4 ms·

Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speak

by dsacco 9y ago

Assuming the lawyers are cautious and risk-averse (as they should be), their counsel will be pretty predictable: don’t do it. On the other hand, if we’re speaking just about doing it anyway, it’s basically trivial to do this as the commenter described without ever being caught. Publicly claiming the PGP signature later will obviously not be trivial, but you can easily send one anonymous email without ever being caught. If someone wants to do this out of a sense of personal ethics, and doesn’t mind restrictions on legally claiming it later on, I’d say go for it. An anonymous email is not a high operational security bar to pass for someone technically competent enough to find a security issue, especially if it’s only once.

dogma1138 9y ago
The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.
- dsacco 9y ago
  > The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. No it isn’t. Make a new key-pair for the signature. This key-pair will also be anonymous. Best of both worlds: still anonymous, but you keep the option to positively claim it later. The fact that they’ve spoken about it on HN somewhat deanonymizes them, sure, but perhaps not meaningfully so yet. The OP needs to secure against a private company’s security and legal teams, not a theoretically omniscient naion state. If he used an alternate IP address for this throwaway, he’s still basically fine. > I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim. This isn’t poor advice. Speaking for myself, I choose to give this advice as a security professional and someone who has had to make various disclosures, both “responsible” and “full”, and of the latter, with and without the cooperation of the company.
  - dogma1138 9y ago
    They've already contacted the company and reported the vulnerabilities, and likely were much less anonymous in the process. Generating PGP keys for future claim would require you to keep a copy of the private key, this copy can be seized if a criminal investigation does happen. >This isn’t poor advice. Speaking for myself, I choose to give this advice as a security professional and someone who has had to make various disclosures, both “responsible” and “full”, and of the latter, with and without the cooperation of the company. So have I and this is a poor advice, especially these days with some of the regulation that is popping up. The line which differentiates between a paid bounty or a PR piece on your website and criminal prosecution is how you handle the situation the law applies identically to both there are no legal provisions for doing unsolicited penetration testing because you say you're a good guy, heck in the UK for example the exemption form that companies sign do not actually exempt the individual tester from being prosecuted by the crown it can only be used as a legal defense, in Germany the possession of "hacking tools" is illegal without a cause, and there are tons of other nuances for each and other country and jurisdiction in the world. Telling people to just post stuff on seclists especially after already being in contact with the company is a terrible idea, so while I do appreciate you might have had different experience it doesn't mean you handled it correctly nor does it mean you are giving a sage advice.

by dsacco 9y ago

dogma1138 9y ago

The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. The correct way to handle it is to contact the relevant CERT team in your country usually on a national or state level. And if it's regulated industry or information (PII is) you can also contact the relevant regulator. Publishing a functional exploit that can be used to gain access to PII on an open mailing list isn't just illegal it's also unethical. This advice is quite indicative of anyone who never handled disclosures from either side of the aisle. You need to understand there could be good reasons why you might not get a reply to a reported vulnerability, including the fact that the legal team and or the authorities put a gag on it. You don't know what language was used in the initial report and what information they've accessed. In many jurisdictions especially in the EU you are actually required to report the incident even if it's under a "bug bounty" program to the authorities if regulated information has been exposed. They may allow you to handle it through your BB program (but they also remind you that you'll be liable for any mishaps in the handling of the incident) they may elect to tell you to stop all contact and hand it over, your own legal department might say they don't like the language used or some other things raised a red flag like "I've downloaded your entire DB as a PoC".... I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim.

dsacco 9y ago
> The PGP signature is a pretty bad idea if this goes criminal, and since they've already reported the vulnerability via less than anonymous means they can be tracked. No it isn’t. Make a new key-pair for the signature. This key-pair will also be anonymous. Best of both worlds: still anonymous, but you keep the option to positively claim it later. The fact that they’ve spoken about it on HN somewhat deanonymizes them, sure, but perhaps not meaningfully so yet. The OP needs to secure against a private company’s security and legal teams, not a theoretically omniscient naion state. If he used an alternate IP address for this throwaway, he’s still basically fine. > I really don't understand why people on HN elect to give such poor advice on a subject that while unlikely but can go south really bad on a whim. This isn’t poor advice. Speaking for myself, I choose to give this advice as a security professional and someone who has had to make various disclosures, both “responsible” and “full”, and of the latter, with and without the cooperation of the company.
- dogma1138 9y ago
  They've already contacted the company and reported the vulnerabilities, and likely were much less anonymous in the process. Generating PGP keys for future claim would require you to keep a copy of the private key, this copy can be seized if a criminal investigation does happen. >This isn’t poor advice. Speaking for myself, I choose to give this advice as a security professional and someone who has had to make various disclosures, both “responsible” and “full”, and of the latter, with and without the cooperation of the company. So have I and this is a poor advice, especially these days with some of the regulation that is popping up. The line which differentiates between a paid bounty or a PR piece on your website and criminal prosecution is how you handle the situation the law applies identically to both there are no legal provisions for doing unsolicited penetration testing because you say you're a good guy, heck in the UK for example the exemption form that companies sign do not actually exempt the individual tester from being prosecuted by the crown it can only be used as a legal defense, in Germany the possession of "hacking tools" is illegal without a cause, and there are tons of other nuances for each and other country and jurisdiction in the world. Telling people to just post stuff on seclists especially after already being in contact with the company is a terrible idea, so while I do appreciate you might have had different experience it doesn't mean you handled it correctly nor does it mean you are giving a sage advice.