13 ms·
Security Researcher Assaulted Following Vulnerability Disclosure
- YjSe2GMQ 8y agoIf you (like me) didn't know what a Shodan safari is, you're in for a fun ride: https://techcrunch.com/2019/01/21/shodan-safari/ https://techcrunch.com/2019/01/21/shodan-safari/
- strictnein 8y agoIt is unbelievable what, to this day, is still directly connected to the Internet. Everything from pharmacy prescription systems, to large cargo ships in the middle of the pacific, to dam control systems. Shodan is an awesome tool.
- morpheuskafka 8y agoAlso they have a free plan for anyone with an edu email, great way to kill a few hours in between studying!
- jstanley 8y agoWithout Oath's abusive GDPR wall: https://outline.com/JF28AH https://outline.com/JF28AH
- xxxanony 8y agobest $50 I ever spent
- saagarjha 8y agoWith articles like this, I often to take out the horrible thing that the company is doing and post the quote to Hacker News, to give a sense of the scale of the issue; in this case me trying to do so would require including the majority of the article. It’s that bad. And yes, apparently the company thought it was ok for the COO to physically assault security researchers at a conference.
- tacon 8y agoOne of the Glassdoor reviews mentions the COO getting wasted at tradeshows, so maybe the assault is just normal behavior for him.
- clubm8 8y agoWeird, I've gotten "wasted" at tradeshows but never assaulted anyone :)
- JabavuAdams 8y agoAngry drunk vs. happy drunk is a good zeroth-order personality test.
- clubm8 8y ago> Angry drunk vs. happy drunk is a good zeroth-order personality test. And to be fair even "happy drunk" can be unprofessional in the wrong context. But I think anyone who judges someone for how they act in a bar, after dark, and the concern is they were too jovial (absent some kind of sexual harassment or belting out racist jokes) is not someone I'd want to work with anyways.
- AndrewKemendo 8y agoCasinos have such a large attack surface that they should be thanking anyone and everyone who exposes any vuln.
- penagwin 8y agoSo is this still a vulnerability? Time to do some more digging boys!
- deleted 8y ago[deleted]
- saagarjha 8y agoIn the off chance that you're serious, this sounds like a great way to land yourself in federal prison.
- walrus01 8y agoAs if blackhats in Vladivostok are particularly afraid of the FBI. Once the vulnerability is public, if that stuff is still connected to the public Internet, game over.
- kbenson 8y agoI'm pretty sure this article is all that was required for some enterprising people to do their own research and find some of the same vulnerabilities. I imagine we might see some interesting damages outlined in some lawsuits from casinos against Atrient.
- WrtCdEvrydy 8y ago> a great way to land yourself in federal prison. For what? Checking shodan and seeing that people don't know how to write secure code.
- a3n 8y agoWouldn't the Nevada Gambling Commission be interested in this?
- rhexs 8y agoI mean, maybe, but do you really think they have some sort of well-staffed cyber-division that would 1. understand this and 2. know what to do with it? My guess is they're still operating like it's the 1980s. Hopefully I'm wrong! Curious that the FBI now does vulnerability coordination. Haven't ever heard that before.
- lallysingh 8y agoThere could be blanket clauses like reasonable efforts to secure private information, access controls, etc. They don't have to specify on the regulation what has to be done, just let prosecutors argue that it's not sufficient.
- a3n 8y agoMy guess would be yes, since so much of gambling is electronic. "Wire fraud" is pretty old.
- daeken 8y agoI've not dealt with the NGC directly -- only other gaming commissions and some NGC partners -- but everyone I've dealt with in gambling has cared deeply about security. They often get it wrong, but they take this stuff very seriously.
- reaperducer 8y agodo you really think they have some sort of well-staffed cyber-division that would 1. understand this and 2. know what to do with it? 1. Yes. 2. Also yes. The Nevada Gaming Commission, all of the big casino companies in its state, and the companies that make the gambling machines, are quite remarkable, technologically speaking. Sometimes I think the terrible web sites they have for hotel reservations are just a smokescreen.
