14 ms·

I found a vulnerability. they found a lawyer

• xvxvx 9mo ago
  I’ve worked in I.T. For nearly 3 decades, and I’m still astounded by the disconnect between security best practices, often with serious legal muscle behind them, and the reality of how companies operate. I came across a pretty serious security concern at my company this week. The ramifications are alarming. My education, training and experience tells me one thing: identify, notify, fix. Then when I bring it to leadership, their agenda is to take these conversations offline, with no paper trail, and kill the conversation. Anytime I see an article about a data breach, I wonder how long these vulnerabilities were known and ignored. Is that just how business is conducted? It appears so, for many companies. Then why such a focus on security in education, if it has very little real-world application? By even flagging the issue and the potential fallout, I’ve put my career at risk. These are the sort of things that are supposed to lead to commendations and promotions. Maybe I live in fantasyland.
  • calvinmorrison 9mo ago
    > By even flagging the issue and the potential fallout, I’ve put my career at risk. Simple as. Not your company? not your problem? Notify, move on.
    • dspillett 9mo ago
      I read that post as him talking about their company, in the sense of the company they were working for. If that was the case, then an exploit of an unfixed security issue could very much affect them either just as part of the company if the fallout is enough to massively harm business, or specifically if they had not properly documented their concerns so “we didn't know” could be the excuse from above and they could be blamed for not adequately communicating the problem. For an external company “not your company, not your problem” for security issues is not a good moral position IMO. “I can't risk the fallout in my direction that I'm pretty sure will result from this” is more understandable because of how often you see whistle-blowers getting black-listed, but I'd still have a major battle with the pernickety prick that is my conscience¹ and it would likely win out in the end. [1] oh, the things I could do if it wasn't for conscience and empathy :)
      • calvinmorrison 9mo ago
        No i mean, 'a company you own'. At the end of the day you're just a worker getting paid to produce output. cross your I's and dot your T's and whatever else and then clock out.
        • dspillett 9mo ago
          Even keeping to the 9-to-5 you can make your displeasure at being insecure know. And if the security issues come to a head and it damages the company, you could be out on your arse if the company dies or needs to cut costs. In the current environment is a lot worse than it would have been five or ten years ago, and that same environment likely limits the “I don't like it so I'll just leave” options that are available. I'm lucky, I have options¹ and it is looking like I don't need them²³, but many are not so lucky. -------- [1] I made serious enquiries about a couple of them when the recent take-over was announced, just in case… [2] the new corporate masters seem to be doing more than talking the talk, and on quality matters we were already doing things right and the new overlords don't appear to have any desire to change that [3] well, at least not on these matters, there are a few cultural changes that I need to get used to or get away from, largely due to being a bigger organisation now, but they aren't wrong just a little further from my preference than things were before.
    • Aurornis 9mo ago
      Their websites says they're a freelance cloud architect. The article doesn't say exactly, but if they used their company e-mail account to send the e-mail it's difficult to argue it wasn't related to their business. They also put "I am offering" language in their e-mail which I'm sure triggered the lawyers into interpreting this a different way. Not a choice of words I would recommend using in a case like this.
      • kjs3 9mo ago
        This is a good point. I think we get a couple of emails a week for exactly this kind of bottom feeder 'consulting firm' 'offering' to tell us all about some massive security issue they found, as long as we sign up for a 'consulting engagement'[1]. On the other hand, we generally ignore them, not threaten to sue them. [1] We get about as many 'pay us a bounty or we'll tell the world about this horrid vulnerability we found'. I have suggested to legal we treat those like extortion attempts to make them go away and stop wasting our time but legal doesn't want to spend time on it.
  • refulgentis 9mo ago
    > These are the sort of things that are supposed to lead to commendations and promotions. Maybe I live in fantasyland. I had a bit of a feral journey into tech, poor upbringing => self taught college dropout waiting tables => founded iPad point of sale startup in 2011 => sold it => Google in 2016 to 2023 It was absolutely astounding to go to Google, and find out that all this work to ascend to an Ivy League-esque employment environment...I had been chasing a ghost. Because Google, at the end of the day, was an agglomeration of people, suffered from the same incentives and disincentives as any group, and thus also had the same boring, basic, social problems as any group. Put more concretely, couple vignettes: - Someone with ~5 years experience saying approximately: "You'd think we'd do a postmortem for this situation, but, you know how that goes. The people involved think they're an organization-wide announcement that you're coming for them, and someone higher ranked will get involved and make sure A) it doesn't happen or B) you end up looking stupid for writing it." - A horrible design flaw that made ~50% of users take 20 seconds to get a query answered was buried, because a manager involved was the one who wrote the code.
    • xvxvx 9mo ago
      I would get fired at Google within seconds then. I’m more than happy to shine a light on bullshit like that.
    • bubblewand 9mo ago
      I've seen into some moderately high levels of "prestigious" business and government circles and I've yet to find any level at which everyone suddenly becomes as competent and sharp as I'd have expected them to be, as a child and young adult (before I saw what I've seen and learned that the norm is morons and liars running everything and operating terrifically dysfunctional organizations... everywhere, apparently, regardless how high up the hierarchy you go). And actually, not only is there no step at which they suddenly become so, people don't even seem to gradually tend to brighter or generally better, on average, as you move "upward"... at all! Or perhaps only weakly so. Whatever the selection process is for gestures broadly at everything, it's not selecting for being both (hell, often not for either) able and willing to do a good job, so far as what the job is apparently supposed to be. This appears to hold for just about everything, reputation and power be damned. Exceptions of high-functioning small groups or individuals in positions of power or prestige exist, as they do at "lower" levels, but aren't the norm anywhere as far as I've been able to discern.
  • dspillett 9mo ago
    > I came across a pretty serious security concern at my company this week. The ramifications are alarming. […] Then when I bring it to leadership, their agenda is to take these conversations offline, with no paper trail, and kill the conversation. I was in a very similar position some years ago. After a couple of rounds of “finish X for sale Y then we'll prioritise those issue”, which I was young and scared enough to let happen, and pulling on heartstrings (“if we don't get this sale some people will have to go, we risk that to [redacted] and her new kids, can we?”) I just started fixing the problems and ignoring other tasks. I only got away with the insubordination because there were things I was the bus-count-of-one on at the time and when they tried to butter me up with the promise of some training courses, I had taken & passed some of those exams and had the rest booked in (the look of “good <deity>, he got an escape plan and is close to acting on it” on the manager's face during that conversation was wonderful!). The really worrying thing about that period is that a client had a pen-test done on their instance of the app, and it passed. I don't know how, but I know I'd never trust that penetration testing company (they have long since gone out of business, I can't think why).
    • tracker1 9mo ago
      I wish I could recall the name of a pen test company I worked with when I wrote my auth system... They were pretty great and found several serious issues. At least compared to our internal digital security group would couldn't fathom, "your test is wrong for how this app is configured, that path leads to a different app and default behavior" it's not actually a failure... to a canned test for a php exploit. The app wasn't php, it was an SPA and always delivered the same default page unless in the /auth/* route. After that my response became, show me an actual exploit with an actual data leak you can show me and I'll update my code instead of your test.
    • xvxvx 9mo ago
      An older company I worked for went out of their way to find a pen tester that would basically rubberstamp everything and give them a pass. I actually uncovered major issues with the software during that process, to the point where it was unusable. Major components were severely out of date and open to attack. Other parts didn't even work as advertised. I didn't stick around much longer.
  • elevation 9mo ago
    Corporate security is best understood as a marketing function; compliance enables sales even if (especially if) it undermines genuine security.
• refulgentis 9mo ago
  Wish they named them. Usually I don't recommend it. But the combination of: A) in EU; GDPR will trump whatever BS they want to try B) no confirmation affected users were notified C) aggro threats D) nonsensical threats, sourced to Data Privacy Officer w/seemingly 0 scruples and little experience Due to B), there's a strong responsibility rationale. Due to rest, there's a strong name and shame rationale. Sort of equivalent to a bad Yelp review for a restaurant, but for SaaS.
  • mzi 9mo ago
    Dan Europe has a flow as discussed in the article and both the foundation and the regulated insurance branch is registered in Malta.
