3 ms·
Yikes... i don't know what i'd do. I hope with enough preventative measures i'll never have to deal with something like that. First scenario: First priority is
by mappu 15y ago
Yikes... i don't know what i'd do. I hope with enough preventative measures i'll never have to deal with something like that.
First scenario: First priority is to branch and patch the hole asap. There's no point dealing with this if someone else is going to put you back in this position a month later. Make sure everyone in the company is on the same page, and then unfortunately i'd probably attempt to verify that the request was legitimate, and ask for proof with the pretence of being willing to pay.. Try and think of some way to make the information useless to the perpetrator, but in the end, i probably would pay up (under some contract) and maybe offer employment as well.
Could possibly whip up a bug reporting program, with well-defined rewards in the vicinity of what was being asked, and give the perpetrator a nondescript shrug toward it. That way the perpetrator gets an easy, moral way out, which is almost as important.
Second scenario: Security audit, change all passwords, IP restrict logins, re-encrypt all user passwords on login. Hopefully there was no sensitive data - then i would wait it out to see if it turns into scenario one. It would be embarassing to send out apologies + service credits if it wasn't malicious (not just e.g. the hosting provider doing maintenance, someone using a proxy, someone working out at a client's site, a contractor's ip you've overlooked, etc)
It always feels like someone's done the right thing when you read stories about services notifying all their users, forcing password changes, and so on. But you have to keep up your business, and it's not like you can just shut everything down, rewind time and never program again. Damage control and move on.
- sharth 15y agoYou would actually offer employment to someone who just blackmailed you?
- mappu 15y agoMaybe? I don't know. It's important to act reasonably and not to spook them into releasing all the data. My company could probably do with an extra pair of hands, especially someone who's proven they know their way around debian / SQL (probable attack vectors), and now they have the DB schema to study, so... not the worst candidate... Plus, the company would by now be busy with the task of patching all the exploits. You almost have to look at it from their point of view. Their options are (a) sign NDA, take employment, money, an honourable way out of a difficult situation, or (b) go on the offensive, release the data for little or no personal gain, and suffer through a police investigation and potentially jail-time or a permanent criminal record. Option (A) works out better for your company, your product, and for them, so you might as well aim for that. I think this is a pretty common approach. Although, it's been used in stings in the past, where a fake offer of employment is enough to get the person in the flesh where the police can take over. There's one very interesting story from Valve about the leak of the Half-Life 2 beta[1] - and of course, Owen Walker[2] found employment after a high-profile hacking case. It would be interesting to see what other companies in similar situations ended up considering... __________________________ 1. http://www.theregister.co.uk/2008/11/14/half_life_sting/ http://www.theregister.co.uk/2008/11/14/half_life_sting/ 2. https://secure.wikimedia.org/wikipedia/en/wiki/Owen_Thor_Walker https://secure.wikimedia.org/wikipedia/en/wiki/Owen_Thor_Wal...