11 ms·

Neel Mehta donates Heartbleed bounty to Freedom of the Press Foundation

248 points by _pius 13y ago

iancarroll 13y ago
Is Hackerone the thing now for reward programs?
- projuce 13y ago
  It is one option, there is also https://bugcrowd.com https://bugcrowd.com mainly paid reward programs, can start using it for a bug bounty/rewards program for free (also maintains the bug bounty list which is used by many white hat hackers https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/) https://crowdcurity.com https://crowdcurity.com
ronnier 13y ago
What a bullet point to put on a resume. Congratulations Mr. Mehta.
- tptacek 13y ago
  That's a nice sentiment, but for whatever it's worth: Neel Mehta is one of the best-known and most well-respected people in vulnerability research.
- dpeck 13y ago
  I'd guess Neel hasn't put anything on his resume for about the last decade. My company worked hard on recruiting him about that long ago and his reputation was already well established then.
iamthepieman 13y ago
Bank account - 15,000 Karma + 1,000,000
handsomeransoms 13y ago
This is a great reminder for others to consider a donation to the Freedom of the Press foundation's ongoing campaign to fund the development of encryption tools to benefit journalists, sources, and everyone who communicates digitally! https://pressfreedomfoundation.org/ https://pressfreedomfoundation.org/ Huge thanks to Neel, whose donation pushed us over the edge to meet our goal! (Full disclosure: I work for the Freedom of the Press Foundation)
motyar 13y ago
@neelmehta 's twitter description says "One day you will understand..." We do now. Huge thanks to Neel.
throwaway662 13y ago
Considering that he is Indian, I wouldn't be surprised if he plagiarized or took credit for some unsuspecting white guy's work.
- shekhar101 13y ago
  What a douche you are!
  - dang 13y ago
    The comment to which you replied was so toxic that I not only banned the user (last night), I did something we almost never do and killed the comment despite its already having a reply. I feel ashamed of Hacker News when I see such things here. Nevertheless, please don't post comments like yours on Hacker News either, no matter how wrong the other person may be. In such extreme cases, here's what we ask. Definitely do: flag the comment by clicking on 'link', which takes you to the item page for the comment, and then clicking on 'flag'. We monitor those flags and take action based on them. Maybe do: send us an email to make sure we take a close look. Definitely don't: lash back. All it does is degrade the discourse further.
    - gojomo 13y ago
      Aside: seems a bug that a [dead] comment can appear higher than any live comments. (It was above iamthepieman's comment a moment ago.)
      - dang 13y ago
        This was probably not because of the dead comment but the live reply, which got some upvotes.
        theycallmemorty 13y ago
        Yes and there is a slight formatting bug where it appears "What a douche you are" is in reply to "Would Neel Mehta be ineligible collecting via his employment at Google?"
gojomo 13y ago
Nice move! I was already wondering, though: might Mehta and/or Codenomicon have been put on the scent of the Heartbleed bug by an inquiry from one of the journalists with Snowden docs? I hope we hear more about how each of the researchers found the bug – code auditing? fuzzing? observing attempted exploits? etc – and in the same general timeframe.
- DrewHintz 13y ago
  No. Neel found it by auditing code. See CVE-2011-0014 for a previous OpenSSL bug he found by auditing code. See CVE-2010-0239 to witness his awesome ability to find bugs by auditing assembly code.
  - gojomo 13y ago
    Thanks! Do you know this because you work with him and are relaying his report of that approach in this particular case, or do you just expect that's the case from his usual technique and prior cases? Wouldn't that track record of awesome ability, and his support for the Freedom of the Press Foundation, also potentially make him a sought-after expert about mysterious things that a journalist didn't understand in a leaked NSA (or other) document? Do you know if the Codenomicon researcher(s) found the issue in the same way? (Their corporate webpage makes a big deal about their fuzzing tools.) Do you believe it was just coincidence that both recently found this same monumental vulnerability? How long would Mehta and/or Codenomicon typically privately research such a bug, with or without coordination with OpenSSL maintainers, after first confirmation of danger?
    - DrewHintz 13y ago
      You're welcome! I know this because I work on the same team with him. I'm not familiar with what Codenomicon did and won't publicly speculate.
- lawnchair_larry 13y ago
  Not to diminish Neel's work (nobody will deny that he was already known as being at the top of his game for the last decade or more), but this particular one was blatantly obvious for anyone who audits C code. This just tells us that nobody bothered to look at it for 2 years. If a client had given me this code to audit, I'd have found it immediately. If you were hiring for an entry level auditing type position, or an intern, and they did not spot this, you would not want to hire that person. For me personally, one of the biggest reasons why I wouldn't have looked is because there is a perception that the probability of things this dumb being missed means looking is surely a waste of time that could be billed hourly to paying clients. It's moments like these that really challenge those assumptions.
deleted 13y ago
[deleted]
camus2 13y ago
Cheers pal! that's a hacker with bleeding heart ! Well done.
sfall 13y ago
Would Neel Mehta be ineligible collecting via his employment at Google?
JohnnyCat 13y ago
Thank you Mr. Mehta wherever you may be. Thank you for your fantastic audit skill. You are unknown super-hero working against dark forces.

