3 ms·

This report showcases a ton of tenacity and thoroughness. Not his first time as well: https://sites.google.com/site/testsitehacking/10k-host-header https://site

This report showcases a ton of tenacity and thoroughness. Not his first time as well: https://sites.google.com/site/testsitehacking/10k-host-header https://sites.google.com/site/testsitehacking/10k-host-heade.... Very impressive. “Please stop exploring this further, as it seems you could easily break something” has got to be the best reply one can receive to a bug bounty report.

ben_jones 8y ago
That's what struck me. From the well told story I feel like there were several points of "welp probably can't go further then this better move on to something else" but he kept going and going and sure enough he got somewhere. Hope to see more work published by him over the next few years!
exikyut 8y ago
I wish all companies had the internal connectedness to be able to react to realtime updates and coordinate the exact split second to hold up the friendly stop sign! There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions). So this the best thing you can hear from that standpoint as well. Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos. That sounds like a "fun" job... --- I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in. There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication. - https://arstechnica.com/information-technology/2018/04/panera-accused-security-researcher-of-scam-when-he-reported-a-major-flaw/ https://arstechnica.com/information-technology/2018/04/paner... - https://news.ycombinator.com/item?id=16739753 https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583 https://news.ycombinator.com/item?id=16737583

ben_jones 8y ago

That's what struck me. From the well told story I feel like there were several points of "welp probably can't go further then this better move on to something else" but he kept going and going and sure enough he got somewhere. Hope to see more work published by him over the next few years!

exikyut 8y ago

I wish all companies had the internal connectedness to be able to react to realtime updates and coordinate the exact split second to hold up the friendly stop sign! There have been few stories on here of bounty hunters who've either been scared to go any further than they have, obviously giving the remote end a good excuse to pay less; or who've taken things slightly too far, generating mildly put-out emails and stepped-on toes (which can't bode too well for future interactions). So this the best thing you can hear from that standpoint as well. Straightforward communication seems to be a holy grail, which is understandable: besides needing full internal access to all the areas affected by the full scope of vulnerability (either directly or via intermediaries who are good communicators) so you can figure out when to hit the stop button, you also need to have the resources to delicately balance management risk and developer egos. That sounds like a "fun" job... --- I guess this demonstrates the fundamental requirement of security: the recipient is the one who needs the non-broken understanding of security, both a) properly in and of itself, and b) how it relates to the domain they're in. There are a thousand public examples of where this has been gotten hopelessly wrong; my bookmarks are a mess, so here's the (somewhat poorly related) one I can remember how to find via Google (it's as bad as all the others, wouldn't mind being reminded and learning about new ones). This one is not the same kind of vulnerability (there's no need to coordinate pushing a stop button, it's a data breach), it's just an example of grossly misunderstood security and utterly broken internal communication. - https://arstechnica.com/information-technology/2018/04/panera-accused-security-researcher-of-scam-when-he-reported-a-major-flaw/ https://arstechnica.com/information-technology/2018/04/paner... - https://news.ycombinator.com/item?id=16739753 https://news.ycombinator.com/item?id=16739753 / https://news.ycombinator.com/item?id=16741391 https://news.ycombinator.com/item?id=16741391 / https://news.ycombinator.com/item?id=16737583 https://news.ycombinator.com/item?id=16737583