  • Nextgrid 9mo ago
    EU GDPR has very little enforcement. So while the regulation in theory prevents that, in practice you can just ignore it. If you're lucky a token fine comes up years down the line.
• vaylian 9mo ago
  > Instead, I offered to sign a modified declaration confirming data deletion. I had no interest in retaining anyone’s personal data, but I was not going to agree to silence about the disclosure process itself. Why sign anything at all? The company was obviously not interested in cooperation, but in domination.
  • dwedge 9mo ago
    [flagged]
    • deleted 9mo ago
      [deleted]
    • gchamonlive 9mo ago
      Because you are highjacking a thread. Wanna trash the site's design, you should open a top level thread instead.
      • magicalhippo 9mo ago
        > Wanna trash the site's design, you should open a top level thread instead. Or better, don't[1]: Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. [1]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        • gchamonlive 9mo ago
          Exactly, thanks
        • dwedge 9mo ago
          Being impossible to read is not common
          • magicalhippo 9mo ago
• desireco42 9mo ago
  I think the problem is the process. Each country should have a reporting authority and it should be the one to deal with security issues. So you never report to actual organization but to the security organization, like you did. And they would be more equiped to deal with this, maybe also validate how serious this issue is. Assign a reward as well. So you are researcher, you report your thing and can't be sued or bullied by organization that is offending in the first place.
  • ikmckenz 9mo ago
    That’s almost what we already have with the CVE system, just without the legal protections. You report the vulnerability to the NSA, let them have their fun with it, then a fix is coordinated to be released much further down the line. Personally I don’t think it’s the best idea in the world, and entrenching it further seems like a net negative.
    • desireco42 9mo ago
      Yeah, something like that, nothing too much, just to exclude individual to deal with evil corps
    • ylk 9mo ago
      This is not how CVEs work at all. You can be pretty vague when registering it. In fact they’re usually annoyingly so and some companies are known for copy and pasting random text into the fields that completely lead you astray when trying to patch diff. Additionally, MITRE doesn’t coordinate a release date with you. They can be slow to respond sometimes but in the end you just tell them to set the CVE to public at some date and they’ll do it. You’re also free to publish information on the vulnerability before MITRE assigned a CVE.
  • PaulKeeble 9mo ago
    If the government wasn't so famous for also locking people up that reported security issues I might agree, but boy they are actually worse. Right now the climate in the world is whistleblowers get their careers and livihoods ended. This has been going on for quite a while. The only practical advice is ignore it exists, refuse to ever admit to having found a problem and move on. Leave zero paper trail or evidence. It sucks but its career ending to find these things and report them.
• anonymous908213 9mo ago
  This is an LLM-generated article, for anyone who might wish to save the "15 min read" labelled at the top. Recounts an entirely plausible but possibly completely made up narrative of incompetent IT, and contains no real substance.
  • a3w 9mo ago
    [flagged]
  • circuit10 9mo ago
    How do you know? Some of the text has a slightly LLM-ish flavour to it (e.g. the numbered lists) but other than that I don’t see any solid evidence of that Edit: I looked into it a bit and things seems to check out, this person has scuba diving certifications on their LinkedIn and the site seems real and high-effort. While I also don’t have solid proof that it’s not AI generated either, making accusations like this based on no evidence doesn’t seem good at all
    • thenewnewguy 9mo ago
      Not them but the formatting screams LLM to me. Random "bolding" (rendered on this website as blue text) of phrases, the heading layout, the lists at the end (bullet point followed by bolded text), common repeats of LLM-isms like "A. Not B". None of these alone prove it but combined they provide strong evidence. You can also see the format and pacing differs greatly from posts on their blog made before LLMs were mainstream, e.g. https://dixken.de/blog/monitoring-dremel-digilab-3d45 https://dixken.de/blog/monitoring-dremel-digilab-3d45 While I wouldn't go so far as to say the post is entirely made up (it's possible the underlying story is true) - I would say that it's very likely that OP used an LLM to edit/write the post.
      • nsteel 9mo ago
        Hang on, they used a computer to help them create the post content?! Outrageous.
      • jibal 9mo ago
• viccis 9mo ago
  This is somewhat related, but I know of a fairly popular iOS application for iPads that stores passwords either in plaintext or encrypted (not as digests) because they will email it to you if you click Forgot Password. You also cannot change it. I have no experience with Apple development standards, so I thought I'd ask here if anyone knows whether this is something that should be reported to Apple, if Apple will do anything, or if it's even in violation of any standards?
  • greggsy 9mo ago
    If anything it’s just a violation of industry expectations. You as a consumer just don’t need to use the product.
  • tokyobreakfast 9mo ago
    >whether this is something that should be reported to Apple, if Apple will do anything Lmao Apple will not do anything for actual malware when reported with receipts, besides sending you a form letter assuring you "experts will look into it, now fuck off" then never contact you again. Ask me how I know. To their credit, I suspected they ran it through useless rudimentary automated checks which passed and they were back in business like a day later. If your expectation is they will do something about shitty coding practices half the App Store would be banned.
    • jopsen 9mo ago
      > Apple will not do anything for actual malware when reported with receipts, besides sending you a form letter assuring you "experts will look into it, now fuck off" Ask while you are in an EU country, request appeal and initiate Out-of-court dispute resolution. Or better yet: let the platform suck, and let this be the year of the linux desktop on iPhone :)
  • wizzwizz4 9mo ago
    I used to say "submit it to Plain Text Offenders: https://plaintextoffenders.com/ https://plaintextoffenders.com/", but the site appears defunct since… 2012‽ How time flies…
• projektfu 9mo ago
  Another comment says the situation was fake. I don't know, but to avoid running afoul of the authorities, it's possible to document this without actually accessing user data without permission. In the US, the Computer Fraud and Abuse Act and various state laws are written extremely broadly and were written at a time when most access was either direct dial-up or internal. The meaning of abuse can be twisted to mean rewriting a URL to access the next user, or inputting a user ID that is not authorized to you. Generally speaking, I think case law has avoided shooting the messenger, but if you use your unauthorized access to find PII on minors, you may be setting yourself up for problems, regardless if the goal is merely dramatic effect. You can, instead, document everything and hypothesize the potential risks of the vulnerability without exposing yourself to accusation of wrongdoing. For example, the article talks about registering divers. The author could ask permission from the next diver to attempt to set their password without reading their email, and that would clearly show the vulnerability. No kids "in harm's way".
  • alphazard 9mo ago
    Instead of understanding all of this, and when it does or does not apply, it's probably better to disclose vulnerabilities anonymously over Tor. It's not worth the hassle of being forced to hire a lawyer, just to be a white hat.
    • cptskippy 9mo ago
      Part of the motivation of reporting is clout and reputation. That sounds harsh or critical but for some folks their reputation directly impacts their livelihood. Sure the data controller doesn't care, but if you want to get hired or invited to conferences then the clout matters.
      • esafak 9mo ago
        You could use public-key encryption in your reports to reveal your identity to parties of your choosing.
• kazinator 9mo ago
  > vulnerability in the member portal of a major diving insurer What are the odds an insurer would reach for a lawyer? They probably have several on speed dial.
  • cptskippy 9mo ago
    What makes you think they don't retain them in-house?
    • tracker1 9mo ago
      Depends on the usage... in-house counsel may open up various liabilities of their own, depending on how things present.
      • cptskippy 9mo ago
        Fair point. I'm always fascinated by the conversations I've had with counsel and the perspectives they offer on things.
    • kazinator 9mo ago
      What makes you think you don't need speed dial in-house? ;)
      • cptskippy 9mo ago
        In my experience the in-house lead attorney is usually sitting in the corner of the CEO's office. Seems silly to phone them up. :)
• deleted 9mo ago
  [deleted]
• deleted 9mo ago
  [deleted]
• kazinator 9mo ago
  Why does someone with a .de website insure their diving using some company based in Malta? Based on this interaction, you have wonder what it's like to file a claim with them.
  • som 9mo ago
    Divers Alert Network, which is probably the most well known dive membership (and insurance) org out there is registered in Malta in Europe.
  • ImPostingOnHN 9mo ago
    It is probably among the standard forms required to participate in a diving class/excursion for travelers from other countries; and, Malta was probably chosen as the official HQ for legal or liability shelter reasons.
