4 ms·

This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was

This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?

RyanZAG 12y ago
Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough. > This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ... Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue. Thank you to him!
- onewaystreet 12y ago
  Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.
  - panopticon 12y ago
    I think the "that have yielded any luck" part of that quote is pretty important.
    - onewaystreet 12y ago
      The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?
      - RyanZAG 12y ago
        Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.
      - bostonpete 12y ago
        I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.
        onewaystreet 12y ago
        I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.
        pg_is_a_butt 12y ago
        no... he said he used the generic yahoo contact forms, they didn't respond. you're an idiot.
  - delecti 12y ago
    > that have yielded any luck with trying to contact them regarding this Might be the important part of the quote you missed.
    - onewaystreet 12y ago
      He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.
  - bdevani 12y ago
    Dude your screen name is really telling. He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust
    - onewaystreet 12y ago
      You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true https://hackerone.com/yahoo?show_all=true.
      - olegbl 12y ago
        I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?
        rnovak 12y ago
        if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?
- frowaway001 12y ago
  > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration And the feds are standing at his front door in 3 .. 2 .. 1.
mralvar 12y ago
Then he wouldn't bring attention to his consultancy firm. "Gee, these guys sure did show the Yahoo CEO! We need to hire them!" Says the MBA.
- paracyst 12y ago
  And this is different from what everyone else on HN does...how?
Zirro 12y ago
According to this[1] article about the current issue: "Before releasing this information, Hall emailed Yahoo and tweeted at its engineering team and CEO Marissa Mayer. It was confirmed to him that its servers had been infiltrated but Yahoo refused to pay him for alerting them as it was not part of the company’s bug bounty programme." [1]: http://www.independent.co.uk/life-style/gadgets-and-tech/news/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims-security-expert-9777753.html http://www.independent.co.uk/life-style/gadgets-and-tech/new... EDIT: The quote previously included "Yahoo is notorious for its disregard of bug bounty hunters, having last year rewarded one such hacker who identified three bugs in Yahoo's servers with a $25 voucher for company merchandise." but I moved it here as it caused confusion regarding which issue the article was referencing.
- elliottcarlson 12y ago
  Please read the follow up: http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the-guy-who-sent-the-t-shirt-out-as-a-thank-you http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the... (and HN discussion: https://news.ycombinator.com/item?id=6488897 https://news.ycombinator.com/item?id=6488897)
  - deleted 12y ago
    [deleted]
- scrollaway 12y ago
  They keep insulting bounty hunters like that, they'll end up on the wrong side of black market bug trades every time some new exploit comes up. And I won't be defending Yahoo when that happens.
  - kjjw 12y ago
    Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.
    - 12y ago
Eiriksmal 12y ago
Found this email from him archived on Seclists: I identified that a few major sites were actually compromised using the vulnerability - Yahoo! being one in particular. Tripod/Lycos and WinZip.com were also compromised. Yahoo! reached out and gave me a response, albeit a very weak one, only after the FBI, media and CEO Marissa Mayers was contacted... WinZip patched their boxes and didn't bother responding or notifying me that they got it done. And, amusingly, an apology for his rambling: Please do excuse the scattered nature of the email sent to Marissa Mayers @ Yahoo! - there were other correspondences that are currently being kept private, and at the time that I wrote that one, I had been awake for roughly 48 hours and was fueled on caffeine and nicotine. From http://seclists.org/nanog/2014/Oct/158 http://seclists.org/nanog/2014/Oct/158

RyanZAG 12y ago

Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough. > This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ... Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue. Thank you to him!

onewaystreet 12y ago
Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.
- panopticon 12y ago
  I think the "that have yielded any luck" part of that quote is pretty important.
  - onewaystreet 12y ago
    The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?
    - RyanZAG 12y ago
      Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.
    - bostonpete 12y ago
      I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.
      - onewaystreet 12y ago
        I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.
        pg_is_a_butt 12y ago
        no... he said he used the generic yahoo contact forms, they didn't respond. you're an idiot.
- delecti 12y ago
  > that have yielded any luck with trying to contact them regarding this Might be the important part of the quote you missed.
  - onewaystreet 12y ago
    He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.
- bdevani 12y ago
  Dude your screen name is really telling. He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust
  - onewaystreet 12y ago
    You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true https://hackerone.com/yahoo?show_all=true.
    - olegbl 12y ago
      I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?
      - rnovak 12y ago
        if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?
frowaway001 12y ago
> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration And the feds are standing at his front door in 3 .. 2 .. 1.

mralvar 12y ago

Then he wouldn't bring attention to his consultancy firm. "Gee, these guys sure did show the Yahoo CEO! We need to hire them!" Says the MBA.

paracyst 12y ago
And this is different from what everyone else on HN does...how?

Zirro 12y ago

According to this[1] article about the current issue: "Before releasing this information, Hall emailed Yahoo and tweeted at its engineering team and CEO Marissa Mayer. It was confirmed to him that its servers had been infiltrated but Yahoo refused to pay him for alerting them as it was not part of the company’s bug bounty programme." [1]: http://www.independent.co.uk/life-style/gadgets-and-tech/news/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims-security-expert-9777753.html http://www.independent.co.uk/life-style/gadgets-and-tech/new... EDIT: The quote previously included "Yahoo is notorious for its disregard of bug bounty hunters, having last year rewarded one such hacker who identified three bugs in Yahoo's servers with a $25 voucher for company merchandise." but I moved it here as it caused confusion regarding which issue the article was referencing.

elliottcarlson 12y ago
Please read the follow up: http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the-guy-who-sent-the-t-shirt-out-as-a-thank-you http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the... (and HN discussion: https://news.ycombinator.com/item?id=6488897 https://news.ycombinator.com/item?id=6488897)
- deleted 12y ago
  [deleted]
scrollaway 12y ago
They keep insulting bounty hunters like that, they'll end up on the wrong side of black market bug trades every time some new exploit comes up. And I won't be defending Yahoo when that happens.
- kjjw 12y ago
  Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.
  - 12y ago

Eiriksmal 12y ago

Found this email from him archived on Seclists: I identified that a few major sites were actually compromised using the vulnerability - Yahoo! being one in particular. Tripod/Lycos and WinZip.com were also compromised. Yahoo! reached out and gave me a response, albeit a very weak one, only after the FBI, media and CEO Marissa Mayers was contacted... WinZip patched their boxes and didn't bother responding or notifying me that they got it done. And, amusingly, an apology for his rambling: Please do excuse the scattered nature of the email sent to Marissa Mayers @ Yahoo! - there were other correspondences that are currently being kept private, and at the time that I wrote that one, I had been awake for roughly 48 hours and was fueled on caffeine and nicotine. From http://seclists.org/nanog/2014/Oct/158 http://seclists.org/nanog/2014/Oct/158