- 8y ago
- cody8295 8y agoI was once fired from a state job (USA) for bringing a vulnerability forward in the online ethics training. You can run "setScore(100, 0, 100)" in the developer console and pass the exam without actually taking it. (The state used a third party online exam provider who I contacted). I was fired by the end of the week
- cody8295 8y agoEdit: the vulnerability still exists on many online exam styled pages.
- WrtCdEvrydy 8y agoOf course it does, half the fucking garbage software you use in a browser is using shitty client side validation.
- mLuby 8y agoSorry you got fired from your old job. Sounds like your new job could be "pay a dollar to skip the exam."
- saagarjha 8y agoIn that case you fail the test for showing a lack of ethics ;)
- 8y ago
- 2sidestoacoin 8y agoSo they agreed with them about the 60,000 bounty, were waiting for a NDA agreement with the lawyers, but this didn't happen fast enough for them and so they showed up unannounced to an important conference where the company was announcing a new product to question them about it. Obviously assault is not right at all. But was this really the right way to check on the status of a security fix?
- outworlder 8y agoAfter getting ignored even when the FBI got involved? What would be the right way then?
- empath75 8y agoProbably through your lawyers.
- outworlder 8y ago_their_ lawyers, I guess. Which would be paid out of their own pockets?
- deleted 8y ago[deleted]
- megous 8y agoAnything else bothers you about this story? Because how they chose to contact Atrient seem like the very unimportant detail in all this.
- 2sidestoacoin 8y agoI'm bothered by people being assaulted just as much as most of the commentators here. Just because I'm not parroting the same "wow Atrient is bad, security researchers good" message doesn't mean my comment is not valid. Obviously a security researcher that has reported an issue wants to have a healthy dialogue with the company and see that the flaw is patched in a reasonable time frame. But lets not pretend that we have all the facts here. Were they in the middle of an internal investigation? If that investigation showed that there was nobody actively exploiting this issue, doesn't Atrient have the right to patch this vulnerability on their own timeline rather than the researchers?
- jstanley 8y ago> Because there is no SSL protection and because the API is wide open and vulnerable to abuse, it is possible to identify kiosks by their Mac address Eh?
- ScottBurson 8y agoIt should have said "MAC address" [0]. Nothing to do with Apple Macintoshes. [0] https://en.wikipedia.org/wiki/MAC_address https://en.wikipedia.org/wiki/MAC_address
- jstanley 8y agoThat still doesn't make any sense to me in the context of the rest of the sentence.
- bashinator 8y agoPossibly, existing kiosks are registered by MAC address in the API. By querying the API for registered kiosks, you can pretend to be one by spoofing the MAC
- Keverw 8y agoI wonder if Casino's run their machines, etc on the same network as guests are on at the hotel, etc... I'd think they'd at least isolate the networks to at least make things a bit harder... Maybe you could be sneaky and unplug an ethernet cable and plug in a device but apparently, the eye in the sky would catch you, and end up in serious trouble. I know some probably have apps to check your rewards, etc but that probably would run on the public internet with some sort of proxy into their private databases. I'm not really into gambling, the family took me once when I turned 21 and was kinda boring. I just waited around while everyone else played video pocket. Free Mt. Dew though... Also, all the woman seem to wear something to show off their breasts more, I guess more tips... So stereotypical like you'd see on television. At least they banned smoking in casinos, I guess in the old day's people would be smoking right next to you. Oh, Google'd it and it seems like they allow it in Vegas at the casino and bar, just not restaurants. Wow. I believe in my state it's a standard ban inside completely of any public building. Also, reports of Atlantic City dying now since more and more states have allowed Casino's to open. I seem to associate gambling with Vegas though over any other city. I wouldn't mind going to just play the slots someday again, but really not into wasting money right now.