  • vablings 9mo ago
    Absolutely horrible according to DIVE TALK https://www.youtube.com/watch?v=O7NsjpiPK7o https://www.youtube.com/watch?v=O7NsjpiPK7o Insurance company would not cover a decompression chamber for someone who has severe decompression sickness, it is a life-threatening condition that requires immediate remediation. The idea that you possible neurological DCS and you must argue on the phone with an insurance rep about if you need to be life-flighted to the nearest chamber is just.... Mind blowing
• 0sdi 9mo ago
  Is this Divers Alert Network (DAN) Europe, and it's insurance subsidiary, IDA Insurance Limited?
  • locusofself 9mo ago
    Another commenter basically deduced this
• stevage 9mo ago
  Since the author is apparently afraid to name the organisation in question, it seems the legal threats have worked perfectly.
  • tuhgdetzhh 9mo ago
    If you follow the jurisdictional trail in the post, the field narrows quickly. The author describes a major international diving insurer, an instructor driven student registration workflow, GDPR applicability, and explicit involvement of CSIRT Malta under the Maltese National Coordinated Vulnerability Disclosure Policy. That combination is highly specific. There are only a few globally relevant diving insurers. DAN America is US based. DiveAssure is not Maltese. AquaMed is German. The one large diving insurer that is actually headquartered and registered in Malta is DAN Europe. Given that the organization is described as being registered in Malta and subject to Maltese supervisory processes, DAN Europe becomes the most plausible candidate based on structure and jurisdiction alone.
  • pavel_lishin 9mo ago
    Or maybe in the diving community, "Maltese insurance company for divers" is about as subtle as "Bird-themed social network with blue checkmarks".
    • saxelsen 9mo ago
      There's pretty much only one global insurer affiliated with dive schools, so this is spot on
    • frederikvs 9mo ago
      I'm a diver, DAN is the only company I can name that specialises in diving insurance. Huh, apparently they're registered in Malta, what a coincidence...
      • bpavuk 9mo ago
        checks out with both Perplexity[0] and top Google results [0]: https://www.perplexity.ai/search/maltese-scuba-diving-insurance-QcwZigSySnmtcL_7aASXRA#1 https://www.perplexity.ai/search/maltese-scuba-diving-insura...
• undebuggable 9mo ago
  > the portal used incrementing numeric user IDs > every account was provisioned with a static default password Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.
  • tracker1 9mo ago
    Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day. My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the future. I usually use "v{version}.{salt}.{hash}" where salt and the resulting hash are a base64 string of the salt and result. I could use multiple db fields for the same, but would rather not... I could also use JSON or some other wrapper, but feel the dot-separated base64 is good enough. I have had instances where hashing was indeed upgraded later, and a password was (re)hashed at login with the new encoding if the version changed... after a given time-frame, will notify users and wipe old passwords to require recovery process. FWIW, I really wish there were better guides for moderately good implementations of login/auth systems out there. Too many applications for things like SSO, etc just become a morass of complexity that isn't always necesssary. I did write a nice system for a former employer that is somewhat widely deployed... I tried to get permission to open-source it, but couldn't get buy in over "security concerns" (the irony). Maybe someday I'll make another one.
    • chuckadams 9mo ago
      Several web frameworks, including Rails, Laravel, and Symfony, will automatically upgrade password hashes if the algorithm or work factor has changed since the password was last hashed.
    • alright2565 9mo ago
      If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm. For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field: import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}") print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}") MD5: 5f4dcc3b5aa765d61d8327deb882cf99 SHA-256: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 But if you use a proper password hash, then your hashing library will automatically take care of versioning your hash, and you can just treat it as an opaque blob: import argon2; print(f"Argon2: {argon2.PasswordHasher().hash('password')}") import bcrypt; print(f"bcrypt: {bcrypt.hashpw(b'password', bcrypt.gensalt()).decode()}") from passlib.hash import scrypt; print(f"scrypt: {scrypt.hash('password')}") Argon2: $argon2id$v=19$m=65536,t=3,p=4$LZ/H9PWV2UV3YTgF3Ixrig$aXEtfkmdCMXX46a0ZiE0XjKABfJSgCHA4HmtlJzautU bcrypt: $2b$12$xqsibRw1wikgk9qhce0CGO9G7k7j2nfpxCmmasmUoGX4Rt0B5umuG scrypt: $scrypt$ln=16,r=8,p=1$/V8rpRTCmDOGcA5hjPFeCw$6N1e9QmxuwqbPJb4NjpGib5FxxILGoXmUX90lCXKXD4 This isn't a new thing, and as far as I'm aware, it's derived from the old apache htpasswd format (although no one else uses the leading colon) $ htpasswd -bnBC 10 "" password :$2y$10$Bh67PQAd4rqAkbFraTKZ/egfHdN392tyQ3I1U6VnjZhLoQLD3YzRe
• cptskippy 9mo ago
  Maintaining Cybersecurity Insurance is a big deal in the US, I don't know about Europe. So vulnerability disclosure is problematic for data controllers because it threatens their insurance and premiums. Today much of enterprise security is attestation based and vulnerability disclosure potentially exposes companies to insurance fraud. If they stated that they maintained certain levels of security, and a disclosure demonstratively proves they do not, that is grounds for dropping a policy or even a lawsuit to reclaim paid funds. So it sort of makes sense that companies would go on the attack because there's a risk that their insurance company will catch wind and they'll be on the hook.
  • pixl97 9mo ago
    Heh, what insurance company you use should be public information, and bug finders should report to them.
    • cptskippy 9mo ago
      I wonder what that might reveal. Often decisions are made at the direction of the board of directors. I have to imagine they would be opposed to such disclosures as it might shine poorly on them.
  • lucb1e 9mo ago
    It's not generally good financial advice to pay the overhead of an insurance company for costs you can easily pay yourself (also things like phone insurance, appliance warranty extensions, etc. won't make your device last longer and the insurer knows better than you what premium covers the average repair costs plus a profit margin). If you have a decent understanding of where the line is between vulnerability disclosure and criminal activities, fronting any court fees and a little bit of lawyer time (iff you can afford these out of pocket) until you're acquitted should be the better route, assuming anyone even ever takes you to court
    • cptskippy 9mo ago
      > It's not generally good financial advice to pay the overhead of an insurance company for costs you can easily pay yourself For a lot of companies, a lawsuit would be the end of them even if it's not financial ruin. Often times the decision to purchase insurance isn't made by the CEO but rather by the board of directors. Board directives are often why you see companies adopting or trending towards certain activities that don't necessarily make sense. They might be at the benefit of a member of the board or one of the other companies they chair.
• FurryEnjoyer 9mo ago
  Malta has been mentioned? As a person living here I could say that workflow of the government here is bad. Same as in every other place I guess. By the way, I had a story when I accidentally hacked an online portal in our school. It didn't go much and I was "caught" but anyways. This is how we learn to be more careful. I believe in every single system like that it's fairly possible to find a vulnerability. Nobody cares about them and people that make those systems don't have enough skill to do it right. Data is going to be leaked. That's the unfortunate truth. It gets worse with the come of AI. Since it has zero understanding of what it is actually it will make mistakes that would cause more data leaks. Even if you don't consider yourself as an evil person, would you still stay the same knowing real security vulnerability? Who knows. Some might take advantage. Some won't and still be punished for doing everything as the "textbook way".
  • lucb1e 9mo ago
    Being more careful is an option, or owning up to it and saying "hey I just did this and noticed this thing unexpectedly happened, apparently you have an XSS here" (or whatever it was). In most cases, the organization you're reporting to is happy about this up-front information, and in the exceptional situation where someone decides to take it to court, there's a clear paper trail (backed up by access and email logs) of what actions were taken and why, making it obvious you did nothing wrong
• cynicalsecurity 9mo ago
  [flagged]
  • kspacewalk2 9mo ago
    Not sure what the name of your complex is, maybe groveling deference to legalese? Whatever it is, I'm sure I would have applied it to your entire country of origin if I knew where you're from, and if I were developmentally around the age of twelve. He did everything exactly by the book and in the end was even nice enough to not publish the company's name, despite the legal threat being bullshit and him being entirely in the right.
