5 ms·

The Property Jungle: I'm a security researcher, get me out of here

37 points by dchest 11y ago

deleted 11y ago
[deleted]
marak830 11y ago
Bloody hell, way to drop the ball. Im quote grateful i dont work in this guys field, id flip out at someone within a week.
- stewartbutler 11y ago
  No matter how egregious the security risk is, I have a hard time taking anyone who uses twitter to contact someone they want to do business with seriously. Or any social media, tbh. It comes off as unprofessional to me, and it is especially unbecoming if you are a security researcher and this is the first resort. It immediately removes any chance of them handling the issue discreetly, and puts them in a defensive position. Why the hell would you do that?
  - deutronium 11y ago
    Yeah I was thinking that, surely an e-mail would be the first point of call rather than mentioning it in public. Also using public tweets doesn't seem particularly professional to me, to start a discussion on vulnerabilities.
    - pm24601 11y ago
      this is the way sec. researchers make that first contact. Easiest way to reach a live person. With email, it can be hard to find on a website that isn't just a generic email address that will go to someone who has no clue. Paul made the effort - TPJ attacked.
  - marak830 11y ago
    I agree with you, but surely replying woth an email address would have been the logical thing todo, instead of a passive agressive "its on our website. His explanation of it veing to find a more accurate email adress is understood, although i would have probably just emailed the default on the site and asked via there.
  - chickenheads 11y ago
    the author of the blog post didn't publish his email to the guy who's site was vulnerable. Only the site's reply. I could only imagine how the original email to the company was worded. There's something here about treating someone, even an ignorant idiot (whose only fault is being ignorantly and aggressively presumptuous), with a basic level of professional courtesy. You either foster that basic level of respect or you act like a child in need of attention. I would never hire this security researcher if I read this blog post. Communication is one of our most important skills.
    - pm24601 11y ago
      Who cares about hiring Paul? TPJ is ignoring the vulns that Paul is trying to inform them of discretely. As a consequence of TPJ's attitude - Paul is doing the next best thing of letting TPJ customers know that they are at risk.
  - tptacek 11y ago
    Software security people routinely make contact with affected vendors through Twitter, so you're going to have a hard time with the whole field.
  - mmahemoff 11y ago
    Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-waster/spammer and in that sense, it's easier for the company to take his approach seriously than if he'd sent a random email in to sales@. Had the company done the right thing and taken him seriously, it would have led to a faster escalation on that basis. He could have immediately emailed the issue and the company would know to expect it and who they're dealing with.
  - pm24601 11y ago
    Paul is doing TPJ a favor - why should Paul exert a huge amount of effort? It was probably the easy way to contact them. Paul is right to not want to talk over the phone: Large amount of time + hard to clear explain exact vulnerability to non-technical types.
chickenheads 11y ago
this is fundamentally a problem with how hackers use twitter and how businesses use twitter. How can this security researcher not see this situation from the business owners mind? The business owner isn't DM'ing 1337's all day about the sqli he finds. The business owner ADMITS that HE BELIEVES the researcher is trying to extort him. All he had to say was "nah dude, this b wicked serious mon no charge check it". But instead he wants to be the internet security researcher hero. SCREW this. Yeah they skirted him with a nastygram but have we really become this thin skinned? This is some sissy boy sh1#.
g0v 11y ago
I feel as though both parties could have handled that better. Contacting a company about a security vulnerability via a tweet, there must be a better way about that. And the company's response seemed pretty disproportionate to me. Maybe someone will learn something from this, or maybe not.
- merpnderp 11y ago
  He clearly stated that they only had a sales email available on their site, and he politely asked for a DM for an appropriate way to contact them. If a company has an active Twitter account it is appropriate to contact them through it. I've done this several times with quite happy results on both ends.
  - g0v 11y ago
    Well, good to know. I guess I'm not familiar with how things can be done. Thanks for the heads up.
- wfo 11y ago
  It appears they might have had a lot of obnoxious aggressive sales spam BS on twitter and they've pretty much learned to ignore twitter; I wouldn't blame any company or person for essentially ignoring it, it's a silly format for unimportant things by design. And the right answer to someone saying "stop trying to scam us" is to say "I'm sorry if I came off like that but that's not what this is about" not write a whiny blog post about how nobody takes your tweets seriously.
raesene2 11y ago
Its a shame to see the company react like this, but the author is taking a bit of a risk here. Finding sql injection requires active testing of the site which, without authority to test, may fall into a gray area of uk law about whether its in breach of the computer misuse act. Now you'd hope the company will take this as intended, but some organisations will take being embarassed like this poorly.
contingencies 11y ago
Bad communication all around. At least the MD states his thinking. Security world is full of puerile one-upmanship. It's far harder to build something than to break it.
tim333 11y ago
Hmm... Pretty much the first line of the Property Jungle's website is "Call us on 0808 1800 178." I'm not sure why his first action was to tweet "critical security issue" publicly. It can see why the Property Jungle guy would have thought it was a revenue extraction thing.
jason_s 11y ago
DM = ?
- dchest 11y ago
  Direct message (Twitter's feature)
colomohare 11y ago
People who manage social media for companies are trained to filter out the shit before it reaches the managing director. This tubby bitch decided to try and boost his self importance because he THOUGHT he found a vulnerability by slagging them off to their customers and then has the gall to whinge about someone being unprofessional. The mind boggles!

