4 ms·

if a platform which stores information about current 0days in their system get's pwned by an OWASP top-10 it should be considered gross negligence on their part

if a platform which stores information about current 0days in their system get's pwned by an OWASP top-10 it should be considered gross negligence on their part. this isn't the security researchers fault but HackerOne trying to spin the story to their advantage. Absolutely disgusting, but I wouldn't expect anything else from them. We should agree to a system that auto-pwns (takes offline) anything that has an OWASP top-10 in it. janit0r had the right idea when s/he/they took all those IoT devices offline. The Japanese did something similar (iirc in 2018). the top comment in the article nails it: > I'm not a fan of a vulnerability reporting platform giving someone grief for finding a vuln in THEIR platform. Of all orgs, HackerOne should understand the optics of how they communicate with a reporting party. Interrogating your voluntary reporting party with things like "why did you access so much data, you didn't need to" is just stupid, that's common exposure assessment practice for most in the industry. Your vuln was found and exploited either way. Your choices are two: 1. Honorable guy validates scope of access and reports it. 2. Less honorable guy pwns your shit. Come on, HackerOne. EDIT: there is so much we could do (programmatically) using .well-known/security.txt to drive automation for all kinds of things in addition to mere providing of a contact point to report vulns to.

shkkmo 7y ago
You should read the actual report [0]. HackerOne repeatedly thanks the hacker for the report and awards a 20k bounty. > Thank you for confirming you no longer have unauthorized access. As part of our investigation, we also want to make sure we have all the relevant information from you to ensure we’re capturing everything, even as we review our own logs / audit records. As such, we would appreciate your answers to a few questions to assist us. HackerOne ask a bunch of questions about what was accessed. > Again, thank you so much for responsibly reporting this issue to us. We really do appreciate it, and we thank you for your assistance with our investigation. Then later after awarding a 20k bounty: >To make it clear on how we believe these situations should be handled by hackers, we’ve added a clarifying section to our policy. We urge you to review this section, which will reduce the blast radius going forward. We’d like for you to continue to be a valuable member of the community and our top hacker, but for that, we require you to be mindful of the access that particular vulnerabilities give you. Being responsible and understanding the potential consequences of your actions is very important in this field. We hope you understand and will take this into consideration going forward. [0] https://hackerone.com/reports/745324 https://hackerone.com/reports/745324
- tastroder 7y ago
  Not sure what exactly that changes. It's still a relatively basic vulnerability and they still school the reporter after changing ("clarifying") their policy [0]. I realize it's worded to not come across as a threat but I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary. https://hackerone.com/security/policy_versions?change=3624684 https://hackerone.com/security/policy_versions?change=362468...
  - shkkmo 7y ago
    > Not sure what exactly that changes. Tone and how you treat your reporters matters. The comment quoted by the person I responded to was edited to include this after they read the full report: >> Edit: This comment was based on an incomplete understanding of the specifics of the communication between H1 and the reporter. This assessment wasn't the most fair, and I probably should have read the full report before passing judgment. [0] You say: >I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary. Isn't it exactly the commonness of that practice that makes it clear it is important to take the time to educate your reporters and improve your policy? The amount of sensitive data was accessed increased the severity of the breach. HackerOne specifically acknowledges this as one of their planned courses of action to improve things going forward: >> As the community grows, HackerOne needs to ensure that HackerOne is reinforcing the best practices in bug bounty hunting. The HackerOne Community team will look to increase hacker education around delivering proof of critical severity vulnerabilities in case sensitive information has been accessed by the hacker. [0] https://arstechnica.com/information-technology/2019/12/hackerone-breach-lets-outside-hacker-read-customers-private-bug-reports/?comments=1&post=38352571#comment-38352571 https://arstechnica.com/information-technology/2019/12/hacke...
    - tastroder 7y ago
      Fair enough. I find it rather patronizing but I also kind of get your point. H1's gamification requires them to educate their users to some degree, sure. Although I find that far more problematic than some common practice. I'd prefer policy that reflects reality. "If you see usernames or reports, stop and report it" might help with the part of the user base that bought into the gamification but I'm really not sure how that helps responsible disclosure in general. If you're not a paid external security researcherm, of course you click on at least one report to confirm that the vulnerability is actually working and has meaningful impact. Plus, they're still working with curious humans here, not OWASP top 10 scanners. That's just like all those bug bounty programs including some phrase disallowing automated tools. Even for active participants of the platform that's completely unrealistic and introduces unnecessary uncertainty.

