3 ms·

I've never had this happen but what I've had in the past is people saying "This isn't a vulnerability", then I told them I would go public with it with an Easy

I've never had this happen but what I've had in the past is people saying "This isn't a vulnerability", then I told them I would go public with it with an Easy POC that anyone could do. Example: http://writecodeeveryday.github.io/projects/badqr/ http://writecodeeveryday.github.io/projects/badqr/ I literally had to twist their arm to get it patched... since was a something to 'reduce friction' which allowed you to steal someone's Bitcoins. At the time, the POC would have netted me $40 for every person I scammed, today, it's a $400 profit and that tool would generate a QR telling people there's free bitcoin at Coinbase so I bet you someone would have used it. Edit: I told my boss if they didn't do shit about it, I would put that QR code with 'Social Engineering' into Facebook ads since it had just started and see how much money I made out of it.

kerng 8y ago
With Amazon AWS I had fun exchange a couple of years back. They don't have a bug bounty (still I think), but their response was that they will fix it but not publicly recognize it because "the cloud is always secure"? Go figure.
- killbrad 8y ago
  This is hyperbolic nonsense. Having worked at AWS, I've never encountered a business that is more serious about their security position.
  - kerng 8y ago
    It's not, I still have the email exchange from a couple years back - I thought of posting it somewhere because it was so odd, but I dont have a blog and I am not interested in publicity. Amazon still doesn't offer a bug bounty program to my knowledge. Also, it's the only cloud provider my active security researcher friends tell me that attempts to regulate them by some weird pen test authorization requirements which are very foreign to industry standards of other cloud providers. I'm just on the side lines watching, but there is a difference of how transparent AWS vs. GCP vs. Azure are when it comes to security. GCP > Azure > AWS
    - WrtCdEvrydy 8y ago
      > pen test authorization requirements Yes, we don't want people to publicize when we fuck up so we'd rather just NDA them to death when they tell us about bugs. Edit: If you don't accept, we just use the hacking laws in the US to silence you.
      - lawnchair_larry 8y ago
        Well, you’re not entitled to conduct attacks on them at all, so why shouldn’t the terms be up to them?
      - Drdrdrq 8y ago
        This sounds.. awful. I'm sure there are reasons, but hiding information this way makes you seem incompetent and unsure of yourself (you as Amazon, not you personally) in my eyes. Edit: I assume you are speaking as employee of Amazon of course, which is not necessarily true.
    - diogenescynic 8y ago
      Pretty sure they do: https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-bug-bounties https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-... And: https://aws.amazon.com/security/vulnerability-reporting/ https://aws.amazon.com/security/vulnerability-reporting/
      - kerng 8y ago
        It's just reporting, no payouts.
    - lawnchair_larry 8y ago
      There’s no way that would be their reason.

kerng 8y ago

With Amazon AWS I had fun exchange a couple of years back. They don't have a bug bounty (still I think), but their response was that they will fix it but not publicly recognize it because "the cloud is always secure"? Go figure.

killbrad 8y ago
This is hyperbolic nonsense. Having worked at AWS, I've never encountered a business that is more serious about their security position.
- kerng 8y ago
  It's not, I still have the email exchange from a couple years back - I thought of posting it somewhere because it was so odd, but I dont have a blog and I am not interested in publicity. Amazon still doesn't offer a bug bounty program to my knowledge. Also, it's the only cloud provider my active security researcher friends tell me that attempts to regulate them by some weird pen test authorization requirements which are very foreign to industry standards of other cloud providers. I'm just on the side lines watching, but there is a difference of how transparent AWS vs. GCP vs. Azure are when it comes to security. GCP > Azure > AWS
  - WrtCdEvrydy 8y ago
    > pen test authorization requirements Yes, we don't want people to publicize when we fuck up so we'd rather just NDA them to death when they tell us about bugs. Edit: If you don't accept, we just use the hacking laws in the US to silence you.
    - lawnchair_larry 8y ago
      Well, you’re not entitled to conduct attacks on them at all, so why shouldn’t the terms be up to them?
    - Drdrdrq 8y ago
      This sounds.. awful. I'm sure there are reasons, but hiding information this way makes you seem incompetent and unsure of yourself (you as Amazon, not you personally) in my eyes. Edit: I assume you are speaking as employee of Amazon of course, which is not necessarily true.
  - diogenescynic 8y ago
    Pretty sure they do: https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-bug-bounties https://www.amazon.jobs/en/jobs/750254/security-engineer-ii-... And: https://aws.amazon.com/security/vulnerability-reporting/ https://aws.amazon.com/security/vulnerability-reporting/
    - kerng 8y ago
      It's just reporting, no payouts.
  - lawnchair_larry 8y ago
    There’s no way that would be their reason.