5 ms·

While Sentinel is handling this in an extremely amateurish way, the way this was handled by the person reporting the bug also was done quite poorly. 1) He shou

While Sentinel is handling this in an extremely amateurish way, the way this was handled by the person reporting the bug also was done quite poorly. 1) He should have attempted to access his own data via an alternative method. He could do this via an incognito session and a proxy, or just tell them he checked with a different machine, etc. Or, at bare minimum, stopped after the first time. Instead, after the first check, he proceeded to download at least one and potentially two sets of people's information that he knew was intended to be confidential. After already confirming that this was broken. This isn't the right way to go about it. 2) This was discussed in a public communication medium when there was little time given for Sentinel to handle it. Public disclosure to force action is a valid strategy, but almost all professional security researches provide time for the company to resolve the issue, rather than doing it within a day. 3) The CEO's report that only 21 people were affected might be totally accurate - webserver access logs would make it quite simple to determine how many people had their data viewed by users other than themselves. Thousands of people being vulnerable does not mean thousands of people were affected by someone other than themselves viewing their data. Primarily due to how 1) was handled, he 100% should be speaking with the relevant authorities. He now has confidential information about 2-3 individuals he should not have. If that information is used for fraudulent purposes, he should be on the radar of the authorities. He shouldn't be charged with anything just for having seen it, but we cannot let reporting a vulnerability be a get-out-of-jail-free card, otherwise you could exploit something for profit, and then report it, and have nothing happen. If he had only verified this happened with his own personal data, there would be no need for this, but that isn't how he handled it. By no means am I defending Sentinel, we need to make sure that we also inform people on how to handle security issues like this /responsibly/ and without causing even more damage.

foota 9y ago
I could be mistaken, but it sounds like they messaged an admin, and did not publicly disclose it. (Other than messaging someone else about it?) Honestly, it sounds like the person here isn't highly familiar with vulnerabilities or disclosure. They probably saw the ID and thought "huh I wonder if I can change that" and then tried two different numbers there. As you state, they should have stopped after one, but they probably didn't expect it to even work the first time.
- cthalupa 9y ago
  His story has now changed - prior to the edit, he was directly linking to the telegram history and saying 'You can verify what I said about things here'
ntnn 9y ago
The person reporting the bug is not a professional bug hunter, he is a user. About 1) - an incognito session wouldn't have had any impact on the situation. It's still the same IP the request comes form. Or a proxy? He's a user, not a security expert. 2) He did report it to Sentinel directly over non-open communication channels: https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i_reported_a_critical_vurnability_in_the_kyc/dtukzcv/?context=0 https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i... This is also clear from the text, I don't know where you got that from. 3) He didn't dispute that 21 people were affected. He disputed the number of 2000, because he tried numbers over 6000 - and since the id is apparently just an increment (which in itself is already a problem) the number is likely to be false. From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company. Quite on the contrary - if he _had_ used a proxy and the authorities would've started an investigation to follow all requests it would've looked a lot worse for him.
- eterm 9y ago
  The recommendation of using incognito is to demonstrate he could access his own data without the appropriate session.
  - ntnn 9y ago
    Ah, that makes sense - thanks!
- cthalupa 9y ago
  > The person reporting the bug is not a professional bug hunter, he is a user. I am aware. This is why I said we need to make sure to attempt to inform people on how to handle these responsibly. > an incognito session wouldn't have had any impact on the situation. It's still the same IP the request comes form. Or a proxy? He's a user, not a security expert. An incognito session would mean he is not using his previous session to gain access. Authentication is more frequently tied to a session than an IP address - this is why you are still logged into HN if you change from your home network to a public wifi, or turn on a VPN. > He did report it to Sentinel directly over non-open communication channels: https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i.. https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i.... This is also clear from the text, I don't know where you got that from. He previously provided a link to a telegram chat specifically with 'You can verify what I said in the chat here'. He has since edited the post and is now claiming differently. > He didn't dispute that 21 people were affected. He disputed the number of 2000, because he tried numbers over 6000 - and since the id is apparently just an increment (which in itself is already a problem) the number is likely to be false. He disputed both. >From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company. Your POV is dangerous. I am not saying he needs to be blamed, but this is quite clearly the incorrect way to handle a data breach and we should educate people on how to do it better. > Quite on the contrary - if he _had_ used a proxy and the authorities would've started an investigation to follow all requests it would've looked a lot worse for him. Not if he only accessed his own data, which is part of my point. When looking for security holes or verifying they work you should /NEVER EVER/ purposefully access the data of anyone else. In some cases this is unavoidable - bugs can leak random data, you can't always set up a reproduction environment, etc - but in this case it was totally avoidable. He should not be prosecuted. He should be educated. Everyone else should also be educated. The point isn't to berate him. He should be in contact with the authorities because he now has access to privileged information, and for all parties' good they need to be aware of who has access to that data so they know who they should speak to if it is used maliciously.

