6 ms·

I work as a contractor for a bank. A few months ago everybody was up in arms about a "major" security issue discovered by an auditor (you could see the setting

by raducu 7y ago

I work as a contractor for a bank. A few months ago everybody was up in arms about a "major" security issue discovered by an auditor (you could see the settings of random users by changing an id in a url). I've just shown them you can credit money to your account, yet this is low priority and they provided a fix that I'm 100% percent sure didn't fix anything, unfortunately the functionality is down on all but the production environment. I'm tempted to just credit myself 1 monetary unit in production and just show them the statement.

winrid 7y ago
Sometimes it matters who finds the issue more than what it is....
trymas 7y ago
> I'm tempted to just credit myself 1 monetary unit in production and just show them the statement. I would be tempted too, though I could bet that this will be a termination of an employment, instead of the problem being fixed. I would like to be proven wrong on this speculation..
- neuronic 7y ago
  Not just that, I would expect criminal charges to follow.
- raducu 7y ago
  Yes, that's what I thought as well.I'll just have to suck it up until the test environments are up again and provide a proof of concept exploit. I'm just impatient because it's a really clever and somewhat complex hack that challenges some multi-threading and transactionability assumptions some people mande and I can't really talk about it(which I'd love to share with my peers).
  - deleted 7y ago
    [deleted]
  - unnouinceput 7y ago
    Raducule, did you did CYA (cover your ass)? E-mail(s) to higher ups responsible in case of a fuck-up that most likely will happen in the future? Do it now if you didn't, or "wave and smile" if you did. Let them burn if you are ignored, no longer your problem.
kstenerud 7y ago
Debit yourself 1 monetary unit, and then say you could just as easily credit money.
eithed 7y ago
Not to downplay the issue in question, but you have to be realistic about prioritazation. An exploit of "if I change variable in URL I can see other people data" trumps "if I make multiple concurrent requests with specific input I can give myself monies". I guess not by much, depending on the complexity involved and the know how required to carry one vs the other. Another thing all together is who reported the issue - sometimes it's more of a PR experience, depending on the company
beerandt 7y ago
Never to yourself. Maybe to a board member. Or all of the board members. But that's a big maybe. And make sure your contract covers your ass, under production system testing / penetration, or something similar.
- raducu 7y ago
  I could only exploit this for my own account, and there are only money involved, if it was human lives at stake, I would not have worked at anything else until the issue was fixed. The bug that lead to me discovering the security issue was mitigated by another developer, the security issue was also deemed fixed, I am 100% it was not, but there's no way to proove it at the moment, except u production, that's why I said I was tempted to actually do it. Anyway, there's nothing much to gain by me by antagonising another coleague, the management or the bank. It's not worth the ego boost or frustration scratch, worst case scenario, I don't patch the issue in time and the bank looses money and they start taking security more seriously.
im_with_stupid 7y ago
You'd get much less reprimand if this information was somehow leaked to someone else who then was stupid enough to do it, although to avoid any legal "abetting" you'd have to have some actual documented cya saying "don't mess with this broken feature".
- raducu 7y ago
  I don't have any ill feelings against the bank or the management, it's just a stupid setup where the local prophet gets ignored, we are swamped with bugs, new business features, new regulatory features, outdated devops, a lot of teams scrambling to catch the monthly release, understaffed qa, non-functional test environments and so on. I can understand every piece of the long string of factors that lead to this ridiculous situation where such a serious security issue is not being addressed; any one in particular is not ridiculous, but they all compound to the ridiculous of the end result. I've fixed another ridiculous security issue in the recent past without making big waves, where only one software architect understood the seriousness of just one option in a maven config file(a whole declarative security module was not being weaved into the bytecode because somone added another module and instead of both being applied, only the most recent one was being applied).
  - im_with_stupid 7y ago
    That might be true, but hacking without explicit consent is a good way to get fired with potential jail time.

by raducu 7y ago

winrid 7y ago

Sometimes it matters who finds the issue more than what it is....

trymas 7y ago

> I'm tempted to just credit myself 1 monetary unit in production and just show them the statement. I would be tempted too, though I could bet that this will be a termination of an employment, instead of the problem being fixed. I would like to be proven wrong on this speculation..

neuronic 7y ago
Not just that, I would expect criminal charges to follow.
raducu 7y ago
Yes, that's what I thought as well.I'll just have to suck it up until the test environments are up again and provide a proof of concept exploit. I'm just impatient because it's a really clever and somewhat complex hack that challenges some multi-threading and transactionability assumptions some people mande and I can't really talk about it(which I'd love to share with my peers).
- deleted 7y ago
  [deleted]
- unnouinceput 7y ago
  Raducule, did you did CYA (cover your ass)? E-mail(s) to higher ups responsible in case of a fuck-up that most likely will happen in the future? Do it now if you didn't, or "wave and smile" if you did. Let them burn if you are ignored, no longer your problem.

kstenerud 7y ago

Debit yourself 1 monetary unit, and then say you could just as easily credit money.

eithed 7y ago

Not to downplay the issue in question, but you have to be realistic about prioritazation. An exploit of "if I change variable in URL I can see other people data" trumps "if I make multiple concurrent requests with specific input I can give myself monies". I guess not by much, depending on the complexity involved and the know how required to carry one vs the other. Another thing all together is who reported the issue - sometimes it's more of a PR experience, depending on the company

beerandt 7y ago

Never to yourself. Maybe to a board member. Or all of the board members. But that's a big maybe. And make sure your contract covers your ass, under production system testing / penetration, or something similar.

raducu 7y ago
I could only exploit this for my own account, and there are only money involved, if it was human lives at stake, I would not have worked at anything else until the issue was fixed. The bug that lead to me discovering the security issue was mitigated by another developer, the security issue was also deemed fixed, I am 100% it was not, but there's no way to proove it at the moment, except u production, that's why I said I was tempted to actually do it. Anyway, there's nothing much to gain by me by antagonising another coleague, the management or the bank. It's not worth the ego boost or frustration scratch, worst case scenario, I don't patch the issue in time and the bank looses money and they start taking security more seriously.

im_with_stupid 7y ago

You'd get much less reprimand if this information was somehow leaked to someone else who then was stupid enough to do it, although to avoid any legal "abetting" you'd have to have some actual documented cya saying "don't mess with this broken feature".

raducu 7y ago
I don't have any ill feelings against the bank or the management, it's just a stupid setup where the local prophet gets ignored, we are swamped with bugs, new business features, new regulatory features, outdated devops, a lot of teams scrambling to catch the monthly release, understaffed qa, non-functional test environments and so on. I can understand every piece of the long string of factors that lead to this ridiculous situation where such a serious security issue is not being addressed; any one in particular is not ridiculous, but they all compound to the ridiculous of the end result. I've fixed another ridiculous security issue in the recent past without making big waves, where only one software architect understood the seriousness of just one option in a maven config file(a whole declarative security module was not being weaved into the bytecode because somone added another module and instead of both being applied, only the most recent one was being applied).
- im_with_stupid 7y ago
  That might be true, but hacking without explicit consent is a good way to get fired with potential jail time.