6 ms·

I would like to highlight the parent post's comment about attempting to contact the people whose work you are exposing vulnerabilities in. I have to say that i

I would like to highlight the parent post's comment about attempting to contact the people whose work you are exposing vulnerabilities in. I have to say that if this is "showing your work" then the most important thing you've shown is poor judgement in publishing their secrets in a submission to a very popular website. The fact that they have followed such shockingly bad security practices themselves is absolutely no excuse. The work I wish we saw was the valiant effort you made to contact the company and help them see their mistakes. That is an area where we can all use more good examples, even if only to show how difficult it is to get something so obviously problematic taken seriously. I'm certain you mean no ill will, but the lack of consideration here is concerning. [EDIT] As per the posters comments, the keys included weren't the real ones. I still think the point stands: they are trivial to obtain when you know they are included in the package so their exclusion only means so much.

noasaservice 5y ago
This is an 0day public disclosure. The company affected should THANK this person for not selling the exploit on the dark web and making bank. And this goes back to the whole "responsible vulnerability disclosure". The damned white hats want to demonize anybody not reaching out to some opaque company and being told it might be fixed in 90-360 days. 0Days are JUST AS responsible as other types of disclosure. You owe them nothing, and they owe you nothing. And you're publishing info to everyone. Information symmetry.
- deadf00d 5y ago
  Yeah, that's what I think too.
- deleted 5y ago
  [deleted]
- mr-wendel 5y ago
  I can't disagree more. They should thank him if he actually reached out to help, even if only to say "look how bad this is; you're easy pwnbait, kthxbye". Based on this article we don't even know if they are opaque (or worse, belligerent). I've tried to be as careful as possible in my wording to avoid demonizing the poster. I still see absolutely nothing indicating maliciousness or ill intent and I would just as strongly disagree with anyone trying to do that. My apologies if I have come across as being hateful in any way. I prefer to champion a web that goes back to a "hacker" culture I learned from in my youth that predates Internet culture: we believe DO owe each other something, somewhere in the positive gradient: basic decency, an assumption that we're all worthy of respect (unless proven otherwise), and that you never try to "score points" at the expense of someone else. But that is just what I believe and what my preferences are. Certainly "do no harm" is the rock bottom line.
  - orf 5y ago
    You don’t owe companies that don’t invest in security anything. This whole comment smells of upmost naïvete. It’s a for-profit company without a bug bounty program, in no way whatsoever should they expect someone to work for free to fix issues they created. The keys are public, they made them public. Do you expect that there are not automated systems trawling apps from the g-play store and doing what he’s doing?
    - noasaservice 5y ago
      I'm sitting there at -3 for what amounts to be an "unpopular opinion" (aside: downvotes/silencing/dead'ing is common here for unpopular but realistic comments in IT, or how dare you offend the techbros, who are invariably writing shitty apps with garbage APIs.) I've made money from selling exploits to companies. Ive also been cheated out and had bugs downrated so they could pay less. Ive also seen colleagues who reported bugs they inadvertently found get hit with a felony (found not guilty). Frankly, this company should thank its lucky stars that the disclosure was an 0Day and not "sell this on dark web and have it exploited for 3mo from 1500 accounts and drain the company's coffers". This person owes the company *nothing*. They found an exploit due to bad API implementation, and wrote about it publicly. If they were in the USA, that's completely in 1fa territory.
    - mr-wendel 5y ago
      If this be naïvete, then I'll happily wear that label, and wear it proudly. I've been around enough to have a good sense of the value you create when you make an effort to consider other people's interests, and that seemed absent in the original post. I disagree that this is naïve, however. I've worked with far too many talented people who think the same way to chalk this thinking up to inexperience or simplicity. That they are a for-profit company is completely irrelevant, as is whether or not they have a bug bounty program. Legal abstractions aside, it's still just people on both sides. The expectation isn't that the poster work for free. The poster could have easily obscured identifying details and the content of his article would not be diminished. It is my opinion that if he wanted to "show his work", work done of his own initiative, then I think it would be more interesting and useful to include something about attempting to assist in remediation. I think, as mentioned by others, it would make a far stronger argument to click that "hire me!" button than anything in his technical analysis. Of course automated systems are on the hunt for this stuff. Same with public code repositories, Docker images, and if you operate a subscription-based service with any popularity then your web interfaces for sign-up, login, etc will be subject to well-orchestrated brute force attacks. That someone did a poor job is all the more reason to avoid potentially contributing to their exploitation. A response within the positive spectrum is absolutely above and beyond. Of all the feedback this community can provide, I think this is the most useful and I'm grateful that the poster has been responsive to it.
- gigaflop 5y ago
  If I leave my door unlocked by accident, and someone leave a note to tell me so, I'm shocked, but happy that I can lock my door and fix the problem. If I accidentally leave my door unlocked, and someone comes in and steals my TV, I'd be upset. I made an honest mistake, and had to pay for it when I wasn't expecting to. If ..., and someone makes a blog post to tell the world that my door is unlocked, my dwelling may be in a permanent state of disrepair by the time I notice. I'd be incredibly unhappy. Mischief doesn't need to cause misery.
deadf00d 5y ago
There is no vulnerability here. Secrets has been anonymised, tokens and secrets provided are not the real ones. I'll follow your advice and update the article once I have an answer from the company.
- dncornholio 5y ago
  > Secrets has been anonymised After or before posting it to the internet?
  - deadf00d 5y ago
    Before. I'm not that crazy.
    - dncornholio 5y ago
      They don't look redacted though, I also don't remember reading you redacted them.
      - deadf00d 5y ago
        I dont say it. If people try, it's gonna lead to nothing. But it's going to be fixed soon.
- mr-wendel 5y ago
  > ... and update the article once I have an answer from the company I look forward to the update and will be very curious to see how that goes. Best of luck! [EDIT] Also I think it worth adding one more thing. I think the poster has demonstrated an openness to feedback that is wonderful. Coming back to the keyboard to read "let me give that a try; I'll update things" is really cool.