- lucb1e 8y ago... so more than two thousand words into the article, having built up to the title of "assaulted" in the context of casinos (which have a movie reputation of hiring big boys to beat you up for things like counting cards and, apparently, vulnerability disclosure), and being a security guy myself, this is the entirety of the assault: > When one of the security researchers [approached Jessie at a conference] and introduced himself as the researcher who Jessie had been dealing with, Jessie suddenly lunged at the researcher and violently grabbed him by his clothes on his chest before then tearing his attendee badge away from him, telling the researcher that he didn't need it anymore and that he would keep hold of it. It was in front of other people, at a conference, and all that the article admits to happening is "grabbing by clothes", "taking his badge", and angry words. That was not worth my time.
- excalibur 8y agoAgreed, the "assault" was a big let down. But it did serve as a good hook to draw more attention to this company's awful security practices and apparent unwillingness to fix them.
- starpilot 8y agoIf only he were brutally beaten to provide you a more stimulating story.
- deleted 8y ago[deleted]
- lucb1e 8y agoIf only they hadn't put it on so thick, we wouldn't have had our time wasted with something that it turns out, after reading nearly to the end, we didn't want to read.
- jjulius 8y ago>... we... Seems like a lot of other people in this thread found it interesting and enjoyed the read. Who's the "we" that you're speaking for here?
- meritt 8y agoDisclosing security vulnerabilities that aren't part of a bug bounty program takes a large amount of either courage or ignorance. Until there are protections in place for a given jurisdiction, far safer to leak it anonymously or just stay quiet. I was surprised that GDPR didn't contain any sort of protections for security researchers. The fines collected are hefty enough they could easily run a very successful bug bounty program.
- 3pt14159 8y agoI agree with you, but it isn't a clear cut issue. Attacking a server right now comes with some legal risk, which is a deterrent to some. It's impossible to tell white hats from black. If it were paired with a law that made it a felony to resell vulns to third parties then it would be much more robust.
- jplayer01 8y agoThe only way you're going to reduce the amount of vulnerabilities being sold on black markets is to provide sufficient financial and social incentive. There are enough people with dubious morals who don't care how illegal it is to find and exploit them, who will eagerly take the biggest payday. Combine no guarantee you'll get paid, poor treatment by authorities and employers and the (albeit low) risk of getting your shit kicked in, I'm not surprised people aren't lining up at the door to report vulnerabilities.
- 3pt14159 8y agoI agree completely, but the issue is that the vulnerability value is asymmetric. It's about $1m to get an iPhone no-click RCE. Up to about $4m for one with a seemingly long shelf life. Apple is not going to pay $Xm for their bug bounty. That said, that there will be some that continue to engage in illegal activity doesn't mean we shouldn't make it illegal in the first place. I'd even be in favour of treating certain classes of vulnerability sale as an act of terrorism or treason or arms export violation. I know it is hard, but we have to try to solve this.
- nodesocket 8y agoWhile the behavior of Atrient and specifically Jessie Gill is absurd in terms of working with the researchers to address the issues and pay the bounty, I am always skeptical of these captured videos. We don't have any context of what was said before and what the communication between the researchers and Atrient was like other than their accounts. Maybe I am just being cynical, but I've personally had interactions with security researchers who are extremely arrogant and on a vendetta to show how smart they are, and drift from white hat to grey or in some cases black hat territory.
- bigiain 8y agoDoes it matter what happened before? Is there _any_ circumstance under which that's appropriate or even justifiable behaviour for a CxO, no matter what had happened in the preceding few moments? If your CxO isn't capable of maintaining professional behaviour in front of arrogant researchers or blackhats boasting in public, I'd suggest it's well past time to be polishing up your resume and moving on...
- nereus18 8y agoI personally (and unfortunately) know Jessie Gill of Atrient. I have to, for work purposes. The way his interactions and comments/quotes were described in that article were exactly things that he would say and do. He's a pretty violent guy actually. And the way he's acting in that video, only saying, "I don't know you" and sitting down, he knows he needs to watch what he says because there are a lot of things that that video could tie to later. Anyway, I wasn't there so I can't be 100% sure of anything, but I have known Jessie for years, hell I've been to his house several times, and the behavior is spot on.
