5 ms·

Reading between the lines, it looks like the story behind the story here is that this security researcher followed responsible disclosure policies and confirmed

Reading between the lines, it looks like the story behind the story here is that this security researcher followed responsible disclosure policies and confirmed that the vulnerabilities were fixed before making this post, but never heard back anything from the company (and thus didn’t get paid, although that’s only a fair expectation if they’ve formally set expectations for paying out on stuff like this ahead of time). I’m curious about the legal/reputational implications of this. I personally found some embarrassing security vulnerabilities in a very high profile tech startup and followed responsible disclosure to their security team, but once I got invited to their HackerOne I saw they had only done a handful of payouts ever and they were all like $2k. I was able to do some pretty serious stuff with what I found and figured it was probably more like a $10k-$50k vuln, and I was pretty busy at the time so I just never did all the formal write up stuff they presumably wanted me to do (I had already sent them several highly detailed emails) because it wouldn’t be worth a measly $2k. Does that mean I can make a post like this?

newman8r 1y ago
> I’m curious about the legal/reputational implications of this. The comments and headlines will be a bit snarkier, more likely to go viral - more likely to go national on a light news day, along with the human interest portion of not getting paid which everyone can relate to. Bad PR move
- weitendorf 1y ago
  I guess I mean the legal risks to both sides. Security is only a portion of what I do and I only dabble in red teaming (this is the first time I ever tried it on a third party). So I legitimately don’t know what the legalities of writing a “here’s how I hacked HypeCo” article are if you don’t have the express approval to write that article from HypeCo. Though in my case the company did have an established, public disclosure program that told people they wouldn’t prosecute people who follow responsible disclosure. TFA seems even murkier because Burger King never said they wouldn’t press charges under the CFAA…
akerl_ 1y ago
As a nitpick, you’re describing coordinated disclosure. Branding it as “responsible” puts the thumb on the scale that somehow not coordinating with the vendor is irresponsible.
- LadyCailin 1y ago
  I would say that it is responsible disclosure. Or anyways, not doing that is irresponsible disclosure. The corporation may be hurt by early disclosure, and that’s whatever, but very often, there are a ton of ordinary people that are collateral damage, and the only thing they did wrong was exist in a society where handing over hoards of personal data to a huge corporation is unavoidable. So yes, anyone who discloses before the company has had a reasonable chance to fix things is indeed irresponsible.
  - dns_snek 1y ago
    You're assuming that the choice is between immediate public disclosure and coordinated disclosure. Doing "the responsible thing" takes effort that is often disrespected (sometimes to the extreme). I'm so sick and tired of some companies that any vulnerability I find in their products going forward is an immediate public disclosure. It's either that or no disclosure, and it would be irresponsible not to disclose it at all.
    - bobmcnamara 1y ago
      Agreed. Cracked a thrift store IoT medical device. Contacted vendor. They sent me a one way NDA. Lol no.
      - dns_snek 1y ago
        I've been trapped in a quasi-NDA on bug bounty platforms too. The vendor just refused to make the report public long after the vulnerability had been fixed, likely to cover it up in case of any resulting damages claims (it was a financial platform and the bug affected withdrawals of customer funds). The platform knows my identity, publishing the details would be against their terms, there's an implied threat that they could take legal action against me if I published the details, and they even low-balled the severity to avoid paying out the appropriate amount. Awesome experience overall.
risyachka 1y ago
This is software. There is basically zero consequences for whatever fuckups you do, thus no incentives for companies to pay for vulnerabilities.
juujian 1y ago
I would argue that it is an ethical thing to do so if it sends a signal to pay whitehats appropriately.
- akerl_ 1y ago
  Who is getting that signal? Burger King is almost certainly going to experience no damage from this. Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal practices, nor will they suddenly decide to spin up a bug bounty.
  - chimpanzee 1y ago
    The signal is for the hats. Black hats may be more likely to attack. White hats will find better things to do. Some might even swap hats.
    - akerl_ 1y ago
      You’ve described a totally different “signal” than the comment I replied to.
      - chimpanzee 1y ago
        I guess I should have made it clearer by making the implicit explicit: “The signal isn’t to pay white hats more, instead…” And perhaps an addendum such as: “…which will then, indirectly and in the long run, create the signal you were replying to.”
        akerl_ 1y ago
        Ah. I don’t have much optimism that companies like Burger King will ever get that 2nd signal (mostly because I don’t think the average consumer-facing business suffers much impact from this kind of incident), but I agree with your premise. Appreciate your clarification despite the bluntness of my reply.
PaulHoule 1y ago
I was about to repost that blog post on another site and now it looks like it was taken down.
BrenBarn 1y ago
It won't change until there is better regulation with muscular enforcement. Right now the choice is between paying an $X bug bounty and the vague possibility of some problem for not paying a bounty (e.g., someone sues you, or a PR fiasco causes you to lose customers). That basically means a choice between a 100% chance of losing $X right now (to pay the bounty) or an unknown but probably low chance of an unknown but probably high cost later on. Without any specific incentives, most people making decisions at companies will just choose to gamble on the future, hoping that they can somehow dodge the consequences. To change that calculus, the chance of that future cost needs to go up and the amount of it also needs to go up. If the choice is between a $100k bug bounty now and a $10-million-dollar penalty for a security breach, people will bite the bullet and pay the bounty. If the CEO knows he will lose his house if its discovered that he dismissed the report and benefited financially from doing so, he will pay the bounty. The consequences need to be shifted to the companies that play fast and loose with customer data.
beefnugs 1y ago
They want capitalism, give them capitalism. If you can make more money exploiting it and selling to mafias and gangs and nation states. Do it.
- deleted 1y ago
  [deleted]
hsbauauvhabzb 1y ago
You should consult a lawyer. The first thing they’ll probably want to see is the terms you agreed to on hackerone.
jeroenhd 1y ago
They heard back from the company alright, they DMCA'd the post: https://infosec.exchange/@bobdahacker/115158347003096276 https://infosec.exchange/@bobdahacker/115158347003096276 The screenshot of the email lacks detail so I don't know what part of the DMCA the author breached here, but this feels a lot like your standard DMCA abuse. This AI generated takedown was funded in part by a Y-Combinator: https://cyble.com/press/cyble-recognized-among-ai-startups-funded-by-y-combinator-2025/ https://cyble.com/press/cyble-recognized-among-ai-startups-f...
- user5994461 1y ago
  [flagged]
  - itake 1y ago
    I still don’t get it. What does copyright have to do with the post?
    - user5994461 1y ago
      [flagged]
      - rtkwe 1y ago
        Just because it's the tool they have doesn't legitimize the use of a copyright takedown just to take down information they do not like. DMCA is specific and in theory limited (though many companies abuse it) the proper channel for non infringing content you don't like is the courts.
      - EMIRELADERO 1y ago
        It's DMCA abuse because that process is only legal to use in case of actual copyright infringement, not just any content you might have a moral claim over. You can see on the email that the "Original work" field is just a link to the BK website.
jongjong 1y ago
This sucks. As a developer who puts a lot of effort on security, I hate that companies can get away with such negligence. I hope people invent AI bots which uncover vulnerabilities and make them available publicly for free, in real-time. This would create the right incentives for companies. Modern software has become a giant house of cards, under the control of foreign powers who possess asymetric knowledge. This is because our overarching legal system protects mediocrity and this gives nefarious skilled people with a massive upper hand, while hurting well-intentioned skilled people who try to build software the right way. The nefarious skilled people don't need to ask for permission and don't need to convince anyone to make money from their schemes... Well-intentioned skilled people build products which are impossible to sell or monetize because nobody cares enough about security... Companies mostly externalize the consequences of vulnerabilities to their users and leverage market monopolies to keep them.
Thorrez 1y ago
>Does that mean I can make a post like this? No. Just because there's a blog post about a fixed vulnerability doesn't imply that it's ok to write a blog post about an unfixed vulnerability. I'm not saying it's wrong to post a blog post about an unfixed vulnerability. I'm just saying that the existence of a blog post about a fixed vulnerability has no impact on whether it's ok or not to post a blog post about an unfixed vulnerability.

