5 ms·

I keep getting emails from India-based "ethical hackers" who ran a vulnerability assessment against some web property and sent me the results. Then they ask fo

I keep getting emails from India-based "ethical hackers" who ran a vulnerability assessment against some web property and sent me the results. Then they ask for payment. I keep reporting them to Google (Gmail IDs) but they keep landing in my inbox.

Schnitz 3y ago
Yup, HackerOne has more or less created a cottage industry of "hackers" that file HackerOne bug reports using semi-automated tools like Burp Suite etc. to get bounties.
userbinator 3y ago
Then they ask for payment. Isn't that extortion? I wonder if India has laws that you can point to to make them go away.
- bawolff 3y ago
  I think it has to have an "or else" to be extortion. If its just, consider giving us a gift if you found this report useful, that doesn't sound like extortion (still obnoxious though)
  - throwaway313313 3y ago
    They typically do not want to disclose the full vulnerability details prior to you paying them. For the few that we have engaged in back and forth conversation, they typically were just reporting warnings from various opensource website scanners, without completely understanding what they were talking about. That's not to say somebody might discover a new unique vulnerability in the open source software and packages you might be using, except you wouldn't expect them to report it to your company, as some random user on the Internet, when the official projects are on github. Alternatively if they reported a very specific issue regarding software you developed, I'm sure it would get your 100% attention. That's not been my experience so far (knock on wood).
    - bawolff 3y ago
      Yeah if they are refusing to share details without money that sounds more like extortion. > That's not to say somebody might discover a new unique vulnerability in the open source software and packages you might be using, except you wouldn't expect them to report it to your company, as some random user on the Internet, when the official projects are on github. I've actually had this happen once or twice. AFAICT the situation was either that the reporter explains themselves so poorly (in very broken english) that the original project ignored them, or they are trying to maximize bounties by reporting to everyobe who uses the package instead of the actual maintainer. > Alternatively if they reported a very specific issue regarding software you developed, I'm sure it would get your 100% attention. That's not been my experience so far (knock on wood). It does happen (especially if you offer bounties or you are famous), but its like 1% of emails you get at most. Most reports are just incoherent non sense or people misunderstanding the output of an autonated scanner. But its worth it to pay attention for the 1%.
  - technion 3y ago
    It's always worded as though you have some trivially exploited RCE, unless you pay them, someone will exploit it. To be fair I'm not suggesting they imply that they will exploit it, but it's always overblown in a way that implies without paying to see their nonsense report your business will suffer a loss.
- smsm42 3y ago
  It's more like panhandling. They don't have anything to threaten with, the most they have is some minor complaint on a test scan, like Apache version being reported by some server, so they just try to score some money for nothing.
bawolff 3y ago
I mean, im not sure what you expect google to do. Its not illegal to send bad security report emails, and i wouldn't exactly call it spam in the traditional sense. They are annoying though. I'm pretty sure 90% of the value proposition of hackerone is dealing with these people.
- arp242 3y ago
  I've reviewed hundreds of security reports over the last ten years. I have yet to see a legitimate one. This is good (no security bugs!) but also a massive waste of time, because I do need to review them because what if there is an actual serious report? Is it "spam" in the sense of Nigerian princes and penis enlargements? No. Is it "spam" in the sense that it's the same useless crap being repeated ad nauseam? Absolutely.
SkyPuncher 3y ago
We, like many companies, run a responsible disclosure program. We get reports like this all of the time. There’s a lot of noise to wade through, but we occasionally get good, valid reports. We pay those a reward and fix the issues. Our understanding is many of these reports come from people who landing a single bounty is equivalent to a month of income.
davidgerard 3y ago
we get these all the time and they've always been shit
smsm42 3y ago
It's not unique to India, they are everywhere. The best thing is just ignore them, usually once they are sure there's no money to be made here, they move on quickly.
extraduder_ire 3y ago
I don't think he coined the term, but Troy Hunt calls them "beg bounties". https://www.troyhunt.com/beg-bounties/ https://www.troyhunt.com/beg-bounties/

Schnitz 3y ago

Yup, HackerOne has more or less created a cottage industry of "hackers" that file HackerOne bug reports using semi-automated tools like Burp Suite etc. to get bounties.

userbinator 3y ago

Then they ask for payment. Isn't that extortion? I wonder if India has laws that you can point to to make them go away.

bawolff 3y ago
I think it has to have an "or else" to be extortion. If its just, consider giving us a gift if you found this report useful, that doesn't sound like extortion (still obnoxious though)
- throwaway313313 3y ago
  They typically do not want to disclose the full vulnerability details prior to you paying them. For the few that we have engaged in back and forth conversation, they typically were just reporting warnings from various opensource website scanners, without completely understanding what they were talking about. That's not to say somebody might discover a new unique vulnerability in the open source software and packages you might be using, except you wouldn't expect them to report it to your company, as some random user on the Internet, when the official projects are on github. Alternatively if they reported a very specific issue regarding software you developed, I'm sure it would get your 100% attention. That's not been my experience so far (knock on wood).
  - bawolff 3y ago
    Yeah if they are refusing to share details without money that sounds more like extortion. > That's not to say somebody might discover a new unique vulnerability in the open source software and packages you might be using, except you wouldn't expect them to report it to your company, as some random user on the Internet, when the official projects are on github. I've actually had this happen once or twice. AFAICT the situation was either that the reporter explains themselves so poorly (in very broken english) that the original project ignored them, or they are trying to maximize bounties by reporting to everyobe who uses the package instead of the actual maintainer. > Alternatively if they reported a very specific issue regarding software you developed, I'm sure it would get your 100% attention. That's not been my experience so far (knock on wood). It does happen (especially if you offer bounties or you are famous), but its like 1% of emails you get at most. Most reports are just incoherent non sense or people misunderstanding the output of an autonated scanner. But its worth it to pay attention for the 1%.
- technion 3y ago
  It's always worded as though you have some trivially exploited RCE, unless you pay them, someone will exploit it. To be fair I'm not suggesting they imply that they will exploit it, but it's always overblown in a way that implies without paying to see their nonsense report your business will suffer a loss.
smsm42 3y ago
It's more like panhandling. They don't have anything to threaten with, the most they have is some minor complaint on a test scan, like Apache version being reported by some server, so they just try to score some money for nothing.

bawolff 3y ago

I mean, im not sure what you expect google to do. Its not illegal to send bad security report emails, and i wouldn't exactly call it spam in the traditional sense. They are annoying though. I'm pretty sure 90% of the value proposition of hackerone is dealing with these people.

arp242 3y ago
I've reviewed hundreds of security reports over the last ten years. I have yet to see a legitimate one. This is good (no security bugs!) but also a massive waste of time, because I do need to review them because what if there is an actual serious report? Is it "spam" in the sense of Nigerian princes and penis enlargements? No. Is it "spam" in the sense that it's the same useless crap being repeated ad nauseam? Absolutely.

SkyPuncher 3y ago

We, like many companies, run a responsible disclosure program. We get reports like this all of the time. There’s a lot of noise to wade through, but we occasionally get good, valid reports. We pay those a reward and fix the issues. Our understanding is many of these reports come from people who landing a single bounty is equivalent to a month of income.

davidgerard 3y ago

we get these all the time and they've always been shit

smsm42 3y ago

It's not unique to India, they are everywhere. The best thing is just ignore them, usually once they are sure there's no money to be made here, they move on quickly.

extraduder_ire 3y ago

I don't think he coined the term, but Troy Hunt calls them "beg bounties". https://www.troyhunt.com/beg-bounties/ https://www.troyhunt.com/beg-bounties/