• clarabennett26 9mo ago
  [dead]
• aicodereview42 9mo ago
  [dead]
• josefritzishere 9mo ago
  I find these tales of lawyerly threats completley validate the hackers actions. They reported the bug to spur the company to resolve it. Their reaction all but confirms that reporting it to them directly would not have been productive. Their management lacks good stewardship. They are not thinking about their responsibility to their customers and employees.
• paxys 9mo ago
  When you are acting in good faith and the person/organization on the other end isn't, you aren't having a productive discussion or negotiation, just wasting your own time. The only sensible approach here would have been to cease all correspondence after their very first email/threat. The nation of Malta would survive just fine without you looking out for them and their online security.
  • czbond 9mo ago
    Agree - yet, security researchers and our wider community also needs to recognize that vulnerabilities are foreign to most non-technical users. Cold approach vulnerability reports to non-technical organizations quite frankly scare them. It might be like someone you've never met telling you the door on your back bedroom balcony can be opened with a dummy key, and they know because they tried it. Such organizations don't kmow what to do. They're scared, thinking maybe someone also took financial information, etc. Internal strife and lots of discussions usually occur with lots of wild specualation (as the norm) before any communication back occurs. It just isn't the same as what security forward organizations do, so it often becomes as a surprise to engineers when "good deed" seems to be taken as malice.
    • jcynix 9mo ago
      > Such organizations don't know what to do. Maybe they should simply use some common sense? If someone could and would steal valuables, it seems highly unlikely that he/she/it would notify you before doing it. If they would want to extort you, they would possibly do so early on. And maybe encrypt some data as a "proof of concept" ... But some organizations seem to think that their lawyers will remedy every failure and that's enough.
      • lucb1e 9mo ago
        > If someone could and would steal valuables, it seems highly unlikely that he/she/it would notify you before doing it. after* doing it. Though I agree with your general point Note the parts in the email to the organization where OP (1) mentions they found underage students among the unsecured accounts and (2) attaches a script that dumps the database, ready to go¹. It takes very little to see in access logs that they accessed records that they weren't authorized to, which makes it hard to distinguish their actions from malicious ones I do agree that if the org had done a cursory web search, they'd have found that everything OP did (besides dumping more than one record from the database) is standard practice and that responsible disclosure is an established practice that criminals obviously wouldn't use. That OP subsequently agrees to sign a removal agreement, besides the lack of any extortion, is a further sign of good faith which the org should have taken them up on ¹ though very inefficiently, but the data protection officer that they were in touch with (note: not a lawyer) wouldn't know that and the IT person that advises them might not feel the need to mention it
• janalsncm 9mo ago
  Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk. 3) Random audits by passers-by is way too haphazard. If a website can require my real PII, I should be able to require that PII is secure. I’m not sure what the full list of industries would be, but insurance companies should be categorically required to have an cyber audit, and laws those same laws should protect white hats from lawyers and allow class actions from all users. That would change the incentives so that the most basic vulnerabilities are gone, and software engineers become more economical than lawyers.
  • psadauskas 9mo ago
    Regarding your 2), in other industries and engineering professions, the architect (or civil engineer, or electrical engineer) who signed off carries insurance, and often is licensed by the state. I absolutely do not want to gatekeep beginners from being able to publish their work on the open internet, but I often wonder if we should require some sort of certification and insurance for large businesses sites that handle personal info or money. There'd be a Certified Professional Software Engineer that has to sign off on it, and thus maybe has the clout to push back on being forced to implement whatever dumb idea an MBA has to drive engagement or short-term sales. Maybe. Its not like its worked very well lately for Boeing or Volkswagen.
    • Onavo 9mo ago
      Oh there have been many cases where software engineers who are not professional engineers with the engineering mafia designation get sidelined by authorities for lacking standing. We absolutely should get rid of the engineering mafias and unions. https://ij.org/press-release/oregon-engineer-makes-history-with-new-traffic-light-timing-formula/ https://ij.org/press-release/oregon-engineer-makes-history-w...
    • henryfjordan 9mo ago
• estebarb 9mo ago
  If this was in Costa Rica the appropiate way was to contact PRODHAB about the leak of personal information and Costa Rica CSIRT ( csirt@micitt.go.cr ). Here all databases with personal information must be registered there and data must be secure.
  • Aurornis 9mo ago
    > If this was in Costa Rica the appropiate way was to contact PRODHAB about the leak of personal information and Costa Rica CSIRT ( csirt@micitt.go.cr ). They did. It's in the article. Search for 'CSIRT'. It's one of the key points of the story.
    • estebarb 9mo ago
      They reached Malta CSIRT. Costa Rica and Malta are totally different countries.
• Buttons840 9mo ago
  I've said before that we need strong legal protections for white-hat and even grey-hat security researchers or hackers. As long as they report what they have found and follow certain rules, they need to be protected from any prosecution or legal consequences. We need to give them the benefit of the doubt. The problem is this is literally a matter of national security, and currently we sacrifice national security for the convenience of wealthy companies. Also, we all have our private data leaked multiple times per month. We see millions of people having their private information leaked by these companies, and there are zero consequences. Currently, the companies say, "Well, it's our code, it's our responsibility; nobody is allowed to research or test the security of our code because it is our code and it is our responsibility." But then, when they leak the entire nation's private data, it's no longer their responsibility. They're not liable. As security issues continue to become a bigger and bigger societal problem, remember that we are choosing to hamstring our security researchers. We can make a different choice and decide we want to utilize our security researchers instead, for the benefit of all and for better national security. It might cause some embarrassment for companies though, so I'm not holding my breath.
  • krisoft 9mo ago
    > we need strong legal protections for white-hat and even grey-hat security researchers or hackers. I have a radical idea which goes even further: we should have legaly mandated bug bounties. A law which says that if someone makes a proper disclosure of an actual exploitable security problem then your company has to pay out. Ideally we could scale the payout based on the importance of the infrastructure in question. Vulnerabilities with little lasting consequence would pay little. Serious vulnerabilities with potential to society wide physical harm could pay out a few percents of the yearly revenue of the given company. For example hacking the high score in a game would pay only little, a vulnerability which can collapse the electric grid or remotely command a car would pay a king’s ransom. Enough to incentivise a cottage industry to find problems. Hopefully resulting in a situation where the companies in question find it more profitable to find and fix the problems themselves. I’m sure there is a potential to a lot of unintended consequences. For example i’m not sure how could we handle insider threats. One one hand insider threats are real and the companies should be protecting against them as best as they could. On the other hand it would be perverse to force companies to pay developers for vulnerabilities the developers themselves intentionally created.
• hbrav 9mo ago
  This is extremely disappointing. The insurer in question has a very good reputation within the dive community for acting in good faith and for providing medical information free of charge to non-members. This sounds like a cultural mismatch with their lawyers. Which is ironic, since the lawyers in question probably thought of themselves as being risk-averse and doing everything possible to protect the organisation's reputation.
  • dekhn 9mo ago
    I find often that conversations between lawyers and engineers are just two very different minded people talking past each other. I'm an engineer, and once I spent more time understanding lawyers, what they do, and how they do it, my ability to get them to do something increased tremendously. It's like programming in an extremely quirky programming language running on a very broken system that requires a ton of money to stay up.
    • BlueGreenMagick 9mo ago
      I'm curious to hear your take on the situation in the article. Based on your experience, do you think there are specific ways the author could have communicated differently to elicit a better response from the lawyers?
      • dekhn 9mo ago
        It would take a bit of time to re-read the entire chain and come up with highly specific ways. The way I read the exchange, the lawyer basically wants the programmer to shut up and not disclose the vulnerability, and is using threatening legal language. While the programmer sees themself as a responsible person doing the company a favor in a principled way. Some things I can see. I think the way the programmer worded this sounds adversarial; I wouldn't have written it that way, but ultimately, there is nothing wrong with it: "I am offering a window of 30 days from today the 28th of April 2025 for [the organization] to mitigate or resolve the vulnerability before I consider any public disclosure." When the lawyer sent the NDA with extra steps: the programmer could have chosen to hire a lawyer at this point to get advice. Or they could ignore this entirely (with the risk that the lawyer may sue him?), or proceed to negotiate terms, which the programmer did (offering a different document to sign). IIUC, at that point, the lawyer went away and it's likely they will never contact this guy again, unless he discloses their name publicly and trashes their security, at which point the lawyer might sue for defamation, etc. Anyway, my take is that as soon as the programmer got a lawyer email reply (instead of the "CTO thanking him for responsible disclosure"), he should have talked to his own lawyer for advice. When I have situations similar to this, I use the lawyer as a sounding board. i ask questions like "What is the lawyer trying to get me to do here?" and "Why are they threatening me instead of thanking me", and "What would happen if I respond in this way". Depending on what I learned from my lawyer I can take a number actions. For example, completely ignoring the company lawyer might be a good course of action. The company doesn't want to bring somebody to court then have everybody read in a newspaper that the company had shitty security. Or writing a carefully written threatening letter- "if you sue me, I'll countersue, and in discovery, you will look bad and lose". Or- and this is one of my favorite tricks, rewriting the document to what I wanted, signing that, sending it back to them. Again, for all of those, I'd talk to a lawyer and listen to their perspective carefully.
