10 ms·

So, it sounds like, this guy worked for CorpCo, found a security issue with OtherCo's app, and explored their APIs (maybe from CorpCo's network?), including acc

by avalys 5y ago

So, it sounds like, this guy worked for CorpCo, found a security issue with OtherCo's app, and explored their APIs (maybe from CorpCo's network?), including accessing at least one CC number that was not his. Someone else later discovered the same issue with OtherCo and stole a bunch more card numbers, and used them to commit fraud. OtherCo looked through their logs, saw the initial exploration coming from this guy at CorpCo, assumed he was also responsible for the subsequent fraud, and contacted CorpCo which ultimately fired him. The fraud was substantial enough for OtherCo to convince authorities to pursue criminal charges. It's a sad story - but it's not unreasonable behavior from all involved.

gameswithgo 5y ago
Aachen 5y ago
> it's not unreasonable behavior from all involved. Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP logs to be turned over or so, but CorpCo knows this person, knows they disclosed what they saw from the start. It sounds pretty unreasonable to fire someone over hearsay, especially when it's unlikely to be true (what dumbass does card fraud and tells their employer—a bank—and requests they disclose it to OtherCo?). And even from OtherCo, they're acting like it's the 70s and they've never heard of responsible disclosure. I understand their logic a bit more for the aforementioned reason, but still, reasonable is not the first word that came to mind.
- tcook_sucks_xie 5y ago
  Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further it's not proof of guilt but a reasonable trail to follow up on
  - deleted 5y ago
    [deleted]
  - Aachen 5y ago
    Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.
    - zozbot234 5y ago
      OP's employer would likely want to avoid looking complicit in hacking a direct competitor to their line of business. What they did does not look overly unreasonable from that POV, the problem is OP put them in a pretty bad position. It's not just about being factually right either, appearances can matter too.
      - Brian_K_White 5y ago
        OP, absolutely, did not, put their employer into any kind of situation. Thanks for F-ing helping.
  - deleted 5y ago
    [deleted]
  - rhizome 5y ago
    I think it is a stretch. What basis would someone use, who knew enough to disclose immediately, to bet their freedom that it was being exploited by others such that they could exploit it without their initial disclosure providing probable cause that he was the exploiter? I can't even think of a movie where that happens, probably because it's impossible to create a suspension of disbelief with the plotline.
    - judge2020 5y ago
      On one hand, someone working infosec might also have access to a spare computer running tails, which they use to sell the exploit to a third party exploit customer, but only after reporting the exploit to the victim company to cover their tracks regarding liability for things like those IP logs. On the other hand, it's not uncommon for a vulnerability to be detected multiple times by different unrelated people, especially if that vulnerability makes itself know via semi-regular use of the product/service.
- 3np 5y ago
  I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.
  - jonathankoren 5y ago
    It's not unreasonable. It may be stupid, but criminals do stupid things all the time. Someone has to be first. Turning the investigation over to the authorities to investigate is also reasonable. What's disappointing is that his company didn't stand by him during the investigation, especially since he reported it.
    - Brian_K_White 5y ago
      To me that is actually grounds for OP to sue the employer for slander/libel/unjustified termination etc. OP did their part and the employer didn't.
      - tptacek 5y ago
        Do you have a legal background? I don't; what I know about defamation law I mostly get from religiously following Ken White. This doesn't sound like an especially plausible case of defamation. If it helps: absent a contract saying otherwise (pretty rare) employers in the US can generally fire you because they don't like your new haircut.
        borski 5y ago
        (With the exception of firing you for protected reasons/classes, like race, gender, sexuality, etc.)
        wglb 5y ago
        This just in: https://www.jdsupra.com/legalnews/hair-discrimination-the-new-protected-3026010/ https://www.jdsupra.com/legalnews/hair-discrimination-the-ne...
  - ipaddr 5y ago
- jollybean 5y ago
  If the retention of the employee is seen as a liability, then that's it, he's out. Very unfair from employees perspective, but 'self interest rational' from the Corp. If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go. Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't. It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.
650REDHAIR 5y ago
