7 ms·

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousan

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find a flaw you simply don't approach the people responsible for it, unless they have an EXCELLENT reputation of dealing with this. Otherwise do an anonymous full disclosure (edit: if you have an entity that routinely handles this sort of thing and has an EXCELLENT reputation, that would work too). If nothing happens, provide a PoC. Of course people, even in IT, are kind of weird here. Somehow responsible disclosure got into people's minds as The Good And Proper Thing to do, and full disclosure being somehow irresponsible. Analogy: Some guy finds out the mayor is completely corrupt or does some illegal stuff. What do you do? a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf?

dzhiurgis 5y ago
Local CERT is sometimes happy to be a proxy, still best do anonymously tho
thepete2 5y ago
That comparison is a bit off though, because exposing the mayor's corruption doesn't put other people and their data at risk.
cortesoft 5y ago
Umm, this seems to imply that these security vulnerabilities are intentional, which doesn't seem like what is happening. In your mayor example, you wouldn't go to the mayor because you know he is intentionally trying to break the law, so going to him doesn't make sense. Incompetence is very different than malfeasance.
- Miraste 5y ago
  The problem is that the response, as it pertains to you, is going to be the same for incompetence or malfeasance in a large number of organizations. Consider what the average self-interested politician would do if you uncovered a corruption problem in their administration they did not know about. Are they going to fix the problem, reward you, and risk losing the next election beneath an avalanche of attack ads? Or are they going to bury it and crush you? Large governments and corporations are not your friends. They will hurt you if it benefits them, often very short-sightedly and regardless of the root problem. There are far too many articles like this one to think "responsible disclosure" is a safe practice. I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges!
  - bigiain 5y ago
    > I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges! If the case you’re remembering is the one where the red team assumed (without asking) that physically breaking into the courthouse at night was “in scope” of their engagement, I’m of the opinion the short-sightedness there was not the agency… https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te... It’s _maybe_ grey area. But there’s no way I’d escalate a pen test to breaking in to a courthouse without explicit in writing permission from someone clearly authorised to give it, including in writing assurances that all relevant law enforcement had been notified (at least at high levels, if part of the authorised physical pen test was actually testing on-ground law enforcement capabilities).
    - Miraste 5y ago
      That is the case I was thinking of, but I went back to check my memory and it was not a gray area. They had a signed contract from the Iowa Judicial Branch and its Information Security Officer that specified gaining physical access to the building. Source: https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-charges-against-men-hired-to-test-their-security/ https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-ch... They did fail to verify that law enforcement was aware (the client specifically asked them not to) and they seem to have misunderstood the building's ownership structure. The end result was that they fulfilled their contract and were arrested for it after encountering one idiot with power, after which the local politicians piled on in order not to look weak.
klyrs 5y ago
Domestic abuse is pretty "normal" too. That doesn't make it tolerable.
- wonderwonder 5y ago
  These 2 things are not even remotely comparable.
  - klyrs 5y ago
    So? Something being "normal" doesn't make it just. Or even legal.
    - wonderwonder 5y ago
      Its not normal in society to commit domestic violence, most people in western society would find themselves ostracized from their peers if they were a known wife / child abuser. If I told my friends the website allowed me to see other plans and I checked them out they would just ask if I saw anything interesting and chuckle at the flaw. Curiosity is normal; beating your spouse is not.
      - klyrs 5y ago
        Ah, I see the misunderstanding. The behavior I'm seeing called "normal" is people being punished in response responsible disclosure, where the actual guilty party is illegally leaking private information. I'm comparing administrative abuse to domestic abuse. If changing a few characters in a URL was a crime, I'd be gone for life. edit: and, I'm using "normal" in the same sense as the comment I was originally responding to: to indicate an everyday occurrence
TeMPOraL 5y ago
Yeah, in my mind, the only "responsible disclosure" these days is one made anonymously to the local data protection authority.
- Verdex 5y ago
  Reading through these comments gave me the same thought. Notice a problem? Buy a raspberry pi with cash, visit starbucks, upload report about the issue to reporters via newly created (and never used again) gmail account, throw away raspberry pi, never talk or think about the issue again.
  - kadoban 5y ago
    Gmail is probably not ideal. Last I tried I needed a phone number to create an account that actually worked.
qwertox 5y ago
All this reminds me of the case of Lilith Wittmann [1], who got sued by the CDU (Germany's majority-holding party) in May 2021 because she discovered a security flaw in their election campaign app "CDU connect". Data from around 100.000 visitors and 18.500 election campaign helpers was not sufficiently secured. She used responsible disclosure to let the CDU know of this flaw, got sued in response. After an outcry from the community the CDU apologized to her and retracted the complaint and the proceeding was suspended in the end of August 2021. It's pretty sad to see how people who act upon their best intentions, intentions which are beneficial to the society, are hit so strongly by those who are afraid to admit that they made a mistake. Hit in such a manner, that it tears apart the daily routine in a very negative way for months. [1] https://lilithwittmann.medium.com/ https://lilithwittmann.medium.com/