newman8r 1y ago

> I’m curious about the legal/reputational implications of this. The comments and headlines will be a bit snarkier, more likely to go viral - more likely to go national on a light news day, along with the human interest portion of not getting paid which everyone can relate to. Bad PR move

weitendorf 1y ago
I guess I mean the legal risks to both sides. Security is only a portion of what I do and I only dabble in red teaming (this is the first time I ever tried it on a third party). So I legitimately don’t know what the legalities of writing a “here’s how I hacked HypeCo” article are if you don’t have the express approval to write that article from HypeCo. Though in my case the company did have an established, public disclosure program that told people they wouldn’t prosecute people who follow responsible disclosure. TFA seems even murkier because Burger King never said they wouldn’t press charges under the CFAA…

akerl_ 1y ago

As a nitpick, you’re describing coordinated disclosure. Branding it as “responsible” puts the thumb on the scale that somehow not coordinating with the vendor is irresponsible.

LadyCailin 1y ago
I would say that it is responsible disclosure. Or anyways, not doing that is irresponsible disclosure. The corporation may be hurt by early disclosure, and that’s whatever, but very often, there are a ton of ordinary people that are collateral damage, and the only thing they did wrong was exist in a society where handing over hoards of personal data to a huge corporation is unavoidable. So yes, anyone who discloses before the company has had a reasonable chance to fix things is indeed irresponsible.
- dns_snek 1y ago
  You're assuming that the choice is between immediate public disclosure and coordinated disclosure. Doing "the responsible thing" takes effort that is often disrespected (sometimes to the extreme). I'm so sick and tired of some companies that any vulnerability I find in their products going forward is an immediate public disclosure. It's either that or no disclosure, and it would be irresponsible not to disclose it at all.
  - bobmcnamara 1y ago
    Agreed. Cracked a thrift store IoT medical device. Contacted vendor. They sent me a one way NDA. Lol no.
    - dns_snek 1y ago
      I've been trapped in a quasi-NDA on bug bounty platforms too. The vendor just refused to make the report public long after the vulnerability had been fixed, likely to cover it up in case of any resulting damages claims (it was a financial platform and the bug affected withdrawals of customer funds). The platform knows my identity, publishing the details would be against their terms, there's an implied threat that they could take legal action against me if I published the details, and they even low-balled the severity to avoid paying out the appropriate amount. Awesome experience overall.