Yeah, next time report it to the feds/state. Get protected status as a whistleblower.
- sneak 5y ago
  No, do not talk to the police. Anything they need to hear before charging you can be published publicly on the web. Anything they need to hear after charging you will be communicated to them in writing by your defense attorney.
- jahewson 5y ago
  I don’t see how it’d count as a whistleblower if it concerns a company that has no relation to your employer.
- tptacek 5y ago
  There is no protected whistleblower status available for finding web bugs.
  - rocqua 5y ago
    If you can pitch it as securities fraud, you might have a very small chance with the SEC. There is a new law protecting whistle blowers for the SEC, and it's seeing people apply to it for wide ranges of reasons. This seems related to the idea "everything bad a public company does is securities fraud".
    - tptacek 5y ago
      It's fun to noodle about! But so far as I know, nothing like this has ever happened: nobody has gotten whistleblower protection from 18 USC 1030 charges, and there is no obvious legal pathway to get it from any agency of the federal government. Sell your bug to a carding ring, then go to the FBI and ask for immunity in exchange for helping them bring down the ring; that's the closest I can think of.
paxys 5y ago
You missed the part where he immediately reported the vulnerability to his manager, security team and execs and got the assurance that it was being handled. If after that he is still thrown under the bus and fired, it's clear that someone at his own company dropped the ball and put the blame on him. I wouldn't be surprised if the actual fraud was committed by one of these people as well, using the very hack that he found and disclosed.
- jahewson 5y ago
  Agreed that anyone who knew about the flaw should be as suspect as the employee in question. But what was this guy doing pentesting a competitor instead of performing his job duties - that’s grounds for being fired right there. Even with an “ok” outcome he’d have arguably caused harm to his employer.
  - Brian_K_White 5y ago
    I know right? I bet he even went to the bathroom and even slept at night. Imagine!
    - MathCodeLove 5y ago
      Because that's definitely the same thing.
      - Brian_K_White 5y ago
        tptacek 5y ago
        Could you both maybe stop? We get it, you contemptuously disagree with each other.
  - paxys 5y ago
    Maybe, but if his company really had a problem with it he would have been fired or at least repremanded when he initially brought up the problem, not months later.
mmaunder 5y ago
Also could land them substantial prison time under CFAA Re accessing a computer system beyond what was authorized. The above link seems to redirect to a default site now. I’m guessing they yanked the post. Back before crime it was ok to explore all over town and on private property. When the kidnappings and burglaries started, all that changed. And I’m so very sorry about this because the old days were truly magical.
- tptacek 5y ago
  If they didn't do anything with the information, as seems likely (why assume otherwise, people? we're not detectives!) then no, it's unlikely to result in substantial prison time. The thing to watch out for in these benign cases is doing things that trigger substantial forensic investigations, which easily run into 6 figures. If you don't cause that kind of damage, and you don't in any way attempt to profit from the activity, then there isn't actually much in CFAA that will drive sentences up. (I'm not a lawyer, but for obvious career reasons I nerd way the hell out on CFAA stuff).
  - Thorrez 5y ago
    Am I recalling right that much of weev's $73,000 in damages was the cost of AT&T sending physical letters to everyone saying their email addresses were leaked? Yeah, this supports that: https://gizmodo.com/exclusive-at-t-hackers-last-bid-to-stay-out-of-prison-5990462 https://gizmodo.com/exclusive-at-t-hackers-last-bid-to-stay-...
ufmace 5y ago
It's also not completely crazy to wonder if this guy discovered the flaw like this, reported it in a way he knew would never actually get to OtherCo, then exploited it himself through a more anonymous channel for real. Then wrote it up like this and made himself sound super-extra-innocent when he found it.
- vaxman 5y ago
  Agreed. This is the most likely scenario. His blog post is literary trash and full of unconvincing self-rationalizations of his every move prior to being caught, while also digging a hole for himself by articulating what kind of industry-insider knowledge was required to exploit that vulnerability. There is, however, a small chance that he is telling the truth, but it’s not enough to get him off the hook in a civil case (at least in the US) because the standard of proof is much lower. Dude’s handle on Twitter is “AccidHacker” and he may claim that’s short for “Accidental Hacker”, but that’s also not believable, from a literal/legal perspective anyway —more likely something an actual hacker would post lamenting how they wound up in such a life.

