5 ms·

IMO, post to the Full Disclosure mailing list[1]. I'd do it anonymously if worried about legal action, but sign the message with a new PGP key. That way I can c

IMO, post to the Full Disclosure mailing list[1]. I'd do it anonymously if worried about legal action, but sign the message with a new PGP key. That way I can claim the discovery later if that becomes advisable. [1] http://seclists.org/fulldisclosure/ http://seclists.org/fulldisclosure/

dogma1138 9y ago
This is a very good way to end up paying damages or going to jail, please do not post it to any public sources without seeking legal counsel.
- sp332 9y ago
  What argument would they use to put you in jail?
  - dogma1138 9y ago
    Violating what ever computer crime acts are relevant to the OP. Responsible disclosure isn’t codified in law, even bug bounties do not somehow exempt you from criminal prosecution they just make it less likely as long as you follow their guidelines at least.
    - sp332 9y ago
      Finding a vulnerability is not a crime.
      - dogma1138 9y ago
        Finding a vulnerability in a website and PoCing can be very much a crime. Finding a vulnerability in a product you own can also be constituted a crime under the DMCA or any other legislation that protects intellectual property and specifically prohibits reverse engineering. The only difference is that companies elect not to file complaints which lead to charges being filed when this is done properly. I've handled bug bounty payouts on both sides, I've sat on a advisory board for a national CERT (my employer held the seat not by name), and I've seen quite a few cases of bug bounty and reported submissions go wrong really fast for as something as silly as poorly constructed language or someone being overly pushy. The OP here found a vulnerability that discloses PII of other users, if this is actual PII as defined by law in their jurisdiction well then they again just potentially commited a crime. By the nature of the vulnerability "iterative exfiltriation of PII" I'm assuming they found some direct access to a resource like a profile page, invoices, or something similar which means that they've found a vulnerability, exploited it during a proof of concept and retrieved PII data, all of this falls under unauthorized and criminal access if not handled correctly. Usually when you have a vulnerability which requires actionable exploitation to prove and you access any type of information especially one that is regulated by law you want to document everything you've accessed and provide those details in the disclosure as they would have to notify the people whose information has been exposed in the least if not their entire customer base.
        deleted 9y ago
        [deleted]
    - nkkollaw 9y ago
      I thought "responsible disclosure" was a marketing term..?
      - dogma1138 9y ago
        It is there is, technically the act of finding vulnerabilities especially over a network is a violation of every computer crime legislation I know off.
      - forgottenpass 9y ago
        Yes and no. No, it's a descriptor. In the debate about the best way to handle knowledge of vulnerabilities, there arose a vaguely-bounded subset practices that got this name. Yes, it's also great marketing. Whatever has the name implies that it's the best of all possible alternatives, fait accompli.
      - sp332 9y ago
        Yes, it's used to castigate hackers who don't do exactly what the vendor wants. And the more common term now is "coordinated disclosure".
        nkkollaw 9y ago
        Exactly.
- dsacco 9y ago
  Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speaking just about doing it anyway, it’s basically trivial to do this as the commenter described without ever being caught. Publicly claiming the PGP signature later will obviously not be trivial, but you can easily send one anonymous email without ever being caught. If someone wants to do this out of a sense of personal ethics, and doesn’t mind restrictions on legally claiming it later on, I’d say go for it. An anonymous email is not a high operational security bar to pass for someone technically competent enough to find a security issue, especially if it’s only once.
  - dogma1138 9y ago
    The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.
    - dsacco 9y ago

dogma1138 9y ago

This is a very good way to end up paying damages or going to jail, please do not post it to any public sources without seeking legal counsel.

sp332 9y ago
What argument would they use to put you in jail?
- dogma1138 9y ago
  Violating what ever computer crime acts are relevant to the OP. Responsible disclosure isn’t codified in law, even bug bounties do not somehow exempt you from criminal prosecution they just make it less likely as long as you follow their guidelines at least.
  - sp332 9y ago
    Finding a vulnerability is not a crime.
    - dogma1138 9y ago
      Finding a vulnerability in a website and PoCing can be very much a crime. Finding a vulnerability in a product you own can also be constituted a crime under the DMCA or any other legislation that protects intellectual property and specifically prohibits reverse engineering. The only difference is that companies elect not to file complaints which lead to charges being filed when this is done properly. I've handled bug bounty payouts on both sides, I've sat on a advisory board for a national CERT (my employer held the seat not by name), and I've seen quite a few cases of bug bounty and reported submissions go wrong really fast for as something as silly as poorly constructed language or someone being overly pushy. The OP here found a vulnerability that discloses PII of other users, if this is actual PII as defined by law in their jurisdiction well then they again just potentially commited a crime. By the nature of the vulnerability "iterative exfiltriation of PII" I'm assuming they found some direct access to a resource like a profile page, invoices, or something similar which means that they've found a vulnerability, exploited it during a proof of concept and retrieved PII data, all of this falls under unauthorized and criminal access if not handled correctly. Usually when you have a vulnerability which requires actionable exploitation to prove and you access any type of information especially one that is regulated by law you want to document everything you've accessed and provide those details in the disclosure as they would have to notify the people whose information has been exposed in the least if not their entire customer base.
      - deleted 9y ago
        [deleted]
  - nkkollaw 9y ago
    I thought "responsible disclosure" was a marketing term..?
    - dogma1138 9y ago
      It is there is, technically the act of finding vulnerabilities especially over a network is a violation of every computer crime legislation I know off.
    - forgottenpass 9y ago
      Yes and no. No, it's a descriptor. In the debate about the best way to handle knowledge of vulnerabilities, there arose a vaguely-bounded subset practices that got this name. Yes, it's also great marketing. Whatever has the name implies that it's the best of all possible alternatives, fait accompli.
    - sp332 9y ago
      Yes, it's used to castigate hackers who don't do exactly what the vendor wants. And the more common term now is "coordinated disclosure".
      - nkkollaw 9y ago
        Exactly.
dsacco 9y ago
Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speaking just about doing it anyway, it’s basically trivial to do this as the commenter described without ever being caught. Publicly claiming the PGP signature later will obviously not be trivial, but you can easily send one anonymous email without ever being caught. If someone wants to do this out of a sense of personal ethics, and doesn’t mind restrictions on legally claiming it later on, I’d say go for it. An anonymous email is not a high operational security bar to pass for someone technically competent enough to find a security issue, especially if it’s only once.
- dogma1138 9y ago
  The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.
  - dsacco 9y ago