4 ms·

> There is absolutely no way this wasn't going to end in a lawsuit. That’s what you call an inaccurate cynical view.

Aachen 5y ago
Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly. Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...
- ghostly_s 5y ago
  Doing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.
  - Aachen 5y ago
    I guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.
- 77pt77 5y ago
  > and my employer would not fire me over such hearsay accusations from a competitor So you think but you might be very wrong.
  - Aachen 5y ago
    I might be, I suppose. Without going into details since this account is trivially traceable to my name, this wouldn't be the first thing the Internet tells me to never pull on my employer that went swimmingly. I do have some faith in my boss; it's a small company and security is a small world, and rich enough to not need backstabbing and politics a lot, thankfully. And I've got access to sensitive customer information on a daily basis (unpatched vulnerabilities), some trust is required in this field. If that wasn't there, I'd never have been put on projects or at least not lasted for very long. Also note that I'm not in the USA and it's not this 2 weeks' notice wild west style employment (from my point of view).
- DaiPlusPlus 5y ago
  > Using anonymisation proxies just makes it all the more suspicious If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer or anything of the sort, it's just the macOS equivalent of Fiddler: a localhost HTTP/HTTPS proxy that lets you decrypt TLS traffic (provided the client software isn't using certificate-pinning, which it wasn't). From TFA: > Wondering how I could feed them to the app, I set up Charles Proxy and pointed my phone to it. I honestly thought this wouldn’t work – who at this time doesn’t have SSL Pinning? https://www.charlesproxy.com/ https://www.charlesproxy.com/ https://www.telerik.com/fiddler https://www.telerik.com/fiddler As a curious user of other applications I've done the same thing the the author has described, so this kinda stuff isn't uncommon - except in my case I've never had an opportunity to stumble across anything as bad the author. As for phone-app' insecure back-end web-services: that's about par for the course thesedays, even for banking and other "secure" services. It's depressing. I have plenty of my own pet-theories as to why things seem worse today than they were 10 years ago, but that's another discussion.
  - Aachen 5y ago
    > If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.
- throwawaysleep 5y ago
  You have a lot of trust in your employer.
  - Aachen 5y ago
    One of the reasons that I like working there.
- aahortwwy 5y ago
  > I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.
  - Aachen 5y ago
    I've familiarized myself with the relevant computervredebreuk legalese and read that our public prosecutor doesn't prosecute cases where all the responsible disclosure guidelines were followed. (Of course they'll still check that they were, since not every claimed white hat is truly a white hat.)
    - aahortwwy 5y ago
      Other jurisdictions are not so sensible.
    - erosenbe0 5y ago
      These cases of just crossing the threshold are not that interesting to prosecutors unless affecting some company with a lot of political capital. If there is no restitution, no safety implications, no children harmed, and the case is a bit confusing, why take it? Prosecutors prefer to take the slam dunk cases where any normal person can agree it was an intrusive or fraudulent access.

Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly. Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...

ghostly_s 5y ago
Doing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.
- Aachen 5y ago
  I guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.
77pt77 5y ago
> and my employer would not fire me over such hearsay accusations from a competitor So you think but you might be very wrong.
- Aachen 5y ago
  I might be, I suppose. Without going into details since this account is trivially traceable to my name, this wouldn't be the first thing the Internet tells me to never pull on my employer that went swimmingly. I do have some faith in my boss; it's a small company and security is a small world, and rich enough to not need backstabbing and politics a lot, thankfully. And I've got access to sensitive customer information on a daily basis (unpatched vulnerabilities), some trust is required in this field. If that wasn't there, I'd never have been put on projects or at least not lasted for very long. Also note that I'm not in the USA and it's not this 2 weeks' notice wild west style employment (from my point of view).
DaiPlusPlus 5y ago
> Using anonymisation proxies just makes it all the more suspicious If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer or anything of the sort, it's just the macOS equivalent of Fiddler: a localhost HTTP/HTTPS proxy that lets you decrypt TLS traffic (provided the client software isn't using certificate-pinning, which it wasn't). From TFA: > Wondering how I could feed them to the app, I set up Charles Proxy and pointed my phone to it. I honestly thought this wouldn’t work – who at this time doesn’t have SSL Pinning? https://www.charlesproxy.com/ https://www.charlesproxy.com/ https://www.telerik.com/fiddler https://www.telerik.com/fiddler As a curious user of other applications I've done the same thing the the author has described, so this kinda stuff isn't uncommon - except in my case I've never had an opportunity to stumble across anything as bad the author. As for phone-app' insecure back-end web-services: that's about par for the course thesedays, even for banking and other "secure" services. It's depressing. I have plenty of my own pet-theories as to why things seem worse today than they were 10 years ago, but that's another discussion.
- Aachen 5y ago
  > If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.
throwawaysleep 5y ago
You have a lot of trust in your employer.
- Aachen 5y ago
  One of the reasons that I like working there.
aahortwwy 5y ago
> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.
- Aachen 5y ago
  I've familiarized myself with the relevant computervredebreuk legalese and read that our public prosecutor doesn't prosecute cases where all the responsible disclosure guidelines were followed. (Of course they'll still check that they were, since not every claimed white hat is truly a white hat.)
  - aahortwwy 5y ago
    Other jurisdictions are not so sensible.
  - erosenbe0 5y ago
    These cases of just crossing the threshold are not that interesting to prosecutors unless affecting some company with a lot of political capital. If there is no restitution, no safety implications, no children harmed, and the case is a bit confusing, why take it? Prosecutors prefer to take the slam dunk cases where any normal person can agree it was an intrusive or fraudulent access.