3 ms·

They don't care? Full disclosure then.

• mryan 11y ago
  No. Even though the company does not care about their lack of security, the OP could risk opening himself up to legal issues if he announces the exploit and provides enough detail for it to be exploited.
  • sneak 11y ago
    What legal issues, specifically?
    • mryan 11y ago
      I'm not going to research specific statutes for you, if that's what you are asking. But some examples off the top of my head... Assume for the sake of argument that Nexmo is based in the UK. Using this exploit to access someone else's Nexmo.com account would be a violation of the Computer Misuse Act. Writing a blog post detailing exactly how you achieved this would be a public admission of violating the Computer Misuse Act. Another example: Person A publishes instructions detailing how to exploit this issue. Person B follows the steps, and causes financial harm to Nexmo. Nexmo sues Person B for exploiting their systems, and also names Person A in the lawsuit because their publication led directly to Person B's actions. I'm not certain either of these cases would hold up in court, but there is certainly a risk that Nexmo would take the second approach. In the OP's shoes, the safest thing is not to publish. I'm not saying that's the right choice - just the safest from a legal perspective.
• vonklaus 11y ago
  I'm no security researcher and have def never found a zero-day , but I think this is the thinking in the industry I identify with. Someone went out of their way to research this vulnerability and spent time on documenting and testing it. They then have the ability to own whatever infrastructure this leaves opened. So, they did the security teams job and helped out. They then take time to repeatