9y ago
        I thought "responsible disclosure" was a marketing term..?
        dogma1138 9y ago
        It is there is, technically the act of finding vulnerabilities especially over a network is a violation of every computer crime legislation I know off.
        forgottenpass 9y ago
        Yes and no. No, it's a descriptor. In the debate about the best way to handle knowledge of vulnerabilities, there arose a vaguely-bounded subset practices that got this name. Yes, it's also great marketing. Whatever has the name implies that it's the best of all possible alternatives, fait accompli.
        sp332 9y ago
        Yes, it's used to castigate hackers who don't do exactly what the vendor wants. And the more common term now is "coordinated disclosure".
        nkkollaw 9y ago
        Exactly.
  - dsacco 9y ago
    Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speaking just about doing it anyway, it’s basically trivial to do this as the commenter described without ever being caught. Publicly claiming the PGP signature later will obviously not be trivial, but you can easily send one anonymous email without ever being caught. If someone wants to do this out of a sense of personal ethics, and doesn’t mind restrictions on legally claiming it later on, I’d say go for it. An anonymous email is not a high operational security bar to pass for someone technically competent enough to find a security issue, especially if it’s only once.
    - dogma1138 9y ago
      The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.
      - dsacco 9y ago
8draco8 9y ago
My chaotic good character says release it! Or at least write a blog post about it, how it is exploitable etc. but either don't give the information about company or preferably say who it is, proof that this can be done but don't give any information how to do it. When it will get to general public the company should realise that they're pants are on fire. My solution is not the politically correct way of doing it but I think that people who don't care about security should be punished
osullivj 9y ago
Blog it! Vendors uniformly crave +ve blog coverage, and fear -ve coverage. If you put together a blog post full of vendor and product names and tech detail on the vulnerabilities, designed for high PageRank, you'll soon have their attention. You'll probably tire very quickly of them begging you to remove or edit the post. The PR saying "no such thing as negative publicity" doesn't apply in our industry sector!
slazaro 9y ago
Do they know any personal information about you from your exchanges so far? If so, be careful because you might be liable if you disclose any vulnerabilities.
- throwawayCBNaT9 9y ago
  Thank you for the input. They do. I'm in the EU, are you aware of any issues that I may face if I choose to disclose it?
  - TheRealPomax 9y ago
    This sounds like the kind of thing the EU has laws for, where a company is legally mandated to fix vulnerabilities that may reveal personally identifiable information if made aware of these. Worth asking someone who's more of a lawyer than I am about that (since I am definitely not a lawyer).
deadmetheny 9y ago
Release it, in order to force a fix. If they won't do their due diligence and it's possible to exploit, nothing stops a malicious actor from taking advantage if they discover it. In the case of public disclosure, it forces them to acknowledge and fix the problem.
dreambo 9y ago
Go to the press. If the service is high profile enough, they'll be happy to post about it, and that will get a response. Works in my country.
thomersch_ 9y ago
Contact some organisation (e.g. EFF or Chaos Computer Club) which specialises in that stuff in order to save yourself from being sued by the vendor.
quantummkv 9y ago
First, and this is very important, send them a new mail disclosing the vulnerabilities that says in clear words that if you do not get a response on this in a fixed number of days, you will go public with your disclosure. Send that mail to everyone concerned in the org. If you do not get a response, then go ahead and make a blog post about it. Be sure to mention that you failed to get a response from the org in the post.
- bb88 9y ago
  I would not put a blog post about it, since an injunction would be enough to get it taken down. I would email a security list since email is not retractable once sent.
  - deleted 9y ago
    [deleted]
  - quantummkv 9y ago
    If the service is publicly available to people, I doubt it would matter. Vulnerabilities are disclosed daily for publicly available services. I remember someone publicly disclosing the vulnerabilities in the Indian government's Aadhar app, a public service, on twitter a few days back. I doubt they took down his tweets. If the service is not publicly available or is some kind of internal, enterprise tool, then it would be a different matter.
sp332 9y ago
If you don't want to go "public" first, you could contact their customers directly. Let them go after the vendor for a fix, and in the meantime they can develop their own mitigations. Even if the vendor still doesn't cooperate, you can delay going public until the high-profile users have protected themselves.
dboreham 9y ago
What do you mean by "iterative exfiltriation"? Does this mean PII can be extracted by an attacker one user at a time?
sdca 9y ago
Sell it to the U.S. government
jdietrich 9y ago
You're in the EU and the vulnerability affects PII, so I'd recommend informing your country's Data Protection Authority of the risk. If you make a public disclosure, you are at risk of being bullied by lawyers at the very least. Handing the issue over to the regulators might be more or less effective than making a public disclosure, but it should offer you some protection against liability and legal threats. As I understand it, most EU member states have some form of legislation to protect whistleblowers against defamation suits. http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm http://ec.europa.eu/justice/data-protection/article-29/struc...
- throwawayCBNaT9 9y ago
  Thank you for the information, I just sent an email.
- jackgolding 9y ago
  This is the best answer - after contacting the business with your real name I wouldn't release any information about this to the public.
twobyfour 9y ago
What makes you so sure fixes are trivial? Do you know what their code looks like? How big their team is? What resources they have available to devote to this? What their runway looks like? What pressures they're under from investors? In a legacy codebase, even the smallest change can introduce all sorts of problems; and a small change to output or business logic can require disproportionately large changes to code. They may simply have determined that finishing the feature changes they think they need for their business to survive is more important than protecting against exploits that they consider either unlikely or low-value. And how acceptable this is may depend in large part on what the service in question is and how broadly it's used. The lack of concern you describe would be totally unacceptable from a bank or even Twitter, but perhaps excusable (at this stage) from an early stage company trying to build the next Twitter.
dogma1138 9y ago
Do not post it to any public resource you can go to jail for that. Your course of action should be: 1) Understanding the legal framework in your country supporting the disclosure of vulnerabilities. 2) Contacting your country’s CERT team or EUCert if you are in the EU.
jlbribeiro 9y ago
Beware: I'm not a Lawyer. Well, if you're in the EU then GDPR [1] will be enforceable from 25 May 2018, so it is my noob understanding that the vendor you're dealing with will, sooner or later, be the subject of regular periodic data protection audits and will be forced to have a Data Protection Officer. Not sure if necessary, but you may contact ENISA [2] to be advised on how to proceed. [1] https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.m.wikipedia.org/wiki/General_Data_Protection_Regu... [2] https://en.m.wikipedia.org/wiki/European_Union_Agency_for_Network_and_Information_Security https://en.m.wikipedia.org/wiki/European_Union_Agency_for_Ne...
alltakendamned 9y ago
You have a few options but it's first and foremost important to understand laws related to "hacking" in your country. Your first option is simply to let it go. It might not be worth your time, energy and risk to pursue this. Certainly if the vulnerabilities are not high risk. You already did the right thing by notifying them. It's the company choice to accept the risk of not fixing the vulnerabilities. You can file the finding with your local CERT, they might be able/helpful to coordinate. You can go full disclosure with it, if you accept the risk the company might sue you. Even if you're in the right, it might cost you a lot of time, money and anxiety before the court says you are. See option 1. Notification to the authority responsible for enforcing GDPR or local privacy authority might be worthwhile, it depends. Also, what kind of PII are we talking about?
bbcbasic 9y ago
Fuck em. Move on. #yolo
matt_the_bass 9y ago
I’m curious why this post got flagged? It seems an appropriate question to me?

