6 ms·

So if I understand correctly, this was found by scanning the Alexa top 1M for exposed .git directories. It's based on research from 2015 where the authors... sc

So if I understand correctly, this was found by scanning the Alexa top 1M for exposed .git directories. It's based on research from 2015 where the authors... scanned the Alexa top 1M for exposed .git directories. Anyone want to hazard a guess at whether anyone else between 2015 and 2018 also thought to run the same experiment with the same parameters and thus also downloaded ebay.co.jp's production database passwords and Wordpress admin credentials? Of course, that would only be a concern if the master hacker in question decided eBay Japan's backend data was more valuable than having their name on a website that says "good job thanks".

comboy 8y ago
It's beyond me why they don't reward such guy even if they don't have any bounty program in place. 10-100K is pennies to them. It just seems more economic to pay white hats than to deal with effects of black hats actions. But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..
- cal97g 8y ago
  If ebay weren't such a fundamentally terrible company I'm sure they would. This doesn't surprise me based on the companies culture generally. They're always trying to stiff people out of money, their platform is full of scammers, and their fees are ridiculous.
- s_dev 8y ago
  Before GDPR there actually wasn't much penalty for reckless collection and storage of personal data. Only PR damage had to be considered.
  - eiurafhlfie 8y ago
    Bear in mind though that Ebay Japan does not target EU/no/ch customers, which is a requirement for the "big reach" of the GDPR. Wikipedia excerpt: "... for all individuals within the European Union (EU) and the European Economic Area (EEA)." https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
    - EinsDueTresFour 8y ago
      It is likely though that, if GDPR proves effective, other countries will soon follow suit and implement a similar set of data protection regulations. Perhaps by then companies around the world will be forced into paying more attention to these matters, and a system of reward for white hats may become the norm.
      - pojzon 8y ago
        With GDPR version in each country after some time the best market will be for companies to lawsuit other IT companies over violations.. After some time smaller companies will be forced to work on market siloses, to not jave to worry about such lawsuits.
    - CathyWest 8y ago
      EinsDueTresFour: I see I'm not the only one who's been shadowbanned for refusing to march to the drum of the Silicon Valley fat cats.
    - XCabbage 8y ago
      I've generally read on Hacker News that having EU users is sufficient to put you within the GDPR's reach, and that for a web service there's therefore nothing that will protect you besides IP-blocking Europe. The quote that you provide here that supposedly shows that the GDPR is irrelevant to Ebay Japan does not in fact contradict that claim. Do you have an excerpt or other source that does?
      - yc-kraln 8y ago
        Amusingly, if a European citizen is not in Europe, they are also covered, so IP banning Europe will not help you.
        ashelmire 8y ago
        The analysis I’ve seen from lawyers is that it only applies to EU citizens inside the EU.
- CathyWest 8y ago
  I'm probably wasting my time unless a lot of people have enabled showing dead posts, as the moment I voiced criticism of the silicon valley establishment I got hid by a shadow ban. So I suppose I have nothing to lose from voicing the same again: Let it henceforth be known that researchers need not bother with the bounty program and just do a full disclosure of any eBay vulnerabilities. This so-called "responsible disclosure" does very little to protect the public and only lets companies fly under the radar with their reckless behaviour. > Ebay was very responsive and fixed the issue about 10-12 hours after I reported it. 10 to 12 hours is responsive? All it takes is a minute to pull the load balancer and nobody would be able to exploit the vulnerability, but that forces them to lose face in front of their customers (but that's exactly what they deserve). The only truly responsible way to deal with vulnerabilities is to notify, give them no more time than it takes them to take the site off-line, and then do full disclosure.
  - dang 8y ago
    We banned you for using yet another account to break HN's guidelines, as we've done before and as you've done before. We couldn't care less which establishment you criticize. A common trollish trick is to use explicitly female usernames, so when we come down hard on them, it looks like we're abusing women. Another common troll trick is to make self-serving proclamations about why they were banned. If you want to participate on HN, you need to take the spirit of this site to heart, as described at https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, and use it only as intended.
- GuiA 8y ago
  The fact that the issue remains unaddressed just tells us the organization (as in, the management chain) is fundamentally broken from a tech point of view. From there, it is not surprising that they would not bother to compensate white hat hackers, because we have established that the organization is fundamentally broken.
- deleted 8y ago
  [deleted]
- megy 8y ago
  > It's beyond me why they don't reward Who? They?
cheschire 8y ago
And now there's confirmation that their bug bounties come with significant caveats that make payout unlikely even for large vulnerabilities. Any future vulnerabilities are now less likely to be reported.
mpeg 8y ago
I used to have a collection of downloaded user databases in an encrypted partition in my iPod back when I was in high school. Some were actually pretty high profile sites (probably top 100 at the time) but I was worried they'd come after me if I reported the vulnerabilities (that was the standard response before bounty programs and such) so I just dumped it and moved on. I'm sure I'm not the only one that just did it for sport.
chelmzy 8y ago
I've been running the same scan since mid 2017 and it has netted me a substantial amount of bounties. There's 100s of people that run internet wide scans of exposed git. And of course I also report to companies that don't have bounties (anonymously). I actually found a different eBay domain with the same issue and they added me to their security hall of fame. The main problem is that new developers come and go, so does the exposed gits.