by avalys 5y ago

gameswithgo 5y ago

Aachen 5y ago

> it's not unreasonable behavior from all involved. Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP logs to be turned over or so, but CorpCo knows this person, knows they disclosed what they saw from the start. It sounds pretty unreasonable to fire someone over hearsay, especially when it's unlikely to be true (what dumbass does card fraud and tells their employer—a bank—and requests they disclose it to OtherCo?). And even from OtherCo, they're acting like it's the 70s and they've never heard of responsible disclosure. I understand their logic a bit more for the aforementioned reason, but still, reasonable is not the first word that came to mind.

tcook_sucks_xie 5y ago
Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further it's not proof of guilt but a reasonable trail to follow up on
- deleted 5y ago
  [deleted]
- Aachen 5y ago
  Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.
  - zozbot234 5y ago
    OP's employer would likely want to avoid looking complicit in hacking a direct competitor to their line of business. What they did does not look overly unreasonable from that POV, the problem is OP put them in a pretty bad position. It's not just about being factually right either, appearances can matter too.
    - Brian_K_White 5y ago
      OP, absolutely, did not, put their employer into any kind of situation. Thanks for F-ing helping.
- deleted 5y ago
  [deleted]
- rhizome 5y ago
  I think it is a stretch. What basis would someone use, who knew enough to disclose immediately, to bet their freedom that it was being exploited by others such that they could exploit it without their initial disclosure providing probable cause that he was the exploiter? I can't even think of a movie where that happens, probably because it's impossible to create a suspension of disbelief with the plotline.
  - judge2020 5y ago
    On one hand, someone working infosec might also have access to a spare computer running tails, which they use to sell the exploit to a third party exploit customer, but only after reporting the exploit to the victim company to cover their tracks regarding liability for things like those IP logs. On the other hand, it's not uncommon for a vulnerability to be detected multiple times by different unrelated people, especially if that vulnerability makes itself know via semi-regular use of the product/service.
3np 5y ago
I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.
- jonathankoren 5y ago
  It's not unreasonable. It may be stupid, but criminals do stupid things all the time. Someone has to be first. Turning the investigation over to the authorities to investigate is also reasonable. What's disappointing is that his company didn't stand by him during the investigation, especially since he reported it.
  - Brian_K_White 5y ago
    To me that is actually grounds for OP to sue the employer for slander/libel/unjustified termination etc. OP did their part and the employer didn't.
    - tptacek 5y ago
      Do you have a legal background? I don't; what I know about defamation law I mostly get from religiously following Ken White. This doesn't sound like an especially plausible case of defamation. If it helps: absent a contract saying otherwise (pretty rare) employers in the US can generally fire you because they don't like your new haircut.
      - borski 5y ago
        (With the exception of firing you for protected reasons/classes, like race, gender, sexuality, etc.)
      - wglb 5y ago
        This just in: https://www.jdsupra.com/legalnews/hair-discrimination-the-new-protected-3026010/ https://www.jdsupra.com/legalnews/hair-discrimination-the-ne...
- ipaddr 5y ago
jollybean 5y ago
If the retention of the employee is seen as a liability, then that's it, he's out. Very unfair from employees perspective, but 'self interest rational' from the Corp. If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go. Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't. It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.

