9 ms·

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the ve

What a great article. Very easy to follow. The best part was that instead of attacking the messenger and denying any problem, Cox seem to have acted like the very model of responsible security response in this kind of situation. I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs. It's the kind of error that could easily be missed by superficial testing or depending on the reason behind the bug, perhaps not even experienced in the test environment.

p0seidon 2y ago
Totally agree, an easy read and a great reaction by Cox. I also like that the discovery and the bug itself were not communicated in a negative or condescending way, which is sometimes the case.
senectus1 2y ago
agreed, lets hope they dont bloody sue him into the ground for "hacking" Its stuff like this that company's should REWARD people for finding.
- imadr 2y ago
  I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder
  - cqqxo4zV46cp 2y ago
    Don’t frame a company not parting ways with money that they could hypothetically part ways with as being unusually egregious. That’s never how it works. Not every conversation needs overstated outrage.
  - teruakohatu 2y ago
    They do not: > Cox does not offer a bounty program or provide compensation in exchange for security vulnerability submissions. https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...
    - tetha 2y ago
      Mh, we have a similar thing on our website at work, but people who found serious issues still got compensated. One big reason to put this out there: Otherwise you get so many drive-by disclosures. Throw ZAP at the domain, copy all of the low and informational topics into a mail at security@domain and ask for a hundred bucks. Just sifting through that nonsense eventually takes up significant time. If you can just answer that with a link to this statement it becomes easier. It makes me a bit sad that this might scare off some motivated, well natured newbs poking at our API, but the spam drowned them out.
  - unclebucknasty 2y ago
    >...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.
    - zdimension 2y ago
      At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.
      - unclebucknasty 2y ago
        >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
        bongodongobob 2y ago
        It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
        worewood 2y ago
        Great response, entirely agree.
        2y ago
  - bayindirh 2y ago
    > Frankly he could have just sold the vulnerability to the highest bidder Why? Ethics aside, is everything money?
    - naikrovek 2y ago
      because money grants wishes, and having more money means you get more of your wishes granted.
      - bayindirh 2y ago
        That doesn't make me interested. I don't get all excited about the things money can buy. Edit: As I noted elsewhere, necessities are something else.
        johnisgood 2y ago
        I would love to have the money (42k EUR) to buy Scewo, which is an advanced self balancing stair climbing wheelchair. Sadly enough, I doubt I will ever be able to.
        WarOnPrivacy 2y ago
        May I suggest a decade of red state hunger-level poverty? My kids and I did it. Three years out of it, I get excited paying utilities on time.
        Vicinity9635 2y ago
        [dead]
      - deleted 2y ago
        [deleted]
    - robertlagrant 2y ago
      > Why? Ethics aside, is everything money? Ethics aside, why not? That's why we have ethics.
- acdha 2y ago
  They have a pretty good looking responsible disclosure program which I’m assuming he checked first - it’d be surprising for someone who works in the field not to have that same concern: https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...
- webninja 2y ago
  Yeah let’s hope that they don’t prosecute him under the CFAA. He saved the FBI and untold others. He’s a hero.
gediz 2y ago
[dead]
randomcarbloke 2y ago
it's good but the constant use of "super" was a little off-putting, "super curious", "super interesting", "super interested", etc.
- pfdietz 2y ago
  Super off-putting, you mean.
- armada651 2y ago
  There were 4 occurrences of the word "super" in an article with more than four thousand words in it, there is no need for "etc." you quoted all the occurrences since "super curious" was used twice.
  - shermantanktop 2y ago
    I guess that reader is super sensitive.
  - randomcarbloke 2y ago
    Once was enough.
- sgerenser 2y ago
  IMHO, your comment is super nitpicky.
  - randomcarbloke 2y ago
    You're goddamn right.
oasisbob 2y ago
> Cox seem to have acted like the very model of responsible security response in this kind of situation It's hard to imagine, but I wish they would have taken advantage of him walking in with the compromised device in the first place. I once stumbled upon a really bad vulnerability in a traditional telco provider, and the amount of work it took to get them to pay attention when only having the front door available was staggering. Took dedicated attempts over about a week to get in touch with the right people - their support org was completely ineffective at escalating the issue. Cox's support organization was presented with a compromised device being handed to them by an infosec professional, and they couldn't handle it effectively at all.
- tw04 2y ago
  > Cox's support organization was presented with a compromised device being handed to them by an infosec professional, and they couldn't handle it effectively at all. He probably should have gone the responsible disclosure route with the modem too. Do you really expect a minimum wage front desk worker to be able to determine what’s a potential major security flaw, and what’s a random idiot who thinks his modem is broken because “modern warfare is slow”?
  - oasisbob 2y ago
    I would expect a front-desk worker to be trained to escalate issues within the org, and supported in doing so.
    - deleted 2y ago
      [deleted]
    - thrwaway1985882 2y ago
      Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times over a year because "hackers were getting in and sending them emails" (internal customer note: stop signing up for porn sites), and a customer's computer could barely browse the web because they were running about 5 software firewalls because they were "under surveillance by the NSA" (internal customer note: schizophrenia). The expected value of processing requests like this any way other than patting the reporter on their head and assuring them the company will research it, then sending them along their way with a new device while chucking the old one in the "reflash" pile isn't just zero, it's sharply negative. The author's mistake was not posting somewhere like NANOG or Full-Disclosure with a detailed write-up. The right circles would've seen it, the detailed write-up would've revealed that the author wasn't an idiot or paranoid, and the popped device might've been researched.
ImPostingOnHN 2y ago
> I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs I would, too. Not sure we will ever learn. Maybe a load balancer config that inadvertently included "test" backends which didn't check authorization?