comboy 8y ago

It's beyond me why they don't reward such guy even if they don't have any bounty program in place. 10-100K is pennies to them. It just seems more economic to pay white hats than to deal with effects of black hats actions. But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..

cal97g 8y ago
If ebay weren't such a fundamentally terrible company I'm sure they would. This doesn't surprise me based on the companies culture generally. They're always trying to stiff people out of money, their platform is full of scammers, and their fees are ridiculous.
s_dev 8y ago
Before GDPR there actually wasn't much penalty for reckless collection and storage of personal data. Only PR damage had to be considered.
- eiurafhlfie 8y ago
  Bear in mind though that Ebay Japan does not target EU/no/ch customers, which is a requirement for the "big reach" of the GDPR. Wikipedia excerpt: "... for all individuals within the European Union (EU) and the European Economic Area (EEA)." https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
  - EinsDueTresFour 8y ago
    It is likely though that, if GDPR proves effective, other countries will soon follow suit and implement a similar set of data protection regulations. Perhaps by then companies around the world will be forced into paying more attention to these matters, and a system of reward for white hats may become the norm.
    - pojzon 8y ago
      With GDPR version in each country after some time the best market will be for companies to lawsuit other IT companies over violations.. After some time smaller companies will be forced to work on market siloses, to not jave to worry about such lawsuits.
  - CathyWest 8y ago
    EinsDueTresFour: I see I'm not the only one who's been shadowbanned for refusing to march to the drum of the Silicon Valley fat cats.
  - XCabbage 8y ago
    I've generally read on Hacker News that having EU users is sufficient to put you within the GDPR's reach, and that for a web service there's therefore nothing that will protect you besides IP-blocking Europe. The quote that you provide here that supposedly shows that the GDPR is irrelevant to Ebay Japan does not in fact contradict that claim. Do you have an excerpt or other source that does?
    - yc-kraln 8y ago
      Amusingly, if a European citizen is not in Europe, they are also covered, so IP banning Europe will not help you.
      - ashelmire 8y ago
        The analysis I’ve seen from lawyers is that it only applies to EU citizens inside the EU.
CathyWest 8y ago
I'm probably wasting my time unless a lot of people have enabled showing dead posts, as the moment I voiced criticism of the silicon valley establishment I got hid by a shadow ban. So I suppose I have nothing to lose from voicing the same again: Let it henceforth be known that researchers need not bother with the bounty program and just do a full disclosure of any eBay vulnerabilities. This so-called "responsible disclosure" does very little to protect the public and only lets companies fly under the radar with their reckless behaviour. > Ebay was very responsive and fixed the issue about 10-12 hours after I reported it. 10 to 12 hours is responsive? All it takes is a minute to pull the load balancer and nobody would be able to exploit the vulnerability, but that forces them to lose face in front of their customers (but that's exactly what they deserve). The only truly responsible way to deal with vulnerabilities is to notify, give them no more time than it takes them to take the site off-line, and then do full disclosure.
- dang 8y ago
  We banned you for using yet another account to break HN's guidelines, as we've done before and as you've done before. We couldn't care less which establishment you criticize. A common trollish trick is to use explicitly female usernames, so when we come down hard on them, it looks like we're abusing women. Another common troll trick is to make self-serving proclamations about why they were banned. If you want to participate on HN, you need to take the spirit of this site to heart, as described at https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, and use it only as intended.
GuiA 8y ago
The fact that the issue remains unaddressed just tells us the organization (as in, the management chain) is fundamentally broken from a tech point of view. From there, it is not surprising that they would not bother to compensate white hat hackers, because we have established that the organization is fundamentally broken.
deleted 8y ago
[deleted]
megy 8y ago
> It's beyond me why they don't reward Who? They?

cheschire 8y ago

And now there's confirmation that their bug bounties come with significant caveats that make payout unlikely even for large vulnerabilities. Any future vulnerabilities are now less likely to be reported.

mpeg 8y ago

I used to have a collection of downloaded user databases in an encrypted partition in my iPod back when I was in high school. Some were actually pretty high profile sites (probably top 100 at the time) but I was worried they'd come after me if I reported the vulnerabilities (that was the standard response before bounty programs and such) so I just dumped it and moved on. I'm sure I'm not the only one that just did it for sport.

chelmzy 8y ago

I've been running the same scan since mid 2017 and it has netted me a substantial amount of bounties. There's 100s of people that run internet wide scans of exposed git. And of course I also report to companies that don't have bounties (anonymously). I actually found a different eBay domain with the same issue and they added me to their security hall of fame. The main problem is that new developers come and go, so does the exposed gits.