4 ms·

This isn't really a mundane detail though. The fact they have non secure (not even SFTP or FTP over SSL) FTP access open to their main downloads page with a rid

This isn't really a mundane detail though. The fact they have non secure (not even SFTP or FTP over SSL) FTP access open to their main downloads page with a ridiculously insecure password is pretty startling. I can't even understand why they had FTP running like that.

ceejayoz 6y ago
Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps. I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this. As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-anniversary/ https://about.fb.com/news/2020/11/bug-bounty-program-10th-an... > Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.
- hackerpain 6y ago
  I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact. How should I report it in your opinion?
  - ceejayoz 6y ago
    Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc. In the EU, you might be able to report it to a regulator. In Russia, perhaps not.
  - mackenzie-gg 6y ago
    Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty https://www.hackerone.com/product/bounty
    - hackerpain 6y ago
      It's not. They may have a private program, don't know.

ceejayoz 6y ago

Having worked with large enterprise vendors, it's really not startling to me. Depressing, perhaps. I'm saying, though, that a hack can be sophisticated even if the initial compromise was something pretty basic like this. As an example, https://about.fb.com/news/2020/11/bug-bounty-program-10th-anniversary/ https://about.fb.com/news/2020/11/bug-bounty-program-10th-an... > Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our Content Delivery Network (CDN), a global network of servers that deliver content to people accessing our platform around the world, where a subset of our CDN URLs could have been accessible after they were set to expire. After fixing this bug, our internal researchers found a rare scenario where a very sophisticated attacker could have escalated to remote code execution. As always, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty – $80,000.

hackerpain 6y ago
I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact. How should I report it in your opinion?
- ceejayoz 6y ago
  Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc. In the EU, you might be able to report it to a regulator. In Russia, perhaps not.
- mackenzie-gg 6y ago
  Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty https://www.hackerone.com/product/bounty
  - hackerpain 6y ago
    It's not. They may have a private program, don't know.