p0seidon 2y ago

Totally agree, an easy read and a great reaction by Cox. I also like that the discovery and the bug itself were not communicated in a negative or condescending way, which is sometimes the case.

senectus1 2y ago

agreed, lets hope they dont bloody sue him into the ground for "hacking" Its stuff like this that company's should REWARD people for finding.

imadr 2y ago
I assumed they offered a bounty for bug disclosure? You mean to tell me that an internet provider with 11 billion in revenue can't pay someone that found a bug impacting all their clients? Frankly he could have just sold the vulnerability to the highest bidder
- cqqxo4zV46cp 2y ago
  Don’t frame a company not parting ways with money that they could hypothetically part ways with as being unusually egregious. That’s never how it works. Not every conversation needs overstated outrage.
- teruakohatu 2y ago
  They do not: > Cox does not offer a bounty program or provide compensation in exchange for security vulnerability submissions. https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...
  - tetha 2y ago
    Mh, we have a similar thing on our website at work, but people who found serious issues still got compensated. One big reason to put this out there: Otherwise you get so many drive-by disclosures. Throw ZAP at the domain, copy all of the low and informational topics into a mail at security@domain and ask for a hundred bucks. Just sifting through that nonsense eventually takes up significant time. If you can just answer that with a link to this statement it becomes easier. It makes me a bit sad that this might scare off some motivated, well natured newbs poking at our API, but the spam drowned them out.
- unclebucknasty 2y ago
  >...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.
  - zdimension 2y ago
    At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.
    - unclebucknasty 2y ago
      >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
      - bongodongobob 2y ago
        It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
        worewood 2y ago
        Great response, entirely agree.
        2y ago
- bayindirh 2y ago
  > Frankly he could have just sold the vulnerability to the highest bidder Why? Ethics aside, is everything money?
  - naikrovek 2y ago
    because money grants wishes, and having more money means you get more of your wishes granted.
    - bayindirh 2y ago
      That doesn't make me interested. I don't get all excited about the things money can buy. Edit: As I noted elsewhere, necessities are something else.
      - johnisgood 2y ago
        I would love to have the money (42k EUR) to buy Scewo, which is an advanced self balancing stair climbing wheelchair. Sadly enough, I doubt I will ever be able to.
      - WarOnPrivacy 2y ago
        May I suggest a decade of red state hunger-level poverty? My kids and I did it. Three years out of it, I get excited paying utilities on time.
      - Vicinity9635 2y ago
        [dead]
    - deleted 2y ago
      [deleted]
  - robertlagrant 2y ago
    > Why? Ethics aside, is everything money? Ethics aside, why not? That's why we have ethics.
acdha 2y ago
They have a pretty good looking responsible disclosure program which I’m assuming he checked first - it’d be surprising for someone who works in the field not to have that same concern: https://www.cox.com/aboutus/policies/cox-security-responsible-disclosure-policy.html https://www.cox.com/aboutus/policies/cox-security-responsibl...
webninja 2y ago
Yeah let’s hope that they don’t prosecute him under the CFAA. He saved the FBI and untold others. He’s a hero.