SAI_Peregrinus 9y ago

IMO, post to the Full Disclosure mailing list[1]. I'd do it anonymously if worried about legal action, but sign the message with a new PGP key. That way I can claim the discovery later if that becomes advisable. [1] http://seclists.org/fulldisclosure/ http://seclists.org/fulldisclosure/

dogma1138 9y ago
This is a very good way to end up paying damages or going to jail, please do not post it to any public sources without seeking legal counsel.
- sp332 9y ago
  What argument would they use to put you in jail?
  - dogma1138 9y ago
    Violating what ever computer crime acts are relevant to the OP. Responsible disclosure isn’t codified in law, even bug bounties do not somehow exempt you from criminal prosecution they just make it less likely as long as you follow their guidelines at least.
    - sp332 9y ago
      Finding a vulnerability is not a crime.
      - dogma1138 9y ago
        Finding a vulnerability in a website and PoCing can be very much a crime. Finding a vulnerability in a product you own can also be constituted a crime under the DMCA or any other legislation that protects intellectual property and specifically prohibits reverse engineering. The only difference is that companies elect not to file complaints which lead to charges being filed when this is done properly. I've handled bug bounty payouts on both sides, I've sat on a advisory board for a national CERT (my employer held the seat not by name), and I've seen quite a few cases of bug bounty and reported submissions go wrong really fast for as something as silly as poorly constructed language or someone being overly pushy. The OP here found a vulnerability that discloses PII of other users, if this is actual PII as defined by law in their jurisdiction well then they again just potentially commited a crime. By the nature of the vulnerability "iterative exfiltriation of PII" I'm assuming they found some direct access to a resource like a profile page, invoices, or something similar which means that they've found a vulnerability, exploited it during a proof of concept and retrieved PII data, all of this falls under unauthorized and criminal access if not handled correctly. Usually when you have a vulnerability which requires actionable exploitation to prove and you access any type of information especially one that is regulated by law you want to document everything you've accessed and provide those details in the disclosure as they would have to notify the people whose information has been exposed in the least if not their entire customer base.
        deleted 9y ago
        [deleted]
    - nkkollaw 9y ago
      I thought "responsible disclosure" was a marketing term..?
      - dogma1138 9y ago
        It is there is, technically the act of finding vulnerabilities especially over a network is a violation of every computer crime legislation I know off.
      - forgottenpass 9y ago
        Yes and no. No, it's a descriptor. In the debate about the best way to handle knowledge of vulnerabilities, there arose a vaguely-bounded subset practices that got this name. Yes, it's also great marketing. Whatever has the name implies that it's the best of all possible alternatives, fait accompli.
      - sp332 9y ago
        Yes, it's used to castigate hackers who don't do exactly what the vendor wants. And the more common term now is "coordinated disclosure".
        nkkollaw 9y ago
        Exactly.
- dsacco 9y ago
  Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speaking just about doing it anyway, it’s basically trivial to do this as the commenter described without ever being caught. Publicly claiming the PGP signature later will obviously not be trivial, but you can easily send one anonymous email without ever being caught. If someone wants to do this out of a sense of personal ethics, and doesn’t mind restrictions on legally claiming it later on, I’d say go for it. An anonymous email is not a high operational security bar to pass for someone technically competent enough to find a security issue, especially if it’s only once.
  - dogma1138 9y ago
    The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.
    - dsacco 9y ago

8draco8 9y ago

My chaotic good character says release it! Or at least write a blog post about it, how it is exploitable etc. but either don't give the information about company or preferably say who it is, proof that this can be done but don't give any information how to do it. When it will get to general public the company should realise that they're pants are on fire. My solution is not the politically correct way of doing it but I think that people who don't care about security should be punished

osullivj 9y ago

Blog it! Vendors uniformly crave +ve blog coverage, and fear -ve coverage. If you put together a blog post full of vendor and product names and tech detail on the vulnerabilities, designed for high PageRank, you'll soon have their attention. You'll probably tire very quickly of them begging you to remove or edit the post. The PR saying "no such thing as negative publicity" doesn't apply in our industry sector!

slazaro 9y ago

Do they know any personal information about you from your exchanges so far? If so, be careful because you might be liable if you disclose any vulnerabilities.

throwawayCBNaT9 9y ago
Thank you for the input. They do. I'm in the EU, are you aware of any issues that I may face if I choose to disclose it?
- TheRealPomax 9y ago
  This sounds like the kind of thing the EU has laws for, where a company is legally mandated to fix vulnerabilities that may reveal personally identifiable information if made aware of these. Worth asking someone who's more of a lawyer than I am about that (since I am definitely not a lawyer).

deadmetheny 9y ago

Release it, in order to force a fix. If they won't do their due diligence and it's possible to exploit, nothing stops a malicious actor from taking advantage if they discover it. In the case of public disclosure, it forces them to acknowledge and fix the problem.

dreambo 9y ago

Go to the press. If the service is high profile enough, they'll be happy to post about it, and that will get a response. Works in my country.

thomersch_ 9y ago

Contact some organisation (e.g. EFF or Chaos Computer Club) which specialises in that stuff in order to save yourself from being sued by the vendor.

quantummkv 9y ago

First, and this is very important, send them a new mail disclosing the vulnerabilities that says in clear words that if you do not get a response on this in a fixed number of days, you will go public with your disclosure. Send that mail to everyone concerned in the org. If you do not get a response, then go ahead and make a blog post about it. Be sure to mention that you failed to get a response from the org in the post.

