4 ms·
> Good Samaritan The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)
by MrBruh 3y ago
> Good Samaritan
The web is insecure enough as it is, I just want to do my part to make it that little bit safer :)
- mise_en_place 3y agoEither way it is a fascinating write-up. It will hopefully be a cautionary tale for other businesses and companies out there, and will inspire them to lockdown this credentialing issue. I've noticed a similar blasé attitude when implementing SSO; the devil is in the details as they say.
- cedws 3y agoI salute you for it. Take caution though. The bad guys don't play by the rules so the rules only hinder the good guys from helping. I think Internet security would be in a better position if we had legislation to protect good samaritan pentesters. Even moreso if they were appropriately rewarded.
- freejazz 3y agoHow do you propose such a law would work?
- cedws 3y ago1. White hat submits a "Notice of Vulnerability Testing" document to target company (copy also sent to government body) including their information, what systems will be tested, and in what time window 2. Company is required to acknowledge the notice within X hours and grant permission or respond with a reason that the test cannot take place 3. White hat performs testing according to the plan 4. White hat discloses any findings to the company (keeping government body in the loop) 5. Company patches systems and may reward white hat at their discretion 6. Government body determines if fines should be applied and may also reward white hat at their discretion Something like that. The white hat would have legal immunity as long as they submit the document, stick to the plan, and don't cause damage.
- freejazz 3y agoNothing in your proposed law provides a way to distinguish between white hats and black hats, and instead it just presupposes that the person undertaking the conduct in question is a white hat.
- nkrisc 3y agoWhy, you’d never catch a black hat hacker again. The authorities would ust reeling in one Good Samaritan after another!
- cedws 3y agoThere is a big difference between discovering a vulnerability that allows you to forge tokens and immediately reporting it versus dumping terabytes of data on the darknet for sale.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- eyegor 3y agoUnfortunately, door 1 is maybe $200 bounty and weeks or months of back and forth (if the corp doesn't have a clear bounty program) whereas door 2 has infinite upside. Honestly, it might make sense for a gov group to run a standardized bounty program for exploits with notable financial / privacy impact.
- DANmode 3y agoGiving corps even more excuse not to run proper bug bounties, or care even less about shipping secure code? Pass.
- zaphar 3y agoI don't know. I think you could perhaps align incentives such that any bounty claimed via the government program is competitive, public, and companies are ranked by the number and severity of bounties. Then the company would have an incentive to run a bounty program where they had a chance of controlling the narrative a bit.
- mmsc 3y agoEverybody has that goal until they get a knock on their door at 6am: https://github.com/disclose/research-threats https://github.com/disclose/research-threats
- nigamanth 3y agoDoes this bug work across all applications that use Firebase? Or just those that didn't push the update with security?
- pharrington 3y agoFrom one Paul to another, best of luck! For the goal of improving overall web security, widespread shame doesn't work. My hunch is that we need to be more prideful about having verifiably robust security practices. Kind of like getting corporations to realize that the data is more valuable if you can prove that nobody can breach it.
- MrBruh 3y agoThank you, the kindness goes a long way!
- deleted 3y ago[deleted]