• durzo22 9mo ago
  [flagged]
• snowhale 9mo ago
  [dead]
  • pixl97 9mo ago
    Reply: "sorry, before reaching out to you I already notified a major media organization with a 90 day release notice"
    • lucb1e 9mo ago
      In case someone takes this as actual advice, I think this comment is best accompanied with a warning that this gets them to call a lawyer for sure ^^' (OP mentions a lawyer in the title, but the post only speaks of a data protection officer, which is a very different role and doesn't even represent the organization's interests but, instead, the users', at least under GDPR where I'm from)
  • zero_shift 9mo ago
    Typical shakedown tactic. I used to have a boss who would issue these ridiculous emails with lines like "you agree to respond within 24 hours else you forfeit (blah blah blah)"
• Hnrobert42 9mo ago
  I use a different email address for every service. About 15 years ago, I began getting spam at my diversalertnetwork email address. I emailed DAN to tell them they'd been breached. They responded with an email telling me how to change my password. I guess I should feel lucky they didn't try to have me criminally prosecuted.
  • ipaddr 9mo ago
    That could be a hack or something the company sold to a third party.
    • mihaaly 9mo ago
      During a property search for rentals in the UK I created a throwaway alias email (to my regular account) as I did not really trust them with my data. This was not for those requiring me to provide credit check papers and name of children (!! yes, you read it right, name of children!) at the very first contact in their web form just to start conversation about if there is viewing ability or not, and then perhaps schedule one. No. Those were avoided completely (despite the desperate property market for renters, I am not that desperate: eventually we left the UK in a big part because of property troubles). Two of those were reported to the relevant authority (one case got confirmed after several months, but still pending after more than a year. The other sank, apparently. My trust in the UK institutions is not elevated). There were more than two requiring full set of data on the prospective viewing candidate. The throwaway email was for the ""reliable"" ones. The trusted names. Or those without over-reaching data collection (one big name, Cheffin, one of the reported one, had over-reaching habit). Having a throwaway alias proved benefitial. From zero spam to my email suddenly spam started to arrive with about 4 / week frequency. Kept coming until the alias got disabled. Cannot tell which was the culprit, only have a shortlist based on timing. But that never ever elsewhere used email somehow got to fraudster elements from the few UK property agent organizations I contacted. In very shor time (few weeks).
      • derelicta 9mo ago
        The absolute hell that is looking for a place to live in the UK. I remember having to submit a copy of my passport to one of those letting agencies. I don't even know how they process it and how it is stored, but I am convinced it's just stored on some random personal OneDrive at this point.
• deleted 9mo ago
  [deleted]
• general1465 9mo ago
  One way how to improve cybersecurity is let cyber criminals loose like predators hunting prey. Companies needs to feel fear that any vulnerability in their systems is going to be weaponized against them. Only then they will appreciate an email telling them about security issue which has not been exploited yet.
  • _kst_ 9mo ago
    Like re-introducing wolves into Yellowstone.
  • kjs3 9mo ago
    One way how to improve cybersecurity is let cyber criminals loose like predators hunting prey. Who, exactly, is holding them back now?
• MrQuincle 9mo ago
  There should exist a vulnerability disclosure intermediary. They can function as a barrier to protect the scientist/researcher/enthousiast and do everything by the book for the different countries.
  • esafak 9mo ago
    Who compensates them for the risk?
    • pixl97 9mo ago
      That's why you just sell it on the black market and let it be the intermediary.
      • nickorlow 9mo ago
        The free market at work!
    • lucb1e 9mo ago
      What risk? It sounds to me like the worst they could get is a subpoena to produce the identity of the reporter Besides, it's usually governmental organizations that do this sort of thing
      • esafak 9mo ago
        The risk of lawsuits like the ones threatened to be filed against this researcher.
        • lucb1e 9mo ago
          They can also sue the pope but I don't think the pope finds that a risk worth considering either when they didn't do any hacking, legal or otherwise. How would an organization get sued for hacking when they didn't do any hacking and are merely passing on a message?
• n_u 9mo ago
  > The security research community has been dealing with this pattern for decades: find a vulnerability, report it responsibly, get threatened with legal action. It's so common it has a name - the chilling effect. Governments and companies talk a big game about how important cybersecurity is. I'd like to see some legislation to prevent companies and governments [1] behaving with unwarranted hostility to security researchers who are helping them. [1] https://news.ycombinator.com/item?id=46814614 https://news.ycombinator.com/item?id=46814614
  • jeroenhd 9mo ago
    I'm not a lawyer, but I believe the EU's Cyber Resilience Act combined with the NIS2 Directive do task governments with setting up bodies to collaborate with security researchers and help deal with reports. The law seems written to target vendors and products rather than services though, reading through this: https://www.acigjournal.com/Vulnerability-Coordination-under-the-Cyber-Resilience-Act,213350,0,2.html https://www.acigjournal.com/Vulnerability-Coordination-under...
• nilslindemann 9mo ago
  AFAIK, what this dude did - running a script which tries every password and actually accessing personal data of other people – is illegal in Germany. The reasoning is, just because a door of a car which is not yours is open you have no right to sit inside and start the motor. Even if you just want to honk the horn to inform the guy that he has left the door open. https://www.nilsbecker.de/rechtliche-grauzonen-fuer-ethische-hacker-und-unternehmen-it-sicherheitsluecken-richtig-melden/ https://www.nilsbecker.de/rechtliche-grauzonen-fuer-ethische...
  • vaylian 9mo ago
    > is illegal in Germany Germany is not exactly well-known for having reasonable IT security laws
    • jeroenhd 9mo ago
      It's not necessarily just Germany. Lots of countries have laws that basically say "you cannot log in to systems that you (should) know you're not allowed to". Technical details such as "how difficult is the password to guess" and "how badly designed is the system at play" may be used in court to argue for or against the severity of the crime, but hacking people in general is pretty damn illegal. He also didn't need to run the script to try more than one or maybe two accounts to verify the problem. He dumped more database than he needed to and that's something the law doesn't particularly like. People don't like it when they find a well-intentioned lock specialist standing in their living room explaining they need better locks. Plenty of laws apply the same logic to digital "locksmiths". In reality, it's pretty improbable in most places for the police to bother with reports like these. There have been cases in Hungary where prestigious public projects and national operations were full of security holes with the researchers sued as a result, but that's closer to politics than it is to normal police operations.
      • hunterpayne 9mo ago
        And people wonder how the US can just turn off the electric grid of another country on demand...with laws like these, I expect there are local 6 year olds who can do the same.
• tverbeure 9mo ago
  > No ..., no ..., no .... Just ... Am I the only one who can't stand this AI slop pattern?
  • silisili 9mo ago
    Between that and 'Read that again' my heart kinda sank as I went. When if ever will this awful trend end?
  • lucb1e 9mo ago
    It's one thing for your blog post to be full of faux writing style, but also that letter to the organization... oof. I wouldn't enjoy receiving that from someone who attached a script that dumps all users from my database and the email, as well as my access logs, confirm they ran it
• dboreham 9mo ago
  Messenger shooting is a common tactic with psychopaths.
