5 ms·

This is a symptom of an unfortunately very common reaction to system security. Unless businesses are actively encouraging bug hunting, almost unbelievably they

• RexRollman 12y ago
  You would think they would have been grateful for the head's up. I guess some people would rather shift blame then accept they made a configuration or security mistake.
  • busterarm 12y ago
    That's pretty much the norm in IT. After 15 years or so, I've seen pretty much everyone shift blame or blatantly lie their ass off to cover their own shortcomings...including a very senior person "invent" a completely fictitious rootkit to excuse the fact that the business lost critical data due to his negligence. It doesn't pay off to blow the whistle on this behavior either and provides a blackmail opportunity that I've seen people capitalize on. Most everyone looks the other way in this business and there's a large amount of lying about credentials & experience to land jobs.
  • deleted 12y ago
    [deleted]
• kermorvan 12y ago
  Reading your post makes me wonder why bug-hunters aren't more cautious about this. Sure the sentiment is good, it is a moral obligation to expose a bug that could be harmful to users. But if you suspect you could get burned for pointing it out, you can take steps to mitigate it. Anonymity for example. Then again if you are in it for the fame and recognition, getting burned is a risk you are taking out of vanity.
  • MereInterest 12y ago
    Because most of the time, the thought doesn't even occur to someone that it could be an issue. Here you are, going along, and suddenly you find information that shouldn't be public. So, you send a quick email. After all, it was probably an oversight, and it only takes a minute of your time to inform somebody.
  • mrich 12y ago
    The guy was helping others. He should not have to take extra steps to be safe while doing it.
  • lambda 12y ago
    Because most people aren't in it for "fame and recognition" or "vanity"? If I find a bug in a piece of software, or something misconfigured, I tend to report it and move on. I don't try to hide my identity before reporting it. A security vulnerability is just a bug or misconfiguration, that happens to be exploitable for nefarious purposes. The responsible thing to do is to notify those responsible, and anonymity doesn't help with that; they may need to follow up to ask questions to find out more details about it. While there are some people in the security community who are prima donnas, who try to hype them selves and their exploits to gain recognition, this case does not appear to have anything to do with that. This is someone who sent a private email to those responsible, and then started seeing articles online and getting complaints emailed to his college about irresponsible hacking of other institutions websites in front of students.
• AwesomeTogether 12y ago
  It is dangerous to report bugs A student in Montreal was expelled after informing the college where he studied that there was a security flaw http://business.financialpost.com/2013/07/17/montreal-student-expelled-after-finding-security-flaw-now-leading-new-startup-outpost-travel/?__lsa=ee90-6b0e http://business.financialpost.com/2013/07/17/montreal-studen...
  • cnlwsu 12y ago
    I am glad I went to a university that reacted appropriately. I found a bad issue (students passwords for system that held their ssns, grades, financial info etc was world readable) and got a pat on the back for them. I went through a prominent CS professor instead of directly reporting it though.
  • plg 12y ago
    I dunno... it appears that he was expelled for some other reason, not the original reporting of the bug? http://news.nationalpost.com/2013/01/20/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data/ http://news.nationalpost.com/2013/01/20/youth-expelled-from-...
    • tedunangst 12y ago
      Post hoc ergo propter hoc.
  • deleted 12y ago
    [deleted]
• skywhopper 12y ago
  Nowhere in the original article[1] is the professor accused of hacking and certainly not of having any malicious intent. The headline of the subsequent summary in scmagazine.com[2] is where the word "hacked" came in, and to be fair to the reporters, what the professor did would be considered "hacking" in some legal interpretations of existing laws whether that's right or wrong. To be clear, we have absolutely zero evidence that the IT staff at the hospital ever accused him of anything or claimed he did anything wrong. Apparently they didn't respond and tell him thanks, but given that they knew who it was, if the hospital thought it was a crime, surely they would have contacted the authorities. In any case, neither article named the professor until he came forward, so I'm not sure how even the extremely mild misinterpretations of the case could be called libel, exactly. All in all, this isn't exactly a cut-and-dried case of curious white-hat smeared by the government and media. There are plenty of those to go around. We needn't invent more. [1] http://www.thenewsstar.com/story/news/local/2014/08/19/conway-server-breach-personal-information-lost/14296833/ http://www.thenewsstar.com/story/news/local/2014/08/19/conwa... [2] http://www.scmagazine.com/professor-hacks-university-health-conway-in-demonstration-for-class/article/367123/ http://www.scmagazine.com/professor-hacks-university-health-...
  • fnordfnordfnord 12y ago
    The headline is: "Professor hacks University Health Conway in demonstration for class" http://imgur.com/M3rdooP http://imgur.com/M3rdooP I'd be pretty annoyed to see that written about me after I had emailed the server owners and informed them that they were hosting patients' personal data on an open ftp server. It'd merely be piss-poor coming from some random local newspaper, and we often tend to dismiss it because technology is complicated egghead stuff; but, this is a website that claims its audience is "IT Professionals" which makes it really irresponsible and the reporter ought to know better. caveat: Given that the professor's story is legit.