37 points by dchest 11y ago

deleted 11y ago

[deleted]

Bloody hell, way to drop the ball. Im quote grateful i dont work in this guys field, id flip out at someone within a week.

stewartbutler 11y ago
No matter how egregious the security risk is, I have a hard time taking anyone who uses twitter to contact someone they want to do business with seriously. Or any social media, tbh. It comes off as unprofessional to me, and it is especially unbecoming if you are a security researcher and this is the first resort. It immediately removes any chance of them handling the issue discreetly, and puts them in a defensive position. Why the hell would you do that?
- deutronium 11y ago
  Yeah I was thinking that, surely an e-mail would be the first point of call rather than mentioning it in public. Also using public tweets doesn't seem particularly professional to me, to start a discussion on vulnerabilities.
  - pm24601 11y ago
    this is the way sec. researchers make that first contact. Easiest way to reach a live person. With email, it can be hard to find on a website that isn't just a generic email address that will go to someone who has no clue. Paul made the effort - TPJ attacked.
- marak830 11y ago
  I agree with you, but surely replying woth an email address would have been the logical thing todo, instead of a passive agressive "its on our website. His explanation of it veing to find a more accurate email adress is understood, although i would have probably just emailed the default on the site and asked via there.
- chickenheads 11y ago
  the author of the blog post didn't publish his email to the guy who's site was vulnerable. Only the site's reply. I could only imagine how the original email to the company was worded. There's something here about treating someone, even an ignorant idiot (whose only fault is being ignorantly and aggressively presumptuous), with a basic level of professional courtesy. You either foster that basic level of respect or you act like a child in need of attention. I would never hire this security researcher if I read this blog post. Communication is one of our most important skills.
  - pm24601 11y ago
    Who cares about hiring Paul? TPJ is ignoring the vulns that Paul is trying to inform them of discretely. As a consequence of TPJ's attitude - Paul is doing the next best thing of letting TPJ customers know that they are at risk.
- tptacek 11y ago
  Software security people routinely make contact with affected vendors through Twitter, so you're going to have a hard time with the whole field.
- mmahemoff 11y ago
  Seems fine to me, considering the company doesn't advertise any security email. The researcher has a solid Twitter profile that establishes he's not some time-waster/spammer and in that sense, it's easier for the company to take his approach seriously than if he'd sent a random email in to sales@. Had the company done the right thing and taken him seriously, it would have led to a faster escalation on that basis. He could have immediately emailed the issue and the company would know to expect it and who they're dealing with.
- pm24601 11y ago
  Paul is doing TPJ a favor - why should Paul exert a huge amount of effort? It was probably the easy way to contact them. Paul is right to not want to talk over the phone: Large amount of time + hard to clear explain exact vulnerability to non-technical types.

chickenheads 11y ago

this is fundamentally a problem with how hackers use twitter and how businesses use twitter. How can this security researcher not see this situation from the business owners mind? The business owner isn't DM'ing 1337's all day about the sqli he finds. The business owner ADMITS that HE BELIEVES the researcher is trying to extort him. All he had to say was "nah dude, this b wicked serious mon no charge check it". But instead he wants to be the internet security researcher hero. SCREW this. Yeah they skirted him with a nastygram but have we really become this thin skinned? This is some sissy boy sh1#.

g0v 11y ago

I feel as though both parties could have handled that better. Contacting a company about a security vulnerability via a tweet, there must be a better way about that. And the company's response seemed pretty disproportionate to me. Maybe someone will learn something from this, or maybe not.

merpnderp 11y ago
He clearly stated that they only had a sales email available on their site, and he politely asked for a DM for an appropriate way to contact them. If a company has an active Twitter account it is appropriate to contact them through it. I've done this several times with quite happy results on both ends.
- g0v 11y ago
  Well, good to know. I guess I'm not familiar with how things can be done. Thanks for the heads up.
wfo 11y ago
It appears they might have had a lot of obnoxious aggressive sales spam BS on twitter and they've pretty much learned to ignore twitter; I wouldn't blame any company or person for essentially ignoring it, it's a silly format for unimportant things by design. And the right answer to someone saying "stop trying to scam us" is to say "I'm sorry if I came off like that but that's not what this is about" not write a whiny blog post about how nobody takes your tweets seriously.

raesene2 11y ago

Its a shame to see the company react like this, but the author is taking a bit of a risk here. Finding sql injection requires active testing of the site which, without authority to test, may fall into a gray area of uk law about whether its in breach of the computer misuse act. Now you'd hope the company will take this as intended, but some organisations will take being embarassed like this poorly.

contingencies 11y ago

Bad communication all around. At least the MD states his thinking. Security world is full of puerile one-upmanship. It's far harder to build something than to break it.

tim333 11y ago

Hmm... Pretty much the first line of the Property Jungle's website is "Call us on 0808 1800 178." I'm not sure why his first action was to tweet "critical security issue" publicly. It can see why the Property Jungle guy would have thought it was a revenue extraction thing.

jason_s 11y ago

DM = ?

dchest 11y ago
Direct message (Twitter's feature)

colomohare 11y ago

People who manage social media for companies are trained to filter out the shit before it reaches the managing director. This tubby bitch decided to try and boost his self importance because he THOUGHT he found a vulnerability by slagging them off to their customers and then has the gall to whinge about someone being unprofessional. The mind boggles!