• socketcluster 9mo ago
  I found a vulnerability recently in a major online platform through HackerOne which could allow an attacker to cheaply DoS the service. I wrote up a detailed report (by hand) showing exactly how to reproduce and even explained exactly how a specially crafted request to a critical service took 10 seconds to get a response (just with a very simple, easy to reproduce example)... I then explained exactly how this vector could be scaled up to a DDoS... They acknowledged it as a legitimate issue and marked my issue as 'useful info' but refused to pay me anything; they said that they would only pay if I physically demonstrate that it leads to a disruption of service; basically baiting me into doing something illegal! It was obvious from my description that this attack could easily be scaled up. I wasn't prepared to literally bring down the service to make my point. They didn't even offer the lowest tier of $200. So bad. AI slop code is taking over the industry, vulnerabilities are popping up all over the place, so much so that companies are refusing to pay out bounties to humans. It's like neglect is being rewarded and diligence is being punished. Then you read about how small the bug bounties are, even for established security researchers. It doesn't seem like a great industry. HackerOne seems like a honeypot to waste hackers' time. They reward a tiny number of hackers with big payouts to create PR to waste as many hackers' time as possible. Probably setting them up and collecting dirt on them behind the scenes. That's what it feels like at least.
  • lucb1e 9mo ago
    This is sort of my issue with bug bounty programs: it can easily start to feel like extortion when a 'good samaritan' demands money. But they promised it to you by having a bug bounty program, then denied it. You feel rightfully cheated when the bug is legitimate, and doubly so when they acknowledge it. But demanding the money feels weird as well. I try to go into these things with zero expectations. Having a mediating party involved from the start is a bit like OP immediately CC'ing the CERT: extra legal steps in the disclosure process. Mediating parties are usually a pain to work with, and if it's deemed "out of scope" then they typically refuse to even notify the vulnerable party (or acknowledge to you that it hasn't been disclosed). I don't want a pay day, I just want them to fix their damn bug, but there's no way to report it besides through this middle person. Literally every time I've had to use a reporting procedure (like HackerOne) has resulted in tone-deaf responses from the company or complete gatekeeping. All of those bugs exist to this day. Every time I can email a human directly, it gets fixed, and in some occasions they send a thank-you like some swag and chocolates, a t-shirt, something Based on what I hear in the community, my HackerOne experiences have been outliers, but it might still be more effective (if you're not looking to collect bounty money) to talk to organizations directly where possible and avoid the ones that use HackerOne or another mediation party
• kube-system 9mo ago
  I suspect that the direction of these situations often depends on how your initial email is routed internally in these organizations. If they go to a lawyer first, you will get someone who tries to fix things with the application of the law. If it goes to an engineer first, you will get someone who tries to fix it with an application of engineering. If it were me, I would have avoided involving third party regulators in the initial contact at least.
  • lucb1e 9mo ago
    Yes, this routing is common. German energy company recommended by a climate organization had a somewhat similar vulnerability and no security contact, so I call them up and.. mhm, yes, okay, is that l-e-g-a-l-@-company-dot-de? You don't want me to just send it to the IT department that can fix it? Okay I see, they will put it through, yes, thank you, bye for now! Was a bit of a "oh god what am I getting into again" moment (also considering I don't speak legal-level German), but I knew they had nothing to stand on if they did file a complaint or court case so I followed through and they just thanked me for the report in the end and fixed it reasonably promptly. No stickers or maybe a discount as a customer, but oh well, no lawsuit either :)
    • Tempest1981 9mo ago
      In the early internet days, you could email root@company.com about a website bug, and somebody might reply.
  • themanmaran 9mo ago
    > If it were me, I would have avoided involving third party regulators in the initial contact at least. I'm surprised to see this take only mentioned once in this thread. I think people here are not aware of the sheer amount of fraud in the "bug bounty" space. As soon as you have a public product you get at least 1 of these attempts per week of someone trying to shake you down for a disclosure that they'll disclose after you pay them something. Typically you just report them as spam and move on. But if I got one that had some credible evidence of them reporting me to a government agency already, I'd immediately get a lawyer to send a cease and desist. It seems like OP was trying to be a by the book law abiding citizen, but the sheer amount of fraud in this space makes it really hard to tell the difference from a cold email.
• deleted 9mo ago
  [deleted]
• andrelaszlo 9mo ago
  Last year I found a vulnerability in a large annual event's ticket system, allowing me to download tickets from other users. I had bought a ticket, which arrived as a link by email. The URL was something like example.com/tickets/[string] The string was just the order number in base 64. The order number was, of course, sequential. I emailed the organizer and the company that built the order system. They immediately fixed it... Just kidding. It's still wide open and I didn't hear anything from them. I'm waiting for this year's edition. Maybe they'll have fixed it.
  • master-lincoln 9mo ago
    And you are not worried enough about other users that you reported the compsny or at least name them here?
• atlgator 9mo ago
  Incrementing user IDs and a default password for everyone — so the real vulnerability was assuming the company had any security to disclose to in the first place. At this point 'responsible disclosure' just means 'giving a company a head start on hiring a lawyer before you go public.'
• newzino 9mo ago
  [flagged]
• nubg 9mo ago
  > No exploits, no buffer overflows, no zero-days. Just a login form, a number, and a default password that was set for each student on creation. ai;dr This is AI slop. Use your own words! I would rather read the original prompt!
  • lucb1e 9mo ago
    Also in the email towards the organization. Makes it sound as condescending "let me dumb it down for you to key points" to the receiver of the email as, well, as LLMs are. Bit off-putting and the story itself is also common to the point of trite. Heck, nothing even ended up happening in this case. No lawyer is mentioned outside of the title, no police complaint was filed, no civil case started, just the three emails saying he should agree to not talk about this. Scary as those demands can be (I have been at the butt end of such things as well, and every time I wish I had used Tor instead of a CIOT-traceable IP address as soon as my "huh, that's odd system behavior"-senses go off. Responsible disclosure just gives you grey hairs in the 10% of cases that respond like this, even if so far 0% actually filed a police complaint or court case)
  • kmoser 9mo ago
    Presuming nobody had found this exploit previously, it actually is a zero-day.
  • bonoboTP 9mo ago
    So strange that I have to scroll this far to find mention of AI writing. It's clearly AI, but apparently now even tech people get fooled not just boomers on Facebook. They don't name the company and the whole story is just way too perfect, and cookie cutter... If you're a human reading this, consider that the comments here may also be AI. Dead Internet and all..
  • BoredomIsFun 9mo ago
    A performative display of performative anti-AI purism.
  • GreenWatermelon 9mo ago
    This garbage actually got over 900 upvotes. Crazy. I already suspected it was AI written based in the super-cringe title, and a cursory look at the content confirmed my suspicion. Cookie-cutter basic ai writing as it gets.
• unyttigfjelltol 9mo ago
  Contacting the authorities led the company to hire lawyers— for communication with the data protection authority. The lever lawyers have to “make it go away” is “law says so.” They’re not going to beg for mercy, they’re not going to invite you to coffee, no “bug bounty.” From their perspective if they arm-wrestle the researcher into an NDA, they patched the only known breach, retrospectively. Perhaps it’s not prosocial or best practice, but you can clearly see how this went down from the company perspective, with a subject organization that has a tenuous grasp of cyber security concepts.
  • zaptheimpaler 9mo ago
    I think we should stop making excuses for shitty practices. I can understand why they might do it, i can also see there are much better ways to deal with this situation.
• anal_reactor 9mo ago
  Unless the company has a bug-bounty program, never ever tell them about vulnerabilities. You'll get ignored at best and have legal issues at worst. Instead, sell them on the black market. Or better yet, just give away for free if you don't care about money. That's how companies will eventually learn to at least have official vulnerability disclosure policy.
• deleted 9mo ago
  [deleted]
• zx8080 9mo ago
  Share the portal name! We want to know the ~f...~ ”heroes”!
• kopirgan 9mo ago
  Wow this more like in US. Didn't know Malta is so lawyered.
• b8 9mo ago
  Sounds like they were bluffing and trying to coerce the researcher in to signing an NDA. I wouldn't of signed and they wouldn't have reach in the US and presumably Germany where the researched is based. Also, I'm glad the affected vendor isn't DAN.