- Tepix 5y ago
  The CDU party no longer holds the majority :-)
  - folli 5y ago
    Still can't tell if this is good or bad.
  - taejo 5y ago
    No party ever held a majority in the Federal Republic of Germany. But the CDU was the largest party in the previous parliament, and part of the governing majority.
    - FrodoB 5y ago
      There is by definition almost always a party holding a relative majority (more seats than any other party), which the CDU did for the longest time. You are correct that they did not hold an absolute majority (more seats than everybody else combined), ensuring that they always had to form a coalition to achieve that.
      - 5y ago
avereveard 5y ago
You got things the other way around it's not about the disclosure is about mitigation. If one contacts the corrupted major for a timed disclosure, he gets time to hide crimes or can continue being corrupted, but the press running the story only damages the major. If I run to the press with a vulnerability, everyone is empowered in exploiting it. Sure it puts lots of pressure on the devs, but devs can only work so fast, which creates a window of opportunity which damages both them and their users. A timed disclosure doesn't prevent exploitation that's already happening, but doesn't increase the problem by itself The desired outcomes in the two cases are different, and it's no surprise different strategies are optimal.
- bigiain 5y ago
  > but devs can only work so fast, which creates a window of opportunity which damages both them and their users. Sadly, time and time again, what in practice ends up happening is the window of opportunity is wasted by the devs being instructed to work on new features rather than fix critical security bugs the company thinks are not widely known. Apple’s response to four zero days being only the most recent high profile example of that.
b3morales 5y ago
> a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf? Huh? This analogy doesn't really make sense. The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's being fixed. Malicious actors who hadn't found the vulnerability yet now get it handed to them on a silver platter. Private notification simply gives the operator a head start on closing the hole before it's more widely known by potential attackers.
- formerly_proven 5y ago
  That's not the point of the analogy (some other siblings got it wrong, too, so the fault is likely mine). The point is that it's inherently very risky for you to contact someone about a problem they created accidentally, negligently or possibly intentionally in order to get it fixed (and that might result in them being fined or otherwise punished when the issue becomes known). So you should not do that. You should either seek a trustworthy intermediary for you to handle the interaction (this might be difficult / non-existent in your locale) or reveal the issues anonymously. Again, it's not about Optimally Mitigating Corporate Security Fuckups, it's much more basic than that: it's about keeping you safe. This should obviously be priority #1. Anyone telling anyone else to do responsible disclosure by default because That's What Good Guys Do And You're Not A Good Guy If You Don't is quite clearly not putting the safety of the reporter at #1.
  - b3morales 5y ago
    I see, yes -- I certainly agree with disclosing safely/anonymously.
- kmlx 5y ago
  > The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's being fixed. if it’s live it’s already being exploited. simple principle, but very effective.
bryanrasmussen 5y ago
this is a poor analogy because the IT department isn't doing something illegal, they are just doing something poorly, the proper analogy would be if you found out the mayor routinely left the special stamp that you can use to get anyone released from jail laying on the park bench he eats lunch at - do you then go around telling people hey the mayor does this or do you say hey mayor please stop taking that stamp with you to lunch because you always forget it at the park bench and someday somebody is going to use it to do bad stuff! OR let us reverse the analogy You find out Facebook is running an international slave trade by using their data to find vulnerable teenage girls sending them invites and then kidnapping them. Do you A) approach Facebook and try to get them to stop their practice B) alert everyone immediately. The answer is you alert everyone immediately because Facebook in this example is doing corrupt and illegal things. There is a difference in how you should react concerning security problems that others can take advantage of and willfully committing illegal and corrupt acts.
- fooqux 5y ago
  > this is a poor analogy because the IT department isn't doing something illegal At what point does it cross the line into IT malpractice? I would say that not even bothering to verify the current user has the access to view what is being requested is well over that line. When you're dealing with PII, HIPAA, etc, there should be a standard level of competence. If I go into a doctor's office with a runny nose, and they remove my liver, simply stating that they practiced medicine "poorly" shouldn't be a defense.
judge2020 5y ago
Perhaps many people are spoiled and blinded by the SV megacorp culture of (usually) taking in bug reports and fixing them and handing out recognition/money. It would be nice if everyone accepted responsible disclosure, but that's not going to be the case until some legislation comes along to require it in the absence of malice.
- LordDragonfang 5y ago
  It's not "spoiled" to expect, at worst, a thank you for pointing out a serious and extremely easily exploited vulnerability in public-facing code. You are inarguably doing the company a favor by disclosing it to them and helping them cover their ass and and in some cases lack of competency. Something shouldn't have to be literally illegal to be considered shitty behavior. (Of course, people are often incentivised to be shitty, which is why legislation should also be applied to the issue)
peterburkimsher 5y ago
Trot Hunt from Have I Been Pwned has an "EXCELLENT reputation". Perhaps responsible disclosure could pass through his entity? It's a way of anonymising the source to keep them safe, and centralising the risk to someone who is already highly regarded by companies and governments.
Aeolun 5y ago
I think B would be blackmail?

