4 ms·

Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, t

by RyanZAG 12y ago

Well.. you didn't read the first couple lines? Notably: > I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough. > This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ... Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue. Thank you to him!

onewaystreet 12y ago
Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.
- panopticon 12y ago
  I think the "that have yielded any luck" part of that quote is pretty important.
  - onewaystreet 12y ago
    The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?
    - RyanZAG 12y ago
      Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.
    - bostonpete 12y ago
      I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.
      - onewaystreet 12y ago
        I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.
        pg_is_a_butt 12y ago
        no... he said he used the generic yahoo contact forms, they didn't respond. you're an idiot.
- delecti 12y ago
  > that have yielded any luck with trying to contact them regarding this Might be the important part of the quote you missed.
  - onewaystreet 12y ago
    He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.
- bdevani 12y ago
  Dude your screen name is really telling. He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust
  - onewaystreet 12y ago
    You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true https://hackerone.com/yahoo?show_all=true.
    - olegbl 12y ago
      I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?
      - rnovak 12y ago
        if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?
frowaway001 12y ago
> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration And the feds are standing at his front door in 3 .. 2 .. 1.

by RyanZAG 12y ago

onewaystreet 12y ago

Looks like you only read the first couple lines. What I'm referring to: > I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.

panopticon 12y ago
I think the "that have yielded any luck" part of that quote is pretty important.
- onewaystreet 12y ago
  The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?
  - RyanZAG 12y ago
    Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.
  - bostonpete 12y ago
    I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.
    - onewaystreet 12y ago
      I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.
      - pg_is_a_butt 12y ago
        no... he said he used the generic yahoo contact forms, they didn't respond. you're an idiot.
delecti 12y ago
> that have yielded any luck with trying to contact them regarding this Might be the important part of the quote you missed.
- onewaystreet 12y ago
  He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.
bdevani 12y ago
Dude your screen name is really telling. He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust
- onewaystreet 12y ago
  You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true https://hackerone.com/yahoo?show_all=true.
  - olegbl 12y ago
    I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?
    - rnovak 12y ago
      if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?

frowaway001 12y ago

> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration And the feds are standing at his front door in 3 .. 2 .. 1.