6 ms·
I got access to all of BitTorrent Inc's source code and sensitive documents
- 0x0 13y agoIf one guy could accidentally stumble upon this, what are the chances others have too? Would it be possible or even likely that the source code or binaries or web servers or private keys have already been compromised or trojanized?
- GBiT 13y agoYou have to be proud of yourself for not abusing it no mater how they responded. You did right thing here. Hope Bitorrent Inc will fix this misunderstanding.
- citricsquid 13y agoLooks like he acquired login information, he didn't exploit some sort of major vulnerability that needed to be fixed which is generally what bug bounties seem to be for. He's insulted he didn't get paid for not being an asshole, what a strange world we live in. Facebook (or any other company) wouldn't pay out if one of their support staff accidentally made a random user an admin, why should this be any different.
- patrickgokey 13y agoLike he says on the forum thread, he did not acquire any login information. Just the opposite, in fact. They neglected to set a username/password to their admin panel. That's a gaping security hole if I've ever seen one.
- Andrenid 13y agoHe didn't get credentials, they never secured their admin panels: > A friend was looking for a hosting provider and wanted it all secure, I checked a network range and found the Jenkins panel of BitTorrent. This was all 100% accidental, truth! At the end of the day If I wanted to 'hack' BitTorrent I wouldn't even know where to begin. I mean, there is no real skill or talent involved in what I did to find the information on BitTorrent. They forgot to set a user/pass to the admin panel, that had access to github from a master account. Github accounts had user/passes that was linked to everything. > No hacking, just random find. Mad huh?
- Dylan16807 13y agoHe stumbled across a major vulnerability that needed to be fixed, not login credentials. >He's insulted he didn't get paid for not being an asshole, what a strange world we live in. That's how bug bounties work, yet people don't complain there.
- hack_edu 13y agoStay classy!
- cupcake-unicorn 13y agoIndeed...This seems rather petty to me. They did offer him some money, which he's not even automatically entitled to in the first place...companies can chose whether they do bug bounties, or how much they pay.
- ascendantlogic 13y agoYou don't seem to understand that access to something that widely used would be worth tens of thousands of dollars on the black market for those sorts of things. For every "good" person that reports the information for free, there are people out there actively looking for this sort of thing that are not good people. If this company sets a precedent that they won't make it worth your while to "turn in the evidence", that sort of thing will just go to the highest bidder out there on the Internet and undoubtedly used for something extremely malicious. tl;dr: small payouts and jerking this guy around sets a bad precedent that will encourage future people to sell on the black market.
- fibbery 13y agoJust because someone leaves their car door unlocked and you tell them about it, doesn't mean they are obligated to give you any of its contents.
- kaybe 13y agoOn the other hand, if you find a wallet, you are entitled to 10% of the cash.(1) (Bad fit as an example, I know, but the question is what is a good comparison..) (1) at least in Germany.
- letney 13y agoIs this German law? I wish that were the case in the US, as I've found a number of wallets over the years and would have made at least a few hundred USD by now.
- th0br0 13y agoIt is. But only if the wallet contains >50€ or so.
- fnordfnordfnord 13y agoWhat! I found a lady's Rolex once (Wilhelma Zoo, Stuttgart) and only got a goofy look when I turned it in.
- netrus 13y agoSource: http://translate.google.com/translate?hl=en&sl=de&tl=en&u=http%3A%2F%2Fwww.gesetze-im-internet.de%2Fbgb%2F__971.html http://translate.google.com/translate?hl=en&sl=de&tl=en&u=ht... (It's 5% below 500EUR, 3% above)
- MentaLTorrent 13y agoA model is nothing, blueprint and trade secrets would be a better way to look at it.
- fnordfnordfnord 13y ago
- otterley 13y agoI find the author's righteous indignation that he did not receive the ransom he thought he deserved amusing at best.
- MentaLTorrent 13y agoI contacted BitTorrent and told them EXACTLY what I did , what information I had access to and what user/passes needed updating, including SSH keys and more. Whilst I gave a small generalization of what was at hand on the thread, there was a considerable amount of data available to me. - MentaL (RZ Thread Starter).
- hack_edu 13y agoNow you just sound entitled AND righteously indignant...
