6 ms·

> Shubham Mittal, co-founder and chief technology officer of RedHunt Labs, alerted TechCrunch to the exposure and asked for help in disclosing to the car maker.

> Shubham Mittal, co-founder and chief technology officer of RedHunt Labs, alerted TechCrunch to the exposure and asked for help in disclosing to the car maker. The London-based cybersecurity company said it discovered a Mercedes employee’s authentication token in a public GitHub repository during a routine internet scan in January. That's a strange way to disclose a security security issue.

esskay 3y ago
Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.
- _kbh_ 3y ago
  > Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find. Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.
  - waihtis 3y ago
    This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.
    - hug 3y ago
      No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not. I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.
      - waihtis 3y ago
        > publishing a bug bounty program doesn’t mean you’re the good guys this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope [1]: https://eu.desmoinesregister.com/story/news/crime-and-courts/2021/08/01/arrested-coalfire-security-testers-2019-file-dallas-county-iowa-courthouse-lawsuit/5431611001/ https://eu.desmoinesregister.com/story/news/crime-and-courts...
        beeboobaa 3y ago
        > this is meaningless rabble That is rich coming from yourself. Are you at all familiar with German law?
        bombcar 3y ago
        It’s less than a 1% chance of financial ruin!m? Sign me up!
        waihtis 3y ago
        I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash
        bombcar 3y ago
        I would probably avoid transportation that kills 1% of its users each trip.
        anon4242 3y ago
        Username checks out. Guess you're going for 100%?
- mavhc 3y ago
  Assuming anyone is reading that email account
  - johannes1234321 3y ago
    Lawyers will. Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.
- wirrbel 3y ago
  It’s pretty dangerous according to German law to disclose security issues.
  - joshuaissac 3y ago
    From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969 https://news.ycombinator.com/item?id=39098969
    - mass_and_energy 3y ago
      This is why I need the CCC in my life
      - sparrowInHand 3y ago
        But they have no big influence, they just play the courtjester to a forever demented king.
        meinheld111 3y ago
        Thou it would be worse without a jester
  - riedel 3y ago
    And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.
    - rurban 3y ago
      > journalists can protect their sources. But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.
cqqxo4zV46cp 3y ago
TechCrunch would be very far down my list of publishers were I wanting to responsibly publicly disclose something. Hard for me to take this particular outfit seriously after they decided to optimise for engagement by running to Entertainment Tonight.
- weego 3y ago
  The'd be on my list if my goal was tie in someone who will give me easy, and very visible, publicity to the process.
rvnx 3y ago
"I contacted unrelated people and all the press to help them"
xeornet 3y ago
Sounds like he was just trying to guarantee a mention (advertising and clout) in the subsequent TechCrunch article…
waihtis 3y ago
Call it what it is, a totally rat move placing Mercedes in risk for pure self-promotion purposes - instead of going via the vulnerability disclosure channel (first result on google when googling "mercedes security disclosure".) I hope nobody is stupid enough to ever engage with this firm after this publicity stunt.
- 0x_rs 3y ago
  The only thing putting Mercedes at risk are previous sentences going heavy handed on ethical security researchers that bothered contacting german companies. You can find some examples online where just "poking" with leaked credentials not unlike OP was not looked favourably upon. https://www.theregister.com/2024/01/19/germany_fine_security/ https://www.theregister.com/2024/01/19/germany_fine_security... https://www.darkreading.com/vulnerabilities-threats/another-researcher-hit-with-threat-of-german-anti-hacking-law https://www.darkreading.com/vulnerabilities-threats/another-...
  - waihtis 3y ago
    there's a world of difference in contacting a company via an ethical vulnerability disclosure program and doing so without one in place. it really shouldn't be that difficult to understand. Being "german" has nothing to do with it

esskay 3y ago

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

_kbh_ 3y ago
> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find. Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.
- waihtis 3y ago
  This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.
  - hug 3y ago
    No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not. I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.
    - waihtis 3y ago
      > publishing a bug bounty program doesn’t mean you’re the good guys this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope [1]: https://eu.desmoinesregister.com/story/news/crime-and-courts/2021/08/01/arrested-coalfire-security-testers-2019-file-dallas-county-iowa-courthouse-lawsuit/5431611001/ https://eu.desmoinesregister.com/story/news/crime-and-courts...
      - beeboobaa 3y ago
        > this is meaningless rabble That is rich coming from yourself. Are you at all familiar with German law?
      - bombcar 3y ago
        It’s less than a 1% chance of financial ruin!m? Sign me up!
        waihtis 3y ago
        I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash
        bombcar 3y ago
        I would probably avoid transportation that kills 1% of its users each trip.
        anon4242 3y ago
        Username checks out. Guess you're going for 100%?
mavhc 3y ago
Assuming anyone is reading that email account
- johannes1234321 3y ago
  Lawyers will. Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.
wirrbel 3y ago
It’s pretty dangerous according to German law to disclose security issues.
- joshuaissac 3y ago
  From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969 https://news.ycombinator.com/item?id=39098969
  - mass_and_energy 3y ago
    This is why I need the CCC in my life
    - sparrowInHand 3y ago
      But they have no big influence, they just play the courtjester to a forever demented king.
      - meinheld111 3y ago
        Thou it would be worse without a jester
- riedel 3y ago
  And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.
  - rurban 3y ago
    > journalists can protect their sources. But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.

cqqxo4zV46cp 3y ago

TechCrunch would be very far down my list of publishers were I wanting to responsibly publicly disclose something. Hard for me to take this particular outfit seriously after they decided to optimise for engagement by running to Entertainment Tonight.

weego 3y ago
The'd be on my list if my goal was tie in someone who will give me easy, and very visible, publicity to the process.

rvnx 3y ago

"I contacted unrelated people and all the press to help them"

xeornet 3y ago

Sounds like he was just trying to guarantee a mention (advertising and clout) in the subsequent TechCrunch article…

waihtis 3y ago

Call it what it is, a totally rat move placing Mercedes in risk for pure self-promotion purposes - instead of going via the vulnerability disclosure channel (first result on google when googling "mercedes security disclosure".) I hope nobody is stupid enough to ever engage with this firm after this publicity stunt.

0x_rs 3y ago
The only thing putting Mercedes at risk are previous sentences going heavy handed on ethical security researchers that bothered contacting german companies. You can find some examples online where just "poking" with leaked credentials not unlike OP was not looked favourably upon. https://www.theregister.com/2024/01/19/germany_fine_security/ https://www.theregister.com/2024/01/19/germany_fine_security... https://www.darkreading.com/vulnerabilities-threats/another-researcher-hit-with-threat-of-german-anti-hacking-law https://www.darkreading.com/vulnerabilities-threats/another-...
- waihtis 3y ago
  there's a world of difference in contacting a company via an ethical vulnerability disclosure program and doing so without one in place. it really shouldn't be that difficult to understand. Being "german" has nothing to do with it