gediz 2y ago

[dead]

randomcarbloke 2y ago

it's good but the constant use of "super" was a little off-putting, "super curious", "super interesting", "super interested", etc.

pfdietz 2y ago
Super off-putting, you mean.
armada651 2y ago
There were 4 occurrences of the word "super" in an article with more than four thousand words in it, there is no need for "etc." you quoted all the occurrences since "super curious" was used twice.
- shermantanktop 2y ago
  I guess that reader is super sensitive.
- randomcarbloke 2y ago
  Once was enough.
sgerenser 2y ago
IMHO, your comment is super nitpicky.
- randomcarbloke 2y ago
  You're goddamn right.

oasisbob 2y ago

> Cox seem to have acted like the very model of responsible security response in this kind of situation It's hard to imagine, but I wish they would have taken advantage of him walking in with the compromised device in the first place. I once stumbled upon a really bad vulnerability in a traditional telco provider, and the amount of work it took to get them to pay attention when only having the front door available was staggering. Took dedicated attempts over about a week to get in touch with the right people - their support org was completely ineffective at escalating the issue. Cox's support organization was presented with a compromised device being handed to them by an infosec professional, and they couldn't handle it effectively at all.

tw04 2y ago
> Cox's support organization was presented with a compromised device being handed to them by an infosec professional, and they couldn't handle it effectively at all. He probably should have gone the responsible disclosure route with the modem too. Do you really expect a minimum wage front desk worker to be able to determine what’s a potential major security flaw, and what’s a random idiot who thinks his modem is broken because “modern warfare is slow”?
- oasisbob 2y ago
  I would expect a front-desk worker to be trained to escalate issues within the org, and supported in doing so.
  - deleted 2y ago
    [deleted]
  - thrwaway1985882 2y ago
    Have you ever worked as a front-line support agent? I'm guessing not. I have many years ago, and for an ISP too. If I bought an Amazon share back then for every time a customer called support because they were "hacked", I'd not be posting here during a boring meeting because I'd own my own private island. The two best conversations I can recall were when we changed a customer's email address about a half dozen times over a year because "hackers were getting in and sending them emails" (internal customer note: stop signing up for porn sites), and a customer's computer could barely browse the web because they were running about 5 software firewalls because they were "under surveillance by the NSA" (internal customer note: schizophrenia). The expected value of processing requests like this any way other than patting the reporter on their head and assuring them the company will research it, then sending them along their way with a new device while chucking the old one in the "reflash" pile isn't just zero, it's sharply negative. The author's mistake was not posting somewhere like NANOG or Full-Disclosure with a detailed write-up. The right circles would've seen it, the detailed write-up would've revealed that the author wasn't an idiot or paranoid, and the popped device might've been researched.

ImPostingOnHN 2y ago

> I'd love to read a follow up on what the bug was that intermittently permitted unauthorised access to the APIs I would, too. Not sure we will ever learn. Maybe a load balancer config that inadvertently included "test" backends which didn't check authorization?