5 ms·

> Does the credit card company have a reason to do that? Yes. They want to make security researchers too afraid to publish their findings.

neilv 2y ago
Then why not offer them a good (not great) nondisclosure deal? "Discreetly let us know, at the earliest sign of vulnerability, sign a contract with NDA, and we'll investigate, fix, and compensate you promptly. We'll also publicly acknowledge, in vague terms, for your career development, that you successfully discovered a vulnerability that has been addressed. (But if you intrude beyond the boundaries we've clearly specified, then we don't have a business relationship, and we have appropriate government offices on speed-dial.)" That's if the company wants NDA. I'm not saying that's how it should be done; just suggesting what seems like a more vendor relationship, business transaction way of being alerted to their own security mess-ups, if that's what they want.
- sdwr 2y ago
  > Some guy is poking around our system looking for exploitable weaknesses. Should we tell him to go away? > Nah, let's pay him instead! is a solution, but obviously can't be the solution. From a distance, white hat "vulnerability disclosures" start to look like a protection racket.
  - JacobThreeThree 2y ago
    Not to mention, short term cost cutting is what ever business tends to prioritize. Companies would prefer not to pay anyone for anything, including random "researchers".
  - taatof 2y ago
    > From a distance, white hat "vulnerability disclosures" start to look like a protection racket. A pretty big distance. If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket. If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.
    - sdwr 2y ago
      If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket. Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...
      - taatof 2y ago
        > If the reporter is trying to get paid for not reporting, that's blackmail. That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments. > The more you pay people to find them, the harder they look... Yeah... that's the point...
        lodovic 2y ago
        People will look for bugs regardless, better incentivize them to report to you first
      - OfficeChad 2y ago
        [dead]
  - neilv 2y ago
    I agree that you don't want to create a protection racket market, and that's what I was thinking when I said "being alerted to their own security mess-ups". Your own staff and vendors are creating security vulnerabilities, and you wisely run a bounty program, to detect and alert you. And you only pay when they find a problem. It can be very economical hedge against both mistakes and systemic dysfunction. Also, if the researchers were criminally-inclined, they could make more money selling vulnerabilities to someone, not alerting you.
- mystified5016 2y ago
  Quite simply, fixing security vulnerabilities costs a lot more money than being such a raging dick to researchers that no one ever reports. No reports means no vulnerabilities and thus no expenditure.
  - neilv 2y ago
    If a short-term-thinking decision-maker has a KPI for low vulnerabilities, they'd rather take the chance of a massive compromise of the company, than to have vulnerabilities reported and definitely hurt their bonus/promotion?
    - zelphirkalt 2y ago
      Classic management think right there.
  - rapidaneurism 2y ago
    Yeah because only ethical hackers ever look for vulnerabilities
- alp1n3_eth 2y ago
  In the U.S. the opposite is encouraged as we lack a lot of safe harbor laws surrounding responsible disclosure. Something as simple as seeing individual's social security numbers hardcoded into HTML could get you dragged through the mud by your state's leaders and the potential threat of jail time. It's why you'll see a black & white approach to this among bug hunters, instead of a grey / middle-of-the-road one. Some will try to disclose responsibly, the company will deny, and by disclosing through their BBP you've technically agreed to their NDA, so you can't say a word about it even if it still exists a year later. Others will find it and just post it publicly right away, as they don't want to agree to an NDA, and a public action leads to them actually fixing it quickly instead of letting the vuln sit around forever.
Aeolun 2y ago
That doesn’t make any sense though. The only reason they could want that is if they were never going to be held account for exposing the financial details of millions of people. Ooh, wait.
zelphirkalt 2y ago
I hope researchers will find ways to publish their findings in other discrete ways then, so that the company behaving like a dick will get hit by black hat people. Would serve them right.