- biot 13y agoScenario 1: You find a boy who is lost and take him to the police station. The family gives you $500 in reward. Scenario 2: You find twin boys who are lost and take them to the police station. The family gives you $500 in reward. Would the fact that you get the same reward regardless of the number of people lead you to act differently in the future? So if next week you found lost twins again, would you let them stay lost or try to sell them on the black market because you know you'll only get $500 when you think it should be $1000? Or is doing the right thing its own reward regardless of whatever amount you get in recognition for acting honorably?
- deleted 13y ago[deleted]
- Dylan16807 13y agoScenario 3: Same as scenario 1, but a month earlier a different person saw a "missing boy, reward" sign for the same child and searched them out. They received $30000 from the family. Wouldn't you find that unfair? Or was the post misleading and the other bounty was a different company, in which case I take it back.
- deleted 13y ago[deleted]
- Wingman4l7 13y agoIt would make a lot more sense to just sell the vulnerability to blackhats than to spend time and effort (and expose yourself to more legal liability) by trying to take advantage of it yourself.
- deleted 13y ago[deleted]
- ceejayoz 13y agoIt's hard to spend millions of dollars from prison.
- aviddd 13y agoIt's true, there are circumstances where a person can make a lot more money by doing the morally wrong or criminal thing.
- deleted 13y ago[deleted]
- MentaLTorrent 13y agoI'm the thread starter from RZ. The reason I mention uTorrent is because the source code was also in the BitTorrent repository for the company including all other source materials and more (Websites/Database user/passwords and more). thanks.
- film42 13y agoThey bought it. See http://torrentfreak.com/bittorrent-inc-buys-%C2%B5torrent/ http://torrentfreak.com/bittorrent-inc-buys-%C2%B5torrent/
- simplyinfinity 13y agoOn December 7, 2006, µTorrent was purchased by BitTorrent, Inc On September 18, 2007, BitTorrent 6.0 was released, which is a re-branded version of µTorrent. [0] [0] https://en.wikipedia.org/wiki/%CE%9CTorrent https://en.wikipedia.org/wiki/%CE%9CTorrent
- grandpoobah 13y agoutorrent was acquired by bittorrent inc
- deleted 13y ago[deleted]
- lukeman 13y agoYou got my hopes up that we'd finally be able to audit Bittorent Sync.
- nivla 13y agolol I was hoping for that too. A great piece of software but a waste since it can't be trusted for anything secure. To make it worse, this news just adds more fuel to the fire. How can you trust them with security if they can't even remember to add a basic authentication to their Admin Panel?
- bigiain 13y agoI've got it syncing EncFS encrypted directories - which in the broad view doesn't help - I've got un-audited code running with my user privs, which _claims_ to "not do anything evil" without being (easily) verified. At least it does mean I've got some extra encrypted-on-the-wire and encrypted-at-rest data floating around - I strongly suspect BTSync's SHA256 encrypted wire protocol moving AES encrypted EncFS files means that data is secure against the NSA's ubiquitous surveillance programs - the cleartext of those files won't be showing up in XKeyscore in response to bored or curious NSA (or Boos-Hamilton) staff. (While acknowledging that if the NSA becomes interested in _me_ specifically (or probably interested enough in any of my social network) - my privacy will be easily and wantonly violated. And I'm actually _mostly_ OK with that.)
- sneak 13y agoThis was my very first thought, as well. Perhaps there should be a kickstarter for an open source bittorrent sync clone?
- lukeman 13y agoThe hope is more that the protocol will be published once it's stable and then FLOSS implementations can spring up. The protocol is clearly still in flux, as some versions of the client have had backwards-incompatible changes.
- mrlinx 13y agoBy submitting this information to BT, he indeed closed a access point to all this data, thus reducing the likelyhood of it being badly used. Isn't this exactly why bounties were created? Because its better to give a few bucks and increase the system's security than to have it compromised for worse costs.
- EasyCo 13y agoSome thoughts: From the perspective of the company, what kind of financial impact would they have suffered should that information have fallen in different (malicious) hands? Providing an adequate award not only shows appreciation but it sets a precedent should something similar happen again. The 'finder' who might otherwise usually go the malicious route will be more likely to do as MentalL has.
- jongraehl 13y agoIt's not the amount of money so much as the "so invoice us" attitude.
- jheriko 13y agowhilst i agree they are ungrateful and inept i can't help but notice that you want a reward for doing the right thing? get over it... life isn't this nice, you are entitled to nearly nothing. deal.