dzhiurgis 5y ago

Local CERT is sometimes happy to be a proxy, still best do anonymously tho

thepete2 5y ago

That comparison is a bit off though, because exposing the mayor's corruption doesn't put other people and their data at risk.

cortesoft 5y ago

Umm, this seems to imply that these security vulnerabilities are intentional, which doesn't seem like what is happening. In your mayor example, you wouldn't go to the mayor because you know he is intentionally trying to break the law, so going to him doesn't make sense. Incompetence is very different than malfeasance.

Miraste 5y ago
The problem is that the response, as it pertains to you, is going to be the same for incompetence or malfeasance in a large number of organizations. Consider what the average self-interested politician would do if you uncovered a corruption problem in their administration they did not know about. Are they going to fix the problem, reward you, and risk losing the next election beneath an avalanche of attack ads? Or are they going to bury it and crush you? Large governments and corporations are not your friends. They will hurt you if it benefits them, often very short-sightedly and regardless of the root problem. There are far too many articles like this one to think "responsible disclosure" is a safe practice. I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges!
- bigiain 5y ago
  > I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges! If the case you’re remembering is the one where the red team assumed (without asking) that physically breaking into the courthouse at night was “in scope” of their engagement, I’m of the opinion the short-sightedness there was not the agency… https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-test-courthouse-then-arrested-employees.html https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te... It’s _maybe_ grey area. But there’s no way I’d escalate a pen test to breaking in to a courthouse without explicit in writing permission from someone clearly authorised to give it, including in writing assurances that all relevant law enforcement had been notified (at least at high levels, if part of the authorised physical pen test was actually testing on-ground law enforcement capabilities).
  - Miraste 5y ago
    That is the case I was thinking of, but I went back to check my memory and it was not a gray area. They had a signed contract from the Iowa Judicial Branch and its Information Security Officer that specified gaining physical access to the building. Source: https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-charges-against-men-hired-to-test-their-security/ https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-ch... They did fail to verify that law enforcement was aware (the client specifically asked them not to) and they seem to have misunderstood the building's ownership structure. The end result was that they fulfilled their contract and were arrested for it after encountering one idiot with power, after which the local politicians piled on in order not to look weak.

