2 ms·
Directly informing the effected bank and then informing your then employer would've been a better solution? I think it has the highest chance for least negative
by Gentil 5y ago
Directly informing the effected bank and then informing your then employer would've been a better solution? I think it has the highest chance for least negative repercussions. I assume it would still go a bit wild, but have the least negative impact. Obviously I could be wrong.
You need to keep in mind that security disclosures and everything around (legal, why disclose? etc) it is a black box for most folks.
Also OP said after reporting it, "months later" OP was fired. This means anyone in those months anyone could've found what the OP found and abused it. And the effected bank might've not been involved until later? And all those crimes are now on your shoulders. Your then bank employee would get delayed through the politics in your company (even with good intentions). It will happen even for their own security disclosure handling. Let alone for competitors cos so much legal stuff are involved now.
From the effected bank's POV, you are just a bank employee who did some fraud. Mainly cos you didn't inform the effected bank and it's been months. Insider hacks from the same industry is not unheard of.
Like I said, this would've been a different scenario if you informed them ASAP. And I am sure when issues hit the roof your employer would wash their hands off. It is the easiest thing to do. Unless you are very well connected in the office. Otherwise even your employee are not sure about you. They will be asking questions like, why is this person doing this anyways? He is not in security so why was the OP poking around it? etc etc.
Hope this gets sorted out. Interesting case indeed.
- netheril96 5y ago> Directly informing the effected bank and then informing your then employer would've been a better solution? We've seen many cases where if you report a security vulnerability to a company, they blame you as a hacker instead of thanking you.
- Gentil 5y ago> I assume it would still go a bit wild, but have the least negative impact. Which is why I added this. It will not be a smooth experience. But the OP will still be in a better position than the current one IMO. You tell me who looks MORE suspicious. - A guy who found a vulnerability and reported very soon and hence the effected bank know about it soon. Or - Or when the effected bank finds out after A COUPLE OF MONTHS (even a few weeks after) that their competitors employee found a vulnerability and they still haven't heard about it? Keep in mind the added issue of the employee being from a competitor and that they might have already seen abuse of the vulnerability which might not be done by the OP. But since it is delayed, all of it is in the OP's shoulders.
- dredmorbius 5y agoSee tptacek's suggested resource from this thread: https://news.ycombinator.com/item?id=30707216 https://news.ycombinator.com/item?id=30707216 Resource: https://clinic.cyber.harvard.edu/files/2020/10/Security_Researchers_Guide-2.pdf https://clinic.cyber.harvard.edu/files/2020/10/Security_Rese... (PDF) HN submission: https://news.ycombinator.com/item?id=30710885 https://news.ycombinator.com/item?id=30710885