risyachka 1y ago

This is software. There is basically zero consequences for whatever fuckups you do, thus no incentives for companies to pay for vulnerabilities.

juujian 1y ago

I would argue that it is an ethical thing to do so if it sends a signal to pay whitehats appropriately.

akerl_ 1y ago
Who is getting that signal? Burger King is almost certainly going to experience no damage from this. Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal practices, nor will they suddenly decide to spin up a bug bounty.
- chimpanzee 1y ago
  The signal is for the hats. Black hats may be more likely to attack. White hats will find better things to do. Some might even swap hats.
  - akerl_ 1y ago
    You’ve described a totally different “signal” than the comment I replied to.
    - chimpanzee 1y ago
      I guess I should have made it clearer by making the implicit explicit: “The signal isn’t to pay white hats more, instead…” And perhaps an addendum such as: “…which will then, indirectly and in the long run, create the signal you were replying to.”
      - akerl_ 1y ago
        Ah. I don’t have much optimism that companies like Burger King will ever get that 2nd signal (mostly because I don’t think the average consumer-facing business suffers much impact from this kind of incident), but I agree with your premise. Appreciate your clarification despite the bluntness of my reply.

PaulHoule 1y ago

I was about to repost that blog post on another site and now it looks like it was taken down.

BrenBarn 1y ago

It won't change until there is better regulation with muscular enforcement. Right now the choice is between paying an $X bug bounty and the vague possibility of some problem for not paying a bounty (e.g., someone sues you, or a PR fiasco causes you to lose customers). That basically means a choice between a 100% chance of losing $X right now (to pay the bounty) or an unknown but probably low chance of an unknown but probably high cost later on. Without any specific incentives, most people making decisions at companies will just choose to gamble on the future, hoping that they can somehow dodge the consequences. To change that calculus, the chance of that future cost needs to go up and the amount of it also needs to go up. If the choice is between a $100k bug bounty now and a $10-million-dollar penalty for a security breach, people will bite the bullet and pay the bounty. If the CEO knows he will lose his house if its discovered that he dismissed the report and benefited financially from doing so, he will pay the bounty. The consequences need to be shifted to the companies that play fast and loose with customer data.

beefnugs 1y ago

They want capitalism, give them capitalism. If you can make more money exploiting it and selling to mafias and gangs and nation states. Do it.

deleted 1y ago
[deleted]

hsbauauvhabzb 1y ago

You should consult a lawyer. The first thing they’ll probably want to see is the terms you agreed to on hackerone.

jeroenhd 1y ago

They heard back from the company alright, they DMCA'd the post: https://infosec.exchange/@bobdahacker/115158347003096276 https://infosec.exchange/@bobdahacker/115158347003096276 The screenshot of the email lacks detail so I don't know what part of the DMCA the author breached here, but this feels a lot like your standard DMCA abuse. This AI generated takedown was funded in part by a Y-Combinator: https://cyble.com/press/cyble-recognized-among-ai-startups-funded-by-y-combinator-2025/ https://cyble.com/press/cyble-recognized-among-ai-startups-f...

user5994461 1y ago
[flagged]
- itake 1y ago
  I still don’t get it. What does copyright have to do with the post?
  - user5994461 1y ago
    [flagged]
    - rtkwe 1y ago
      Just because it's the tool they have doesn't legitimize the use of a copyright takedown just to take down information they do not like. DMCA is specific and in theory limited (though many companies abuse it) the proper channel for non infringing content you don't like is the courts.
    - EMIRELADERO 1y ago
      It's DMCA abuse because that process is only legal to use in case of actual copyright infringement, not just any content you might have a moral claim over. You can see on the email that the "Original work" field is just a link to the BK website.

jongjong 1y ago

This sucks. As a developer who puts a lot of effort on security, I hate that companies can get away with such negligence. I hope people invent AI bots which uncover vulnerabilities and make them available publicly for free, in real-time. This would create the right incentives for companies. Modern software has become a giant house of cards, under the control of foreign powers who possess asymetric knowledge. This is because our overarching legal system protects mediocrity and this gives nefarious skilled people with a massive upper hand, while hurting well-intentioned skilled people who try to build software the right way. The nefarious skilled people don't need to ask for permission and don't need to convince anyone to make money from their schemes... Well-intentioned skilled people build products which are impossible to sell or monetize because nobody cares enough about security... Companies mostly externalize the consequences of vulnerabilities to their users and leverage market monopolies to keep them.

Thorrez 1y ago

>Does that mean I can make a post like this? No. Just because there's a blog post about a fixed vulnerability doesn't imply that it's ok to write a blog post about an unfixed vulnerability. I'm not saying it's wrong to post a blog post about an unfixed vulnerability. I'm just saying that the existence of a blog post about a fixed vulnerability has no impact on whether it's ok or not to post a blog post about an unfixed vulnerability.