klyrs 5y ago

Domestic abuse is pretty "normal" too. That doesn't make it tolerable.

wonderwonder 5y ago
These 2 things are not even remotely comparable.
- klyrs 5y ago
  So? Something being "normal" doesn't make it just. Or even legal.
  - wonderwonder 5y ago
    Its not normal in society to commit domestic violence, most people in western society would find themselves ostracized from their peers if they were a known wife / child abuser. If I told my friends the website allowed me to see other plans and I checked them out they would just ask if I saw anything interesting and chuckle at the flaw. Curiosity is normal; beating your spouse is not.
    - klyrs 5y ago
      Ah, I see the misunderstanding. The behavior I'm seeing called "normal" is people being punished in response responsible disclosure, where the actual guilty party is illegally leaking private information. I'm comparing administrative abuse to domestic abuse. If changing a few characters in a URL was a crime, I'd be gone for life. edit: and, I'm using "normal" in the same sense as the comment I was originally responding to: to indicate an everyday occurrence

TeMPOraL 5y ago

Yeah, in my mind, the only "responsible disclosure" these days is one made anonymously to the local data protection authority.

Verdex 5y ago
Reading through these comments gave me the same thought. Notice a problem? Buy a raspberry pi with cash, visit starbucks, upload report about the issue to reporters via newly created (and never used again) gmail account, throw away raspberry pi, never talk or think about the issue again.
- kadoban 5y ago
  Gmail is probably not ideal. Last I tried I needed a phone number to create an account that actually worked.

qwertox 5y ago

All this reminds me of the case of Lilith Wittmann [1], who got sued by the CDU (Germany's majority-holding party) in May 2021 because she discovered a security flaw in their election campaign app "CDU connect". Data from around 100.000 visitors and 18.500 election campaign helpers was not sufficiently secured. She used responsible disclosure to let the CDU know of this flaw, got sued in response. After an outcry from the community the CDU apologized to her and retracted the complaint and the proceeding was suspended in the end of August 2021. It's pretty sad to see how people who act upon their best intentions, intentions which are beneficial to the society, are hit so strongly by those who are afraid to admit that they made a mistake. Hit in such a manner, that it tears apart the daily routine in a very negative way for months. [1] https://lilithwittmann.medium.com/ https://lilithwittmann.medium.com/

Tepix 5y ago
The CDU party no longer holds the majority :-)
- folli 5y ago
  Still can't tell if this is good or bad.
- taejo 5y ago
  No party ever held a majority in the Federal Republic of Germany. But the CDU was the largest party in the previous parliament, and part of the governing majority.
  - FrodoB 5y ago
    There is by definition almost always a party holding a relative majority (more seats than any other party), which the CDU did for the longest time. You are correct that they did not hold an absolute majority (more seats than everybody else combined), ensuring that they always had to form a coalition to achieve that.
    - 5y ago

avereveard 5y ago

You got things the other way around it's not about the disclosure is about mitigation. If one contacts the corrupted major for a timed disclosure, he gets time to hide crimes or can continue being corrupted, but the press running the story only damages the major. If I run to the press with a vulnerability, everyone is empowered in exploiting it. Sure it puts lots of pressure on the devs, but devs can only work so fast, which creates a window of opportunity which damages both them and their users. A timed disclosure doesn't prevent exploitation that's already happening, but doesn't increase the problem by itself The desired outcomes in the two cases are different, and it's no surprise different strategies are optimal.