650REDHAIR 5y ago

Yeah, next time report it to the feds/state. Get protected status as a whistleblower.

sneak 5y ago
No, do not talk to the police. Anything they need to hear before charging you can be published publicly on the web. Anything they need to hear after charging you will be communicated to them in writing by your defense attorney.
jahewson 5y ago
I don’t see how it’d count as a whistleblower if it concerns a company that has no relation to your employer.
tptacek 5y ago
There is no protected whistleblower status available for finding web bugs.
- rocqua 5y ago
  If you can pitch it as securities fraud, you might have a very small chance with the SEC. There is a new law protecting whistle blowers for the SEC, and it's seeing people apply to it for wide ranges of reasons. This seems related to the idea "everything bad a public company does is securities fraud".
  - tptacek 5y ago
    It's fun to noodle about! But so far as I know, nothing like this has ever happened: nobody has gotten whistleblower protection from 18 USC 1030 charges, and there is no obvious legal pathway to get it from any agency of the federal government. Sell your bug to a carding ring, then go to the FBI and ask for immunity in exchange for helping them bring down the ring; that's the closest I can think of.

paxys 5y ago

You missed the part where he immediately reported the vulnerability to his manager, security team and execs and got the assurance that it was being handled. If after that he is still thrown under the bus and fired, it's clear that someone at his own company dropped the ball and put the blame on him. I wouldn't be surprised if the actual fraud was committed by one of these people as well, using the very hack that he found and disclosed.

jahewson 5y ago
Agreed that anyone who knew about the flaw should be as suspect as the employee in question. But what was this guy doing pentesting a competitor instead of performing his job duties - that’s grounds for being fired right there. Even with an “ok” outcome he’d have arguably caused harm to his employer.
- Brian_K_White 5y ago
  I know right? I bet he even went to the bathroom and even slept at night. Imagine!
  - MathCodeLove 5y ago
    Because that's definitely the same thing.
    - Brian_K_White 5y ago
      - tptacek 5y ago
        Could you both maybe stop? We get it, you contemptuously disagree with each other.
- paxys 5y ago
  Maybe, but if his company really had a problem with it he would have been fired or at least repremanded when he initially brought up the problem, not months later.

mmaunder 5y ago

Also could land them substantial prison time under CFAA Re accessing a computer system beyond what was authorized. The above link seems to redirect to a default site now. I’m guessing they yanked the post. Back before crime it was ok to explore all over town and on private property. When the kidnappings and burglaries started, all that changed. And I’m so very sorry about this because the old days were truly magical.

tptacek 5y ago
If they didn't do anything with the information, as seems likely (why assume otherwise, people? we're not detectives!) then no, it's unlikely to result in substantial prison time. The thing to watch out for in these benign cases is doing things that trigger substantial forensic investigations, which easily run into 6 figures. If you don't cause that kind of damage, and you don't in any way attempt to profit from the activity, then there isn't actually much in CFAA that will drive sentences up. (I'm not a lawyer, but for obvious career reasons I nerd way the hell out on CFAA stuff).
- Thorrez 5y ago
  Am I recalling right that much of weev's $73,000 in damages was the cost of AT&T sending physical letters to everyone saying their email addresses were leaked? Yeah, this supports that: https://gizmodo.com/exclusive-at-t-hackers-last-bid-to-stay-out-of-prison-5990462 https://gizmodo.com/exclusive-at-t-hackers-last-bid-to-stay-...

ufmace 5y ago

It's also not completely crazy to wonder if this guy discovered the flaw like this, reported it in a way he knew would never actually get to OtherCo, then exploited it himself through a more anonymous channel for real. Then wrote it up like this and made himself sound super-extra-innocent when he found it.

vaxman 5y ago
Agreed. This is the most likely scenario. His blog post is literary trash and full of unconvincing self-rationalizations of his every move prior to being caught, while also digging a hole for himself by articulating what kind of industry-insider knowledge was required to exploit that vulnerability. There is, however, a small chance that he is telling the truth, but it’s not enough to get him off the hook in a civil case (at least in the US) because the standard of proof is much lower. Dude’s handle on Twitter is “AccidHacker” and he may claim that’s short for “Accidental Hacker”, but that’s also not believable, from a literal/legal perspective anyway —more likely something an actual hacker would post lamenting how they wound up in such a life.