248 points by _pius 13y ago

iancarroll 13y ago

Is Hackerone the thing now for reward programs?

projuce 13y ago
It is one option, there is also https://bugcrowd.com https://bugcrowd.com mainly paid reward programs, can start using it for a bug bounty/rewards program for free (also maintains the bug bounty list which is used by many white hat hackers https://bugcrowd.com/list-of-bug-bounty-programs/ https://bugcrowd.com/list-of-bug-bounty-programs/) https://crowdcurity.com https://crowdcurity.com

ronnier 13y ago

What a bullet point to put on a resume. Congratulations Mr. Mehta.

tptacek 13y ago
That's a nice sentiment, but for whatever it's worth: Neel Mehta is one of the best-known and most well-respected people in vulnerability research.
dpeck 13y ago
I'd guess Neel hasn't put anything on his resume for about the last decade. My company worked hard on recruiting him about that long ago and his reputation was already well established then.

iamthepieman 13y ago

Bank account - 15,000 Karma + 1,000,000

handsomeransoms 13y ago

This is a great reminder for others to consider a donation to the Freedom of the Press foundation's ongoing campaign to fund the development of encryption tools to benefit journalists, sources, and everyone who communicates digitally! https://pressfreedomfoundation.org/ https://pressfreedomfoundation.org/ Huge thanks to Neel, whose donation pushed us over the edge to meet our goal! (Full disclosure: I work for the Freedom of the Press Foundation)

motyar 13y ago

@neelmehta 's twitter description says "One day you will understand..." We do now. Huge thanks to Neel.

throwaway662 13y ago

Considering that he is Indian, I wouldn't be surprised if he plagiarized or took credit for some unsuspecting white guy's work.

shekhar101 13y ago
What a douche you are!
- dang 13y ago
  The comment to which you replied was so toxic that I not only banned the user (last night), I did something we almost never do and killed the comment despite its already having a reply. I feel ashamed of Hacker News when I see such things here. Nevertheless, please don't post comments like yours on Hacker News either, no matter how wrong the other person may be. In such extreme cases, here's what we ask. Definitely do: flag the comment by clicking on 'link', which takes you to the item page for the comment, and then clicking on 'flag'. We monitor those flags and take action based on them. Maybe do: send us an email to make sure we take a close look. Definitely don't: lash back. All it does is degrade the discourse further.
  - gojomo 13y ago
    Aside: seems a bug that a [dead] comment can appear higher than any live comments. (It was above iamthepieman's comment a moment ago.)
    - dang 13y ago
      This was probably not because of the dead comment but the live reply, which got some upvotes.
      - theycallmemorty 13y ago
        Yes and there is a slight formatting bug where it appears "What a douche you are" is in reply to "Would Neel Mehta be ineligible collecting via his employment at Google?"

gojomo 13y ago

Nice move! I was already wondering, though: might Mehta and/or Codenomicon have been put on the scent of the Heartbleed bug by an inquiry from one of the journalists with Snowden docs? I hope we hear more about how each of the researchers found the bug – code auditing? fuzzing? observing attempted exploits? etc – and in the same general timeframe.

DrewHintz 13y ago
No. Neel found it by auditing code. See CVE-2011-0014 for a previous OpenSSL bug he found by auditing code. See CVE-2010-0239 to witness his awesome ability to find bugs by auditing assembly code.
- gojomo 13y ago
  Thanks! Do you know this because you work with him and are relaying his report of that approach in this particular case, or do you just expect that's the case from his usual technique and prior cases? Wouldn't that track record of awesome ability, and his support for the Freedom of the Press Foundation, also potentially make him a sought-after expert about mysterious things that a journalist didn't understand in a leaked NSA (or other) document? Do you know if the Codenomicon researcher(s) found the issue in the same way? (Their corporate webpage makes a big deal about their fuzzing tools.) Do you believe it was just coincidence that both recently found this same monumental vulnerability? How long would Mehta and/or Codenomicon typically privately research such a bug, with or without coordination with OpenSSL maintainers, after first confirmation of danger?
  - DrewHintz 13y ago
    You're welcome! I know this because I work on the same team with him. I'm not familiar with what Codenomicon did and won't publicly speculate.
lawnchair_larry 13y ago
Not to diminish Neel's work (nobody will deny that he was already known as being at the top of his game for the last decade or more), but this particular one was blatantly obvious for anyone who audits C code. This just tells us that nobody bothered to look at it for 2 years. If a client had given me this code to audit, I'd have found it immediately. If you were hiring for an entry level auditing type position, or an intern, and they did not spot this, you would not want to hire that person. For me personally, one of the biggest reasons why I wouldn't have looked is because there is a perception that the probability of things this dumb being missed means looking is surely a waste of time that could be billed hourly to paying clients. It's moments like these that really challenge those assumptions.

deleted 13y ago

[deleted]

camus2 13y ago

Cheers pal! that's a hacker with bleeding heart ! Well done.

sfall 13y ago

Would Neel Mehta be ineligible collecting via his employment at Google?

JohnnyCat 13y ago

Thank you Mr. Mehta wherever you may be. Thank you for your fantastic audit skill. You are unknown super-hero working against dark forces.