• f30e3dfed1c9 9mo ago
  Not clear to me why the author thinks he's the good guy in this scenario. His letter to the company might as well read "I am a busybody who downloaded private information about a person who is not me from your web site, ENTIRELY WITHOUT AUTHORIZATION from that person. Here, let me show it to you." Why does he think he's entitled to do this? I get that his intentions are more or less good but don't see that as much excuse. What did he expect them to say? "Oh thank you wise and wonderful full-time Linux Platform Engineer"? I appreciate that the web site in question seems to have absolutely pathetic security practices. Good reason not to do business with them. Not a good reason to do something that, in many jurisdictions at least, sounds like it constitutes a crime.
• cryptonector 9mo ago
  Hey TFA, other people have gone to prison for finding monotonic user/account IDs and _testing_ their hunch to see if it's true. See, doing that puts you at great risk of violating the CFAA. Basically, the moment you knew they were allocating account IDs monotonically and with a default password was the moment you had a vulnerability that you could report without fear of prosecution, but the moment you tested that vulnerability is the moment you may have broken the law. Writing about it is essentially confessing. You need a lawyer, and a good one. And you need to read about these things.
  • dented42 9mo ago
    That feels fundamentally broken. How can you expect an organisation to respond appropriately if you don’t provide them any kind of proof?
    • Faark 9mo ago
      He had enough proof, his own students, who assumingly agreed. And in case the company still pretends there is no problem you could still crawl their entire user base...
  • bdavbdav 9mo ago
    Would a better course of action here have been for him to generate a “test test” account under his?
    • Alive-in-2025 9mo ago
      they you could kick him out of the org for "creating a bogus account" - "our company isn't bad, you're the bad actor". The bad company he was try get to fix their thing didn't behave properly, end of story. This happens over and over again because for so many companies their natural thing is to hid any problem and threaten to sue anyone who discloses. Software problems have broken that typical behavior, to some extent. I salute the author of this post who dared to do the right thing. I hope the company comes to their senses and doesn't try to punish the diving instructor. Over and over companies have tried this same "attack the problem reporter" strategy when software problems are revealed.
• Mustafabei 9mo ago
  I am a lawyer and my field do cross this area which the events have transpired. First, yes, everyone should acknowledge that this matter has been handled poorly by their corporate in-house and external lawyers. These should not have happened. The company should face consequences. I advise my data controller corporate clients to reach out to the reporter/whistleblower immediately and have the IT team collaborate, at the very least talk to the person to effectively replicate the exploit so it can be thoroughly fixed. There should even be procedures on how this should be handled. I understand from the article that this is not how it's so done. However, I feel obligated to note some different aspects, all of which are absolutely not intended to condone how this company handled the situation. I want to re-iterate; they should have handled it better. Things to note; 1. They might have already reached out to the data privacy board. The data privacy boards, especially in Europe are very involved in the reporting procedures and in my experience, their experts are very reluctant about public disclosures if the breach/data leak is caused by an exploit. They (sometimes rightfully) do not trust to the private sector's biased explanation that this vulnerabililty has been "fixed" and sometimes effectively prevent public disclosures about the event, allowing only the affected data subjects to be informed about the event. The potential danger of re-exploitation and protection of the public far outweighs the public's (that is persons who are not affected by this breach) right to be informed of such event. Affected persons should be notified. You might not have been aware that these happened. It is their legal obligation to notify the affected data subjects but it is not their legal obligation to notify the reporter that the notifications to the data subjects are made. 2. You did the right thing reaching out to the company and upon some radio silence, contacting the competent authority. But sadly, your duties as a citizen end there. You played your part and did all you could have done if not more. Contacting the company again was not really required. If you found yourself losing sleep, you could have re-contacted the authorities with a data subject request or a right to be informed request. They are legally obligated (under GDPR) to respond to you. 3. Sadly, your e-mail, especially the line below is actually a threat that is actionable under many EU juristictions; I am offering a window of 30 days from today the 28th of April 2025 for [the organization] to mitigate or resolve the vulnerability before I consider any public disclosure. You cannot disclose this to public. Even with good intentions. This might enable the exploit to actually be exploited by ill-faithed persons and would cause more damage. The company is responsible for this vulnerability and they should face counsequences for their actions or the lack thereof, but going public about an exploit is absolutely ill-advised, even if this is intended to coerce the company into action. Nevertheless, I wanted to re-iterate that this is not intended to condone the company's behaviors in any way. You did the right thing warning them and the authorities but further action might have caused more damage. It is always best to attend to this situations with the guidance of a data privacy legal consultant.
• chris_wot 9mo ago
  What’s the bet this was Divers Alert Network (DAN) that did this. There aren’t a huge number of insurance companies who insure diving students in Malta.
• rurban 9mo ago
  Of course he got a response by a lawyer. He shouldn't have hacked the whole site, that's highly illegal, and usually the police is coming knocking, not just a lawyer. Such a morally bankrupt weirdo
  • ahme 9mo ago
    Rage bait.
    • bonoboTP 9mo ago
      The rage bait is the cookie cutter made up story with zero concrete info on the company (disclosure?!) and AI generated writing.
• deleted 9mo ago
  [deleted]
• dwardu 9mo ago
  Companies in Malta have to report these things to the police. Some university of malta student found a vulnerability in some software and they got instantly referred to the police rather than being tracked when they reported the issue. Companies are doing their best to not reward people who diligently inform them about vulnerabilities.
• stodor89 9mo ago
  > I am offering a window of 30 days from today the 28th of April 2025 for [the organization] to mitigate or resolve the vulnerability before I consider any public disclosure. Well, you started friendly but then made illegal threats. So they responded friendly but then sent you lawyers.
• penyaev 9mo ago
  I truly don’t understand why you decided to take the stance of setting them deadlines and disclosing the vulnerability if they miss them. I understand you had good intentions, but I also can see how this can look like unnecessary escalation and even like blackmail to someone outside the industry, like an insurance manager or a lawyer. I agree that disclosing a vulnerability in a major web browser or in a protocol makes sense because it’s in the interests of the humanity to fix it asap. But a random insurance firm? Dude, you’re talking to them as if they were Google. If you really care about them and wish them good (which I believe you do!) you should’ve just left out the deadlines and disclosure part and I don’t think cc’ing the national agency was that necessary given the scale of the problem. Maybe should’ve just given them a call and have had a friendly chat over the phone. You would’ve helped them and stayed friends.
  • krater23 9mo ago
    Nope, this just didn't works either.
    • fried-gluttony 9mo ago
      That's an assumption - maybe backed by experience, but still. The professional way would be to slowly escalate. Tell them nice and friendly. Wait a bit. Increase pressure bit by bit. You also don't directly shout at anyone making a mistake - at least not the first time.
  • DrSiemer 9mo ago
    Adding a deadline to a disclosure of a vulnerability of this nature is standard practice. Every day it's not patched is a day data could be compromised. Any halfway competent lawyer should be fully aware of this. Disclosure without a deadline WILL be ignored. It does not matter if it's Google or your local boyscouts club, any organization requiring users to provide information that can be abused in the wrong hands takes on a responsibility to handle such data responsibly.
  • UqWBcuFx6NV4r 9mo ago
    This is standard practice. Typical HN behaviour to drive by with quite evidently zero relevant background and self-righteously preach for three paragraphs about something that you don’t understand. This industry sucks.
• krater23 9mo ago
  Fuck you! Name the company! They shall burn!
• BrandoElFollito 9mo ago
  You typically disclose the vulnerability for one of these reasons: you want money, you want fame, you want to make a better world. There are others such as blackmail but let's settle for the typical ones. If you do it for money or fame, you step cautiously not to annoy the company. You ask, you beg, etc. Not something to be proud of but this is life. If you do this to make the world a better place, you get annoying. You explain the risks, possibly how to fix it and then send a few reminders with the threat of making it public. Depending on where you are this may be a danger for you or not (though you would usually go anonymous in that case). OP did the right thing. Without setting deadlines, a company will ignore it. Or not - but in that case they will not be offended by the deadline and would discuss with the reporter (by agreeing on mitigation if a complete fix cannot be done easily). There used to be a time when companies cared because it was an uncommon event. Today you get 3 "We are so sorry" emails a week, so one more or one less make it less stressful to have public disclosures or data leaks. There is simply no accountability.
  • ddtaylor 9mo ago
    Full disclosure is responsible disclosure. Companies can't hide when there is a website or bot spewing out the information with their logo next to it. Proxies are cheaper than lawyers.
