4 ms·
...and that is why you never try to help businessmen. EVER. You just laugh and move on. At best you tell people privately not to do business with them, but you
by EarlKing 5y ago
...and that is why you never try to help businessmen. EVER. You just laugh and move on. At best you tell people privately not to do business with them, but you NEVER stick your neck out. There is absolutely no way this wasn't going to end in a lawsuit. Don't be this guy. Seriously. No matter how much of a duty you think you have to report security matters you find this episode vividly illustrates the fact that no good deed goes unpunished.
And people wonder why even in the future nothing works.
- deleted 5y ago[deleted]
- devwastaken 5y agoThis is why you leak anonymously and let the wolves take care of it as nature intended.
- sneak 5y agoIt's not a leak to publish your own original research.
- dikaio 5y agoIssue is, he will be stored in logs traversing through accounts not his.
- tjpnz 5y agoIf you're going spelunking you'll take precautions to mitigate the risk of it being traced back to you.
- Aachen 5y agoYeah but that wasn't the situation. Twas a bit late for that by the point OP discovered there existed a security issue in the first place and they had even already "exploited" it.
- dqv 5y agoI think a lot of hackers start with just seeing what’s going on without any intent to dig deeper. But then something too good to pass up gets them high, and with weakened inhibitions, they make bad decisions that require responsible disclosure (in lieu of saying and doing nothing and possibly getting into more trouble). Of course a responsible disclosure is always prudent, and these companies certainly did not deserve one, but the hacker here got too excited. They didn’t cover their tracks first, necessitating a responsible disclosure.
- hnthrowaway0315 5y agoI'm not sure an unprepared one can leak anonymously and safely.
- dtx1 5y agojust post your findings from an internet cafe on 4chan and watch the competitor burn
- MikeTheGreat 5y agoSerious question: are internet cafes still a thing? Admittedly this is from a small sample of Seattle-area coffee shops but most of my experiences with non-home non-work WiFi is at coffee shops that provide the WiFi but expect you to bring your own device (laptop, phone, etc). Is it still common to go someplace and rent time on a computer provided by the owner (i.e., at an internet cafe?)
- joe_the_user 5y agoI don't think places you can rent machines are common (except libraries as noted but these may require ID) but the steps "buy machine with cash, take machine to anonymous cafe outside your area and get wifi password, upload info" still seem reasonably secure. You can throw the machine off a bridge later if you're paranoid - and work hard at sanitizing your info while you're at it.
- AlexCoventry 5y agoCan you just spoof your MAC address instead of buying a new machine?
- kyleee 5y agopossibly but will you bet jail time on it?
- dtx1 5y ago
- mike00632 5y ago... or report the vulnerability anonymously?
- pabs3 5y ago... or report it anonymously to a higher authority like the CERT for your location.
- Aachen 5y agoYour IP is still in the access logs. The advice is good and we do this sometimes when not wanting to spend work time to deal with corporate politics around the reporting (though frankly the back-and-forth with the CERT is often a game of its own), but it wouldn't have helped in this case.
- pabs3 5y agoThis is why it is a good idea to use Tor or a VPN for most things or even just for when you casually go reverse engineering a competitor's product :)
- Aachen 5y agoAs I wrote in a comment elsewhere in the thread, I'm not sure if that is really the best idea. > Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity... But yeah it all depends on the circumstances. Given how these companies are handling it, it couldn't have gone much worse I suppose. On the other hand, if the company suspects it was a black hat then you have to be very sure you can hide all tracks completely and, if found out, you have a lot more to explain.
- ironmagma 5y ago> There is absolutely no way this wasn't going to end in a lawsuit. That’s what you call an inaccurate cynical view.
- Aachen 5y agoNot sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly. Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...
- ghostly_s 5y agoDoing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.
- Aachen 5y agoI guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.
- 77pt77 5y ago> and my employer would not fire me over such hearsay accusations from a competitor So you think but you might be very wrong.
- wyldfire 5y agoFrom what little I know of the world, this kind of litigiousness is more peculiar to the US than the rest of the world (or maybe at least the ones who usually speak English?).
- GauntletWizard 5y agoYes, in the EU he would simply be serving time, with little to no lawyer involvement from the companies - the government would have taken care of the whole thing.
- theelous3 5y agoThis is beyond delusional. Absolutely no evidence or case studies to support this.
- Aachen 5y agoThe Dutch public prosecution doesn't prosecute when responsible disclosure guidelines were followed. For the computer fraud part obviously; card fraud would be investigated (and there's no helping that this person will be a suspect, but without evidence or motive that should not be a big deal). That's not "this person would simply be serving time". Quite the opposite. Can't speak for other European countries, I'm not familiar with their practices, but I haven't heard in recent years that anyone got prosecuted for responsible disclosure. A few months back a company started a civil case: that was unusual enough that it made the news (and it was dropped). About a year or so ago, someone was convinced while claiming to be white hat, but they emailed the company something like "pay me and I'll tell you what the problem is. Wouldn't want reputation damage now would we?" Again, unusual enough that it makes the news, and in neither case was a legit white hat "serving time".
- 77pt77 5y agoIt's not. Germany is way worse.
- TillE 5y agoYeah seriously, people talk about the UK's defamation law being bad, but in Germany you can get in trouble simply for insulting someone or making a rude gesture (Beleidigung).
- throwawaysleep 5y agoI feel that in so many cases as a developer, the best thing for me to do is to let things fail. Scrum incentivizes waiting for bug reports from production. Low tenures for employment mean there is no reason to care much about maintainability or security. The pay difference between excellence and mediocrity is 2%. What a world we live in.
- actionfromafar 5y agoWhich one gets 2% more?
- throwawaysleep 5y agoIn theory the excellent one. In practice, the one that negotiates better.
- brailsafe 5y agoI wouldn't even restrict this to security matters; don't stick your neck out for your employer at all for any reason, unless the risk has already been taken or you're a shareholder. The nature of capitalism and employment is one of control and risk management. Unless you're guaranteed to be rewarded (very well), don't do anything beyond your basic responsibilities. More than that costs extra. You either have control, or you don't, and as a normal employee, you don't. This is how I learnt not to care about doing very high-quality work, because it costs me disproportionally more than it costs my employer, and it usually doesn't matter if they're big enough.
- deleted 5y ago[deleted]