neilv 2y ago

Then why not offer them a good (not great) nondisclosure deal? "Discreetly let us know, at the earliest sign of vulnerability, sign a contract with NDA, and we'll investigate, fix, and compensate you promptly. We'll also publicly acknowledge, in vague terms, for your career development, that you successfully discovered a vulnerability that has been addressed. (But if you intrude beyond the boundaries we've clearly specified, then we don't have a business relationship, and we have appropriate government offices on speed-dial.)" That's if the company wants NDA. I'm not saying that's how it should be done; just suggesting what seems like a more vendor relationship, business transaction way of being alerted to their own security mess-ups, if that's what they want.

sdwr 2y ago
> Some guy is poking around our system looking for exploitable weaknesses. Should we tell him to go away? > Nah, let's pay him instead! is a solution, but obviously can't be the solution. From a distance, white hat "vulnerability disclosures" start to look like a protection racket.
- JacobThreeThree 2y ago
  Not to mention, short term cost cutting is what ever business tends to prioritize. Companies would prefer not to pay anyone for anything, including random "researchers".
- taatof 2y ago
  > From a distance, white hat "vulnerability disclosures" start to look like a protection racket. A pretty big distance. If a mobster threatens to burn down a building unless you buy their "insurance", that's a protection racket. If someone finds a major fire code violation and threatens to tell the fire marshal about it unless they fix it within a certain timeframe, that's not a protection racket, even though there's technically a threat involved. If the building owner is a dick about it, then next time that person will probably just go directly to the fire marshal.
  - sdwr 2y ago
    If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket. Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...
    - taatof 2y ago
      > If the reporter is trying to get paid for not reporting, that's blackmail. That's not what happened here and isn't usually what happens, though? The reporter usually gives a timeline for fixing the bug before reporting externally, and often extends that deadline if it's clear the Company is working on it. This is separate from bug bounty payments. > The more you pay people to find them, the harder they look... Yeah... that's the point...
      - lodovic 2y ago
        People will look for bugs regardless, better incentivize them to report to you first
    - OfficeChad 2y ago
      [dead]
- neilv 2y ago
  I agree that you don't want to create a protection racket market, and that's what I was thinking when I said "being alerted to their own security mess-ups". Your own staff and vendors are creating security vulnerabilities, and you wisely run a bounty program, to detect and alert you. And you only pay when they find a problem. It can be very economical hedge against both mistakes and systemic dysfunction. Also, if the researchers were criminally-inclined, they could make more money selling vulnerabilities to someone, not alerting you.
mystified5016 2y ago
Quite simply, fixing security vulnerabilities costs a lot more money than being such a raging dick to researchers that no one ever reports. No reports means no vulnerabilities and thus no expenditure.
- neilv 2y ago
  If a short-term-thinking decision-maker has a KPI for low vulnerabilities, they'd rather take the chance of a massive compromise of the company, than to have vulnerabilities reported and definitely hurt their bonus/promotion?
  - zelphirkalt 2y ago
    Classic management think right there.
- rapidaneurism 2y ago
  Yeah because only ethical hackers ever look for vulnerabilities
alp1n3_eth 2y ago
In the U.S. the opposite is encouraged as we lack a lot of safe harbor laws surrounding responsible disclosure. Something as simple as seeing individual's social security numbers hardcoded into HTML could get you dragged through the mud by your state's leaders and the potential threat of jail time. It's why you'll see a black & white approach to this among bug hunters, instead of a grey / middle-of-the-road one. Some will try to disclose responsibly, the company will deny, and by disclosing through their BBP you've technically agreed to their NDA, so you can't say a word about it even if it still exists a year later. Others will find it and just post it publicly right away, as they don't want to agree to an NDA, and a public action leads to them actually fixing it quickly instead of letting the vuln sit around forever.

Aeolun 2y ago

That doesn’t make any sense though. The only reason they could want that is if they were never going to be held account for exposing the financial details of millions of people. Ooh, wait.

zelphirkalt 2y ago

I hope researchers will find ways to publish their findings in other discrete ways then, so that the company behaving like a dick will get hit by black hat people. Would serve them right.