shkkmo 7y ago

You should read the actual report [0]. HackerOne repeatedly thanks the hacker for the report and awards a 20k bounty. > Thank you for confirming you no longer have unauthorized access. As part of our investigation, we also want to make sure we have all the relevant information from you to ensure we’re capturing everything, even as we review our own logs / audit records. As such, we would appreciate your answers to a few questions to assist us. HackerOne ask a bunch of questions about what was accessed. > Again, thank you so much for responsibly reporting this issue to us. We really do appreciate it, and we thank you for your assistance with our investigation. Then later after awarding a 20k bounty: >To make it clear on how we believe these situations should be handled by hackers, we’ve added a clarifying section to our policy. We urge you to review this section, which will reduce the blast radius going forward. We’d like for you to continue to be a valuable member of the community and our top hacker, but for that, we require you to be mindful of the access that particular vulnerabilities give you. Being responsible and understanding the potential consequences of your actions is very important in this field. We hope you understand and will take this into consideration going forward. [0] https://hackerone.com/reports/745324 https://hackerone.com/reports/745324

tastroder 7y ago
Not sure what exactly that changes. It's still a relatively basic vulnerability and they still school the reporter after changing ("clarifying") their policy [0]. I realize it's worded to not come across as a threat but I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary. https://hackerone.com/security/policy_versions?change=3624684 https://hackerone.com/security/policy_versions?change=362468...
- shkkmo 7y ago
  > Not sure what exactly that changes. Tone and how you treat your reporters matters. The comment quoted by the person I responded to was edited to include this after they read the full report: >> Edit: This comment was based on an incomplete understanding of the specifics of the communication between H1 and the reporter. This assessment wasn't the most fair, and I probably should have read the full report before passing judgment. [0] You say: >I'm not sure why that was necessary either. It might have been out of scope according to some H1 guideline the reporter wasn't aware of but what the reporter did wasn't really out of the ordinary. Isn't it exactly the commonness of that practice that makes it clear it is important to take the time to educate your reporters and improve your policy? The amount of sensitive data was accessed increased the severity of the breach. HackerOne specifically acknowledges this as one of their planned courses of action to improve things going forward: >> As the community grows, HackerOne needs to ensure that HackerOne is reinforcing the best practices in bug bounty hunting. The HackerOne Community team will look to increase hacker education around delivering proof of critical severity vulnerabilities in case sensitive information has been accessed by the hacker. [0] https://arstechnica.com/information-technology/2019/12/hackerone-breach-lets-outside-hacker-read-customers-private-bug-reports/?comments=1&post=38352571#comment-38352571 https://arstechnica.com/information-technology/2019/12/hacke...
  - tastroder 7y ago
    Fair enough. I find it rather patronizing but I also kind of get your point. H1's gamification requires them to educate their users to some degree, sure. Although I find that far more problematic than some common practice. I'd prefer policy that reflects reality. "If you see usernames or reports, stop and report it" might help with the part of the user base that bought into the gamification but I'm really not sure how that helps responsible disclosure in general. If you're not a paid external security researcherm, of course you click on at least one report to confirm that the vulnerability is actually working and has meaningful impact. Plus, they're still working with curious humans here, not OWASP top 10 scanners. That's just like all those bug bounty programs including some phrase disallowing automated tools. Even for active participants of the platform that's completely unrealistic and introduces unnecessary uncertainty.