3 ms·

> it's not unreasonable behavior from all involved. Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP lo

by Aachen 5y ago

> it's not unreasonable behavior from all involved. Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP logs to be turned over or so, but CorpCo knows this person, knows they disclosed what they saw from the start. It sounds pretty unreasonable to fire someone over hearsay, especially when it's unlikely to be true (what dumbass does card fraud and tells their employer—a bank—and requests they disclose it to OtherCo?). And even from OtherCo, they're acting like it's the 70s and they've never heard of responsible disclosure. I understand their logic a bit more for the aforementioned reason, but still, reasonable is not the first word that came to mind.

tcook_sucks_xie 5y ago
Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further it's not proof of guilt but a reasonable trail to follow up on
- deleted 5y ago
  [deleted]
- Aachen 5y ago
  Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.
  - zozbot234 5y ago
    OP's employer would likely want to avoid looking complicit in hacking a direct competitor to their line of business. What they did does not look overly unreasonable from that POV, the problem is OP put them in a pretty bad position. It's not just about being factually right either, appearances can matter too.
    - Brian_K_White 5y ago
      OP, absolutely, did not, put their employer into any kind of situation. Thanks for F-ing helping.
- deleted 5y ago
  [deleted]
- rhizome 5y ago
  I think it is a stretch. What basis would someone use, who knew enough to disclose immediately, to bet their freedom that it was being exploited by others such that they could exploit it without their initial disclosure providing probable cause that he was the exploiter? I can't even think of a movie where that happens, probably because it's impossible to create a suspension of disbelief with the plotline.
  - judge2020 5y ago
    On one hand, someone working infosec might also have access to a spare computer running tails, which they use to sell the exploit to a third party exploit customer, but only after reporting the exploit to the victim company to cover their tracks regarding liability for things like those IP logs. On the other hand, it's not uncommon for a vulnerability to be detected multiple times by different unrelated people, especially if that vulnerability makes itself know via semi-regular use of the product/service.
  - treis 5y ago
    Aren't you just proving their point?
  - tluyben2 5y ago
    > think of a movie where that happens, probably because it's impossible Always reminds me of a CSI (original series) interview with the actor who played Grissom; the writers contacted the police and forensics labs for story ideas but the real life events were so insane that they would feel too fabricated for television. People are generally greedy and often dumb; maybe they found an open house door, put a little note in the mailbox, slept on it and thought maybe they could get away with a further peek inside if no one closed the door yet (which makes the perpetrator think they didn’t read the note yet)?
3np 5y ago
I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.
- jonathankoren 5y ago
  It's not unreasonable. It may be stupid, but criminals do stupid things all the time. Someone has to be first. Turning the investigation over to the authorities to investigate is also reasonable. What's disappointing is that his company didn't stand by him during the investigation, especially since he reported it.
  - Brian_K_White 5y ago
    To me that is actually grounds for OP to sue the employer for slander/libel/unjustified termination etc. OP did their part and the employer didn't.
    - tptacek 5y ago
      Do you have a legal background? I don't; what I know about defamation law I mostly get from religiously following Ken White. This doesn't sound like an especially plausible case of defamation. If it helps: absent a contract saying otherwise (pretty rare) employers in the US can generally fire you because they don't like your new haircut.
      - borski 5y ago
        (With the exception of firing you for protected reasons/classes, like race, gender, sexuality, etc.)
      - wglb 5y ago
        This just in: https://www.jdsupra.com/legalnews/hair-discrimination-the-new-protected-3026010/ https://www.jdsupra.com/legalnews/hair-discrimination-the-ne...
- ipaddr 5y ago
jollybean 5y ago
If the retention of the employee is seen as a liability, then that's it, he's out. Very unfair from employees perspective, but 'self interest rational' from the Corp. If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go. Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't. It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.

by Aachen 5y ago

tcook_sucks_xie 5y ago

Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further it's not proof of guilt but a reasonable trail to follow up on

deleted 5y ago
[deleted]
Aachen 5y ago
Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.
- zozbot234 5y ago
  OP's employer would likely want to avoid looking complicit in hacking a direct competitor to their line of business. What they did does not look overly unreasonable from that POV, the problem is OP put them in a pretty bad position. It's not just about being factually right either, appearances can matter too.
  - Brian_K_White 5y ago
    OP, absolutely, did not, put their employer into any kind of situation. Thanks for F-ing helping.
deleted 5y ago
[deleted]
rhizome 5y ago
I think it is a stretch. What basis would someone use, who knew enough to disclose immediately, to bet their freedom that it was being exploited by others such that they could exploit it without their initial disclosure providing probable cause that he was the exploiter? I can't even think of a movie where that happens, probably because it's impossible to create a suspension of disbelief with the plotline.
- judge2020 5y ago
  On one hand, someone working infosec might also have access to a spare computer running tails, which they use to sell the exploit to a third party exploit customer, but only after reporting the exploit to the victim company to cover their tracks regarding liability for things like those IP logs. On the other hand, it's not uncommon for a vulnerability to be detected multiple times by different unrelated people, especially if that vulnerability makes itself know via semi-regular use of the product/service.
- treis 5y ago
  Aren't you just proving their point?
- tluyben2 5y ago
  > think of a movie where that happens, probably because it's impossible Always reminds me of a CSI (original series) interview with the actor who played Grissom; the writers contacted the police and forensics labs for story ideas but the real life events were so insane that they would feel too fabricated for television. People are generally greedy and often dumb; maybe they found an open house door, put a little note in the mailbox, slept on it and thought maybe they could get away with a further peek inside if no one closed the door yet (which makes the perpetrator think they didn’t read the note yet)?

3np 5y ago

I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.

jonathankoren 5y ago
It's not unreasonable. It may be stupid, but criminals do stupid things all the time. Someone has to be first. Turning the investigation over to the authorities to investigate is also reasonable. What's disappointing is that his company didn't stand by him during the investigation, especially since he reported it.
- Brian_K_White 5y ago
  To me that is actually grounds for OP to sue the employer for slander/libel/unjustified termination etc. OP did their part and the employer didn't.
  - tptacek 5y ago
    Do you have a legal background? I don't; what I know about defamation law I mostly get from religiously following Ken White. This doesn't sound like an especially plausible case of defamation. If it helps: absent a contract saying otherwise (pretty rare) employers in the US can generally fire you because they don't like your new haircut.
    - borski 5y ago
      (With the exception of firing you for protected reasons/classes, like race, gender, sexuality, etc.)
    - wglb 5y ago
      This just in: https://www.jdsupra.com/legalnews/hair-discrimination-the-new-protected-3026010/ https://www.jdsupra.com/legalnews/hair-discrimination-the-ne...
ipaddr 5y ago

jollybean 5y ago

If the retention of the employee is seen as a liability, then that's it, he's out. Very unfair from employees perspective, but 'self interest rational' from the Corp. If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go. Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't. It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.