3 ms·
It depends on the company. Many companies have bug bounty or vulnerability disclosure programs that explicitly guarantee safe harbor+protections for researchers
by richbell 3y ago
It depends on the company. Many companies have bug bounty or vulnerability disclosure programs that explicitly guarantee safe harbor+protections for researchers.
However, not all organizations
are happy to be contacted about security issues. Sometimes doing the right thing can still result in (threats of) legal repercussions.
https://arstechnica.com/tech-policy/2021/10/missouri-gov-calls-journalist-who-found-security-flaw-a-hacker-threatens-to-sue/ https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal...
- azeemba 3y agoThe bug bounties are usually pretty clear that you aren't allowed to make changes in the production systems. Here they made many changes - including changing the name of a release. The bug bounties also prefer seeing a working attack instead of theoretical reports. So not sure how they could have tested their attack in this situation without making actual changes.
- richbell 3y agoIt depends. Sometimes companies only permit testing in specific test domains, other times they permit it as long as your activity is clearly identifiable (e.g., including a custom header in all request). It does seem like walking a precarious tight rope.