  • spacemanmatt 12y ago
    Wrong on the facts -- the article calls it a "security breach" and names the professor as the responsible party. The article says he did this in front of a class full of students. I'd say he has a pretty good case for libel, and the authors are pretty stupid to ignore his demand for retraction and apology.
• rasur 12y ago
  There should be some kind of anonymizing escrow-type service that allows people/info.sec researchers to help companies with security issues (or am I being woefully slow, and there already exists such a thing? This was just a OTTOMH/knee-jerk thought, FFTTMTFO..).
  • DanBC 12y ago
    And it would help explain why the disclosure is being made - to help the company the disclosure is being made to, as a free gift.
    • rasur 12y ago
      Yup, agreed. I wasn't clear, but I was thinking/ass-u-me'ing that it would be an entity that would try to act responsibly.
  • oliwary 12y ago
    Maybe even a government agency? It could notify the company, follow up on whether they fixed the issue and sanction it if nothing has happened. Then it would allow the researcher to publish an article and protect him from retribution.
    • nitrogen 12y ago
      The worry there is that such an agency might keep the exploits for itself.
  • giardini 12y ago
    A lawyer can do this. But then _you_ must pay.
• plitfabi 12y ago
  I work as a contingent faculty member at a private liberal arts college. When searching for someone's email address recently, I discovered published on the web a list names, email addresses, and ID numbers for all staff and faculty. I notified the responsible department through a trusted tenured faculty member. The response was "oh, that's just test data," which turned out to be false, and then "oh, it's not a big deal anyway." This was also false, for any number of reasons. Among them is the institution's use of swipe cards to control access to buildings and labs, and a ridiculously simple swipe payload (essentially just the unencrypted ID number). They removed that information from the site and probably no one with ill intent accessed it. However, the security situation at that institution would be in better shape today if there had been an open discussion about this leak and its implications. Because I didn't feel comfortable approaching decision makers about this without risking retaliation against me, that discussion never happened.
• droopybuns 12y ago
  I see this as a symptom of something different. Security researchers have treated press coverage as a desirable commodity for a while now. Journalism has changed though, and so now we are seeing people like zdarski calling out journalists for reporting failures. The fact is that journalists today are too busy writing linkbait headlines and getting page clicks to bother with details like accuracy or ethics. Researchers need to look at stories like this one and realize that journalists are not your friends, even if they write nice things about you or hang out with you at parties. This journalist probably thought he was doing this guy a favor by writing about him.
• nikcub 12y ago
  > My advice is do not bother. Second this motion. The number of vendors or administrators who respond well to security or privacy reports is tiny. Some approximate data from my own emails. I've reported just over 120 security or privacy bugs over the past 4-5 years that this email address goes back (using my real name). I tag the emails, but searching "from:me vulnerability" brings them up. It is like a scoreboard of horrible vendors and site administrators. From the most recent 100, there are around 25 with no reply at all. I know that some of those, such as government sites were followed up on the phone. Of those with a "(1)" in the thread meaning an additional message, most are me sending a reminder or trying to work out who to contact. There are then a group of replies where they confirm receipt of the email, but then never confirm the actual contents of what i've reported. Scanning the threads, this looks like another 30 or so emails. Then there is the group who confirm or deny the bug or parts but get into prolonged technical arguments, with around a dozen threads stretching beyond 10+ emails into arguments about if it is a bug or not. Last group is those who get the bugs fixed and respond well. In these cases there are only a very small number where the threads are short - most involve long conversations. Some of these are still open - I just reminded myself that I have an open privacy issue with a large web company that still hasn't been fixed. That thread is 30+ emails long. Overall more than half either didn't reply or didn't confirm the bug (silently fixed or not). There is a messy middle full of long threads and replies that are full of frustration and then only a tiny number of reports where they just get fixed with minimal effort (and you know who these companies are). There is not a single instance of a non-software company responding well to a bug report (usually from a custom web app), and that includes some well known brands (banks, etc.). The number of good experiences I could count on one hand. In terms of vendors, recent examples are a 20+ email thread over 3 weeks debating a vendor about severity of a group of bugs (still ongoing), two reasonably well-known vendors with no reply and a well-known vendor who only fixed after more than a month. You can work out before reporting an issue who the good vendors are. They have a page dedicated to security with contact info, a key and a proper reporting program (preferably with a bounty). With everyone else, you are working for free, wasting your time, not making the internet any more secure and run the risk of getting into trouble - in some countries that could involve legal trouble (there have been a number of raids as a result of security reports in Australia, and the government head of privacy here said there is no such things as a white hat report).
• iuguy 12y ago
  > My advice is do not bother. There is almost no upside for you and likely very significant downsides. Years ago I realised that security bug reporting is a painful experience at best, from about 2006 I decided I'd stop tracking and reporting software security bugs that I find, which while not the optimal solution has made my life a lot less stressful.