noasaservice 5y ago

This is an 0day public disclosure. The company affected should THANK this person for not selling the exploit on the dark web and making bank. And this goes back to the whole "responsible vulnerability disclosure". The damned white hats want to demonize anybody not reaching out to some opaque company and being told it might be fixed in 90-360 days. 0Days are JUST AS responsible as other types of disclosure. You owe them nothing, and they owe you nothing. And you're publishing info to everyone. Information symmetry.

deadf00d 5y ago
Yeah, that's what I think too.
deleted 5y ago
[deleted]
mr-wendel 5y ago
I can't disagree more. They should thank him if he actually reached out to help, even if only to say "look how bad this is; you're easy pwnbait, kthxbye". Based on this article we don't even know if they are opaque (or worse, belligerent). I've tried to be as careful as possible in my wording to avoid demonizing the poster. I still see absolutely nothing indicating maliciousness or ill intent and I would just as strongly disagree with anyone trying to do that. My apologies if I have come across as being hateful in any way. I prefer to champion a web that goes back to a "hacker" culture I learned from in my youth that predates Internet culture: we believe DO owe each other something, somewhere in the positive gradient: basic decency, an assumption that we're all worthy of respect (unless proven otherwise), and that you never try to "score points" at the expense of someone else. But that is just what I believe and what my preferences are. Certainly "do no harm" is the rock bottom line.
- orf 5y ago
  You don’t owe companies that don’t invest in security anything. This whole comment smells of upmost naïvete. It’s a for-profit company without a bug bounty program, in no way whatsoever should they expect someone to work for free to fix issues they created. The keys are public, they made them public. Do you expect that there are not automated systems trawling apps from the g-play store and doing what he’s doing?
  - noasaservice 5y ago
    I'm sitting there at -3 for what amounts to be an "unpopular opinion" (aside: downvotes/silencing/dead'ing is common here for unpopular but realistic comments in IT, or how dare you offend the techbros, who are invariably writing shitty apps with garbage APIs.) I've made money from selling exploits to companies. Ive also been cheated out and had bugs downrated so they could pay less. Ive also seen colleagues who reported bugs they inadvertently found get hit with a felony (found not guilty). Frankly, this company should thank its lucky stars that the disclosure was an 0Day and not "sell this on dark web and have it exploited for 3mo from 1500 accounts and drain the company's coffers". This person owes the company *nothing*. They found an exploit due to bad API implementation, and wrote about it publicly. If they were in the USA, that's completely in 1fa territory.
  - mr-wendel 5y ago
    If this be naïvete, then I'll happily wear that label, and wear it proudly. I've been around enough to have a good sense of the value you create when you make an effort to consider other people's interests, and that seemed absent in the original post. I disagree that this is naïve, however. I've worked with far too many talented people who think the same way to chalk this thinking up to inexperience or simplicity. That they are a for-profit company is completely irrelevant, as is whether or not they have a bug bounty program. Legal abstractions aside, it's still just people on both sides. The expectation isn't that the poster work for free. The poster could have easily obscured identifying details and the content of his article would not be diminished. It is my opinion that if he wanted to "show his work", work done of his own initiative, then I think it would be more interesting and useful to include something about attempting to assist in remediation. I think, as mentioned by others, it would make a far stronger argument to click that "hire me!" button than anything in his technical analysis. Of course automated systems are on the hunt for this stuff. Same with public code repositories, Docker images, and if you operate a subscription-based service with any popularity then your web interfaces for sign-up, login, etc will be subject to well-orchestrated brute force attacks. That someone did a poor job is all the more reason to avoid potentially contributing to their exploitation. A response within the positive spectrum is absolutely above and beyond. Of all the feedback this community can provide, I think this is the most useful and I'm grateful that the poster has been responsive to it.
gigaflop 5y ago
If I leave my door unlocked by accident, and someone leave a note to tell me so, I'm shocked, but happy that I can lock my door and fix the problem. If I accidentally leave my door unlocked, and someone comes in and steals my TV, I'd be upset. I made an honest mistake, and had to pay for it when I wasn't expecting to. If ..., and someone makes a blog post to tell the world that my door is unlocked, my dwelling may be in a permanent state of disrepair by the time I notice. I'd be incredibly unhappy. Mischief doesn't need to cause misery.

deadf00d 5y ago

There is no vulnerability here. Secrets has been anonymised, tokens and secrets provided are not the real ones. I'll follow your advice and update the article once I have an answer from the company.

dncornholio 5y ago
> Secrets has been anonymised After or before posting it to the internet?
- deadf00d 5y ago
  Before. I'm not that crazy.
  - dncornholio 5y ago
    They don't look redacted though, I also don't remember reading you redacted them.
    - deadf00d 5y ago
      I dont say it. If people try, it's gonna lead to nothing. But it's going to be fixed soon.
mr-wendel 5y ago
> ... and update the article once I have an answer from the company I look forward to the update and will be very curious to see how that goes. Best of luck! [EDIT] Also I think it worth adding one more thing. I think the poster has demonstrated an openness to feedback that is wonderful. Coming back to the keyboard to read "let me give that a try; I'll update things" is really cool.