bigiain 5y ago
> but devs can only work so fast, which creates a window of opportunity which damages both them and their users. Sadly, time and time again, what in practice ends up happening is the window of opportunity is wasted by the devs being instructed to work on new features rather than fix critical security bugs the company thinks are not widely known. Apple’s response to four zero days being only the most recent high profile example of that.

b3morales 5y ago

> a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf? Huh? This analogy doesn't really make sense. The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's being fixed. Malicious actors who hadn't found the vulnerability yet now get it handed to them on a silver platter. Private notification simply gives the operator a head start on closing the hole before it's more widely known by potential attackers.

formerly_proven 5y ago
That's not the point of the analogy (some other siblings got it wrong, too, so the fault is likely mine). The point is that it's inherently very risky for you to contact someone about a problem they created accidentally, negligently or possibly intentionally in order to get it fixed (and that might result in them being fined or otherwise punished when the issue becomes known). So you should not do that. You should either seek a trustworthy intermediary for you to handle the interaction (this might be difficult / non-existent in your locale) or reveal the issues anonymously. Again, it's not about Optimally Mitigating Corporate Security Fuckups, it's much more basic than that: it's about keeping you safe. This should obviously be priority #1. Anyone telling anyone else to do responsible disclosure by default because That's What Good Guys Do And You're Not A Good Guy If You Don't is quite clearly not putting the safety of the reporter at #1.
- b3morales 5y ago
  I see, yes -- I certainly agree with disclosing safely/anonymously.
kmlx 5y ago
> The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's being fixed. if it’s live it’s already being exploited. simple principle, but very effective.

bryanrasmussen 5y ago

this is a poor analogy because the IT department isn't doing something illegal, they are just doing something poorly, the proper analogy would be if you found out the mayor routinely left the special stamp that you can use to get anyone released from jail laying on the park bench he eats lunch at - do you then go around telling people hey the mayor does this or do you say hey mayor please stop taking that stamp with you to lunch because you always forget it at the park bench and someday somebody is going to use it to do bad stuff! OR let us reverse the analogy You find out Facebook is running an international slave trade by using their data to find vulnerable teenage girls sending them invites and then kidnapping them. Do you A) approach Facebook and try to get them to stop their practice B) alert everyone immediately. The answer is you alert everyone immediately because Facebook in this example is doing corrupt and illegal things. There is a difference in how you should react concerning security problems that others can take advantage of and willfully committing illegal and corrupt acts.

fooqux 5y ago
> this is a poor analogy because the IT department isn't doing something illegal At what point does it cross the line into IT malpractice? I would say that not even bothering to verify the current user has the access to view what is being requested is well over that line. When you're dealing with PII, HIPAA, etc, there should be a standard level of competence. If I go into a doctor's office with a runny nose, and they remove my liver, simply stating that they practiced medicine "poorly" shouldn't be a defense.

judge2020 5y ago

Perhaps many people are spoiled and blinded by the SV megacorp culture of (usually) taking in bug reports and fixing them and handing out recognition/money. It would be nice if everyone accepted responsible disclosure, but that's not going to be the case until some legislation comes along to require it in the absence of malice.

LordDragonfang 5y ago
It's not "spoiled" to expect, at worst, a thank you for pointing out a serious and extremely easily exploited vulnerability in public-facing code. You are inarguably doing the company a favor by disclosing it to them and helping them cover their ass and and in some cases lack of competency. Something shouldn't have to be literally illegal to be considered shitty behavior. (Of course, people are often incentivised to be shitty, which is why legislation should also be applied to the issue)

peterburkimsher 5y ago

Trot Hunt from Have I Been Pwned has an "EXCELLENT reputation". Perhaps responsible disclosure could pass through his entity? It's a way of anonymising the source to keep them safe, and centralising the risk to someone who is already highly regarded by companies and governments.

Aeolun 5y ago

I think B would be blackmail?