- me9187 8y agohello! thanks for this comment would you be able to contact me on twitter @me9187 (this account is mentioned in the secjuice article for verification) and tell us a little bit more about your experiences?
- 8y ago
- bredren 8y agoTo assault a programmer on the floor of a conference and expect to get away with says a lot about what this person has likely gotten away in their past.
- Keverw 8y agoYeah, especially a tech conference. Everyone has phones with cameras, vloggers and journalists covering things. I know there are stories of casinos in Vegas breaking people's legs for cheating, but I guess that doesn't happen anymore since big corporations run them now with too much to lose. Plus if that ever happened and went viral, it would hurt their business.
- Animats 8y agoNow that this is out in the open, I wonder how much longer Atrient will stay in business. These people sell these systems to casinos. Their customers are not going to like this at all. Atrient mostly handles affinity cards and such. So they have lots of info about customers, including drivers license scans[1], but not much of a connection into the casino's main systems. A basic break-in might get you a suite upgrade or free booze. A more ambitious attacker would obtain the casino's customer list, with enough info to identify big losers and big winners. [1] http://www.atrient.com/products/card-printing-enrollment/ http://www.atrient.com/products/card-printing-enrollment/
- caf 8y agoWell there was also this: "...and that you could enter casino cash prize draws with as many entries as you wanted in order to win them, ..."
- technion 8y agoRegarding a "casino's main systems".. Going back a few years I was involved with a gaming organisation. We were advised that certain activities legally had to be air gapped (we are not in the US), and I raised an issue of how it is that servers could be accessed by VNC (single dictionary word password) over the Internet if that were the case. I was advised that the server was installed in a rack with 1RU of space between it and the router connecting it to the internet, and that lawyers had reviewed it and considered that to meet the legal definition. I strongly suspect you'll find core activities just as vulnerable.
- helios893 8y agoSo open season on Atrient?
- whyisthewhat 8y agoThis is not the first time Atrient has been sloppy with the details of their NDAs, nor the first time Jessie Gill has gotten in trouble for being a touch too eager to get physical. https://www.leagle.com/decision/infdco20180828d81 https://www.leagle.com/decision/infdco20180828d81
- corebit 8y agoHahahaha, how terrible is Atrient's lawyer, Mark E. Ferrario, for filing a complaint that didn't even allege a cause of action?! He just asked the court to do some random stuff without arguing a case. The whole opinion is just, "Plaintiff didn't allege anything, so dismissed".
- techntoke 8y agoGeez, what a creep and psychopath. This is what happens when someone thinks that they are too rich to follow the rules of society.
- Abimelex 8y agoPeople are complaining a lot about GDPR here but such a case would definitely lead to a fine of 4% or 8% of atrients revenue.
- LaserToy 8y agoThis one does deserve to be called vulnerability. It is a plain stupidity.
- deleted 8y ago[deleted]
- gene_vache 8y agoDoes anyone figure this guy is connected and the third party contractors hired to program the kiosks were some student working from home in his off time?
- heyjudy 8y agoPlay stupid games with mafioso, win stupid prizes. (Pun intended.)
- michaelmrose 8y agoSuch behavior needs to lead to jail time and not just a trivially payable fine so that the rich like the poor understand that wrongdoing has consequences.
- techslave 8y agog’bye atrient. we hardly knew ye.
- craftoman 8y agoWe should not forget the 18 year's old Hungarian "hacker" that was arrested for opening Dev Tools and modified HTML values. https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-for-pressing-f12/ https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-...
- jeddhor 8y agoWonderful man, this Jessie Gill. https://www.leagle.com/decision/infdco20180828d81 https://www.leagle.com/decision/infdco20180828d81