• matltc 9mo ago
  I disclosed a vulnerability much like this one. .gov website. Incrementing IDs. No password to crack, just a url parameter with a Boolean value. Pretty much example.com/clients/fullz?id=123&butDoIReallyHaveToAuth=false Changed param key but yeah. Just that. You did need to have an authenticated session, but any valid session token would do. They hit me with same kind of response. I got a lawyer. Worked out in the end, but I was out three hundred bucks for the consultation That was the last vulnerability I will ever disclose
  • ddtaylor 9mo ago
    Proxies are cheaper than lawyers.
• purrcat259 9mo ago
  OP discovered the state of Malta's InfoSec culture the hard way. TLDR: infosec is screwed in Malta. The only people who benefit are malicious actors. Some missing historical context is that there was no real legislation other than computer misuse up until the recent case known as the FreeHour case. A group of students discovered some pretty nasty vulnerabilities in an app aimed at matching student schedules. One of these vulns was exposing RW API keys for hundreds of student's google calendars, hanging out to dry on the open internet. The students involved, together with one of their lecturers, sent a standard vuln disclosure notice via email to the company. Instead of what you'd expect, the students were arrested, strip searched and charged with computer misuse. This really threw the entire local infosec scene off, with some very vocal voices saying how draconian the situation was. Finally they all receieved presidential pardons [1] although last I heard they don't have their hardware back yet. FreeHour and their tech supplier (never publicly mentioned but if you ask around you can find out who they are) never saw any consequences. I've done two public disclosures [2] [3] which worked out well but only because I knew how to go about it. In such a tiny country is about who you know and how you know them, so in both cases I established contact via trusted intermediaries, both times ensuring I found someone who would know what I was talking about whilst also not immediately reach for the police. I'm sitting on another issue I discovered because after a long conversation with CSIRT about it we figured the only way I can actually anonymously report it is by snail mailing it to them. I can't pull together the energy to complete it because I don't have the time right now in my life for another legal melodramatic situation. Despite this, MITA (the government IT department) annually runs cybersec award ceremony [4]. I had once planned to nominate the students for the award but the nomination criteria forbids nominations for individuals who have "averse media publications" about them. This is very much a deep socio-political problem in the country: we don't handle candour or bluntness of any kind in the public sphere. Being a very blunt person, it got me in all kinds of trouble growing up. [1] https://timesofmalta.com/article/pardon-issued-students-lecturer-ethical-hacking-case.1112315 https://timesofmalta.com/article/pardon-issued-students-lect... [2] https://www.simonam.dev/accidental-pentest/ https://www.simonam.dev/accidental-pentest/ [3] https://www.simonam.dev/total-account-takeover/ https://www.simonam.dev/total-account-takeover/ [4] https://ncc-mita.gov.mt/cyber-awards/ https://ncc-mita.gov.mt/cyber-awards/
• ddtaylor 9mo ago
  A sobering reminder that full disclosure is responsible disclosure. The only chains you should have on you are proxy chains.
• altilunium 9mo ago
  Here’s a similar case, but she handled it differently : https://teletype.in/@cyllchuesnconii/TSwR1AAfffT https://teletype.in/@cyllchuesnconii/TSwR1AAfffT
• Edop3 9mo ago
  IANAL but this is exactly it. They weren't being cartoonishly evil—they were in catastrophic liability mode and the blogger's specific choices forced them to show their hand. The second you CC CSIRT Malta, you've triggered the 72-hour GDPR Article 33 clock with the Data Protection Commissioner. That's why they complained about "additional complexities"—they couldn't treat this as a theoretical bug anymore. They had 72 hours to either report a confirmed breach (€20M exposure) or silence the witness. They chose door number two. And that 30-day deadline? To a non-technical GC, "fix this in 30 days or I go public" reads like extortion, not standard disclosure. As that Mustafabei comment noted, that's actionable language in many EU jurisdictions. They genuinely thought they were being shaken down, hence the immediate lawyer deployment. The self-own is what gets me. Their strategy was rational—silence the guy, claim no "confirmed" breach occurred, avoid Article 34 notifications—but the execution turned a fixable IDOR bug into written evidence of witness intimidation. They managed to validate every suspicion that DAN (let's be real, it's DAN Europe) cares more about covering asses than protecting diver data. The irony is if he'd skipped the CSIRT CC and just sent a casual "hey, noticed your student IDs look sequential, maybe check your auth?" they'd have fixed it quietly, never notified users, and learned absolutely nothing. Instead we got this mess. Better for the community, worse for his stress levels.
• orf 9mo ago
  Name. And. Shame.
• kgeist 9mo ago
  Not a security researcher, but I once found an open Redis port without auth on a large portal. Redis was used to cache all views, so one could technically modify any post and add malicious links, etc. I found the portal admin's email, emailed them directly, and got a response within an hour: "Thanks, I closed the port." I didn't need a bounty or anything, so sometimes it may be easier and safer to just skip all those management layers and communicate with an actual fellow engineer directly
• karanveer 9mo ago
  all things aside, the location at which you discovered the vulnerability is so interesting..i mean imagine being on a 2 week vacation and then amidst this happens..on a beautiful day.
• booleandilemma 9mo ago
  Why disclose anything? These companies are heartless.
• ronbenton 9mo ago
  All the disclosure and legal issues aside, it’s sobering to think of how many of these types of trivial bugs exist on random websites that collect sensitive user information. It seems hopeless to try to safeguard one’s own information.
  • duskdozer 9mo ago
    Which is why collecting and storing sensitive user information needs to be more heavily restricted and treated as the unsafe activity that it is.
• jp1016 9mo ago
  The part where they blame users for not changing the default password is infuriating but unfortunately very common. I've seen this exact same attitude from companies that issue credentials like "Welcome1!" and then act shocked when accounts get popped. What really gets me is the legal threat angle. Incremental user IDs + shared default password isn't even a sophisticated attack to discover. A curious user would stumble onto this by accident. Responding to that with criminal liability threats under Maltese computer misuse law is exactly the kind of thing that discourages researchers from reporting anything at all, which means the next person who finds it might not be so well-intentioned. The fact that minors' data was exposed makes the GDPR Article 34 notification question especially pointed. Would love to know if the Maltese DPA ever followed up on this.
• mystraline 9mo ago
  Easy enough then. For bad companies, sell the exploits on the gray market. They can pay market price too.
• jdefr89 9mo ago
  Vulnerability Researcher here… Unless your target has a security bounty process or reward; leave them alone. You don’t pentest a company without a contract that specified what you can and can’t test. Although I would personally appreciate and thank a well meaning security researchers efforts most companies don’t. I have reported 0days for companies that HAVE bounties and they still tried to put me in hot water over disclosure.. Not worth the risk these days.
  • 1970-01-01 9mo ago
    Good guideline advice but it seems you didn't read the article. Their personal data was at risk here. Leaving them alone would very likely result in a breach of this person's data. Both he and you have an ethical responsibility to at minimum notify the business of this problem and follow up with it.
    • kortilla 9mo ago
      That’s not how it works. You are not ethically responsible to hack every company you interact with.
      • 1970-01-01 9mo ago
        No, that's exactly how it works when you're Certified. https://www.giac.org/policies/ethics/ https://www.giac.org/policies/ethics/ "I will protect confidential and proprietary information with which I come into contact."
        • mbrumlow 9mo ago
          GIAC has zero authority, any group of people can get together and make their own policies and print a nice little certificate when somebody applies.
        • kortilla 9mo ago
          No it’s not. Unless you’re certified by the government that carries no weight. That’s no different than “sovereign citizens” claiming they have rights to drive without licenses.
• jalapenos 9mo ago
  Almost makes one want to anonymously respond: Oh, I see that you're cunts. Well that's your choice. My choice, in response, then, is to notify certain corners of the dark web how you approach security. I'm sure they'll find something else, and don't worry - they won't bother you with a disclosure.
• malklera 9mo ago
  From a "noob" move using incremental userID I understand, but using the same password for multiple users is crazy. Concur with the author > It's the response that tells you everything about an organization's security culture.
• peter_d_sherman 9mo ago
  My favorite quote from the article: "Don't shoot the messenger. The person reporting the bug is not your enemy. The bug is."