bb88 9y ago
I would not put a blog post about it, since an injunction would be enough to get it taken down. I would email a security list since email is not retractable once sent.
- deleted 9y ago
  [deleted]
- quantummkv 9y ago
  If the service is publicly available to people, I doubt it would matter. Vulnerabilities are disclosed daily for publicly available services. I remember someone publicly disclosing the vulnerabilities in the Indian government's Aadhar app, a public service, on twitter a few days back. I doubt they took down his tweets. If the service is not publicly available or is some kind of internal, enterprise tool, then it would be a different matter.

sp332 9y ago

If you don't want to go "public" first, you could contact their customers directly. Let them go after the vendor for a fix, and in the meantime they can develop their own mitigations. Even if the vendor still doesn't cooperate, you can delay going public until the high-profile users have protected themselves.

dboreham 9y ago

What do you mean by "iterative exfiltriation"? Does this mean PII can be extracted by an attacker one user at a time?

sdca 9y ago

Sell it to the U.S. government

jdietrich 9y ago

You're in the EU and the vulnerability affects PII, so I'd recommend informing your country's Data Protection Authority of the risk. If you make a public disclosure, you are at risk of being bullied by lawyers at the very least. Handing the issue over to the regulators might be more or less effective than making a public disclosure, but it should offer you some protection against liability and legal threats. As I understand it, most EU member states have some form of legislation to protect whistleblowers against defamation suits. http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm http://ec.europa.eu/justice/data-protection/article-29/struc...

throwawayCBNaT9 9y ago
Thank you for the information, I just sent an email.
jackgolding 9y ago
This is the best answer - after contacting the business with your real name I wouldn't release any information about this to the public.

twobyfour 9y ago

What makes you so sure fixes are trivial? Do you know what their code looks like? How big their team is? What resources they have available to devote to this? What their runway looks like? What pressures they're under from investors? In a legacy codebase, even the smallest change can introduce all sorts of problems; and a small change to output or business logic can require disproportionately large changes to code. They may simply have determined that finishing the feature changes they think they need for their business to survive is more important than protecting against exploits that they consider either unlikely or low-value. And how acceptable this is may depend in large part on what the service in question is and how broadly it's used. The lack of concern you describe would be totally unacceptable from a bank or even Twitter, but perhaps excusable (at this stage) from an early stage company trying to build the next Twitter.

dogma1138 9y ago

Do not post it to any public resource you can go to jail for that. Your course of action should be: 1) Understanding the legal framework in your country supporting the disclosure of vulnerabilities. 2) Contacting your country’s CERT team or EUCert if you are in the EU.

jlbribeiro 9y ago

Beware: I'm not a Lawyer. Well, if you're in the EU then GDPR [1] will be enforceable from 25 May 2018, so it is my noob understanding that the vendor you're dealing with will, sooner or later, be the subject of regular periodic data protection audits and will be forced to have a Data Protection Officer. Not sure if necessary, but you may contact ENISA [2] to be advised on how to proceed. [1] https://en.m.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.m.wikipedia.org/wiki/General_Data_Protection_Regu... [2] https://en.m.wikipedia.org/wiki/European_Union_Agency_for_Network_and_Information_Security https://en.m.wikipedia.org/wiki/European_Union_Agency_for_Ne...

alltakendamned 9y ago

You have a few options but it's first and foremost important to understand laws related to "hacking" in your country. Your first option is simply to let it go. It might not be worth your time, energy and risk to pursue this. Certainly if the vulnerabilities are not high risk. You already did the right thing by notifying them. It's the company choice to accept the risk of not fixing the vulnerabilities. You can file the finding with your local CERT, they might be able/helpful to coordinate. You can go full disclosure with it, if you accept the risk the company might sue you. Even if you're in the right, it might cost you a lot of time, money and anxiety before the court says you are. See option 1. Notification to the authority responsible for enforcing GDPR or local privacy authority might be worthwhile, it depends. Also, what kind of PII are we talking about?

bbcbasic 9y ago

Fuck em. Move on. #yolo

matt_the_bass 9y ago

I’m curious why this post got flagged? It seems an appropriate question to me?