foota 9y ago

I could be mistaken, but it sounds like they messaged an admin, and did not publicly disclose it. (Other than messaging someone else about it?) Honestly, it sounds like the person here isn't highly familiar with vulnerabilities or disclosure. They probably saw the ID and thought "huh I wonder if I can change that" and then tried two different numbers there. As you state, they should have stopped after one, but they probably didn't expect it to even work the first time.

cthalupa 9y ago
His story has now changed - prior to the edit, he was directly linking to the telegram history and saying 'You can verify what I said about things here'

ntnn 9y ago

The person reporting the bug is not a professional bug hunter, he is a user. About 1) - an incognito session wouldn't have had any impact on the situation. It's still the same IP the request comes form. Or a proxy? He's a user, not a security expert. 2) He did report it to Sentinel directly over non-open communication channels: https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i_reported_a_critical_vurnability_in_the_kyc/dtukzcv/?context=0 https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i... This is also clear from the text, I don't know where you got that from. 3) He didn't dispute that 21 people were affected. He disputed the number of 2000, because he tried numbers over 6000 - and since the id is apparently just an increment (which in itself is already a problem) the number is likely to be false. From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company. Quite on the contrary - if he _had_ used a proxy and the authorities would've started an investigation to follow all requests it would've looked a lot worse for him.

eterm 9y ago
The recommendation of using incognito is to demonstrate he could access his own data without the appropriate session.
- ntnn 9y ago
  Ah, that makes sense - thanks!
cthalupa 9y ago
> The person reporting the bug is not a professional bug hunter, he is a user. I am aware. This is why I said we need to make sure to attempt to inform people on how to handle these responsibly. > an incognito session wouldn't have had any impact on the situation. It's still the same IP the request comes form. Or a proxy? He's a user, not a security expert. An incognito session would mean he is not using his previous session to gain access. Authentication is more frequently tied to a session than an IP address - this is why you are still logged into HN if you change from your home network to a public wifi, or turn on a VPN. > He did report it to Sentinel directly over non-open communication channels: https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i.. https://www.reddit.com/user/notarealhacker/comments/7vpfdl/i.... This is also clear from the text, I don't know where you got that from. He previously provided a link to a telegram chat specifically with 'You can verify what I said in the chat here'. He has since edited the post and is now claiming differently. > He didn't dispute that 21 people were affected. He disputed the number of 2000, because he tried numbers over 6000 - and since the id is apparently just an increment (which in itself is already a problem) the number is likely to be false. He disputed both. >From my POV he didn't do anything wrong. He noticed a possible bug, verified it and notified the company. Your POV is dangerous. I am not saying he needs to be blamed, but this is quite clearly the incorrect way to handle a data breach and we should educate people on how to do it better. > Quite on the contrary - if he _had_ used a proxy and the authorities would've started an investigation to follow all requests it would've looked a lot worse for him. Not if he only accessed his own data, which is part of my point. When looking for security holes or verifying they work you should /NEVER EVER/ purposefully access the data of anyone else. In some cases this is unavoidable - bugs can leak random data, you can't always set up a reproduction environment, etc - but in this case it was totally avoidable. He should not be prosecuted. He should be educated. Everyone else should also be educated. The point isn't to berate him. He should be in contact with the authorities because he now has access to privileged information, and for all parties' good they need to be aware of who has access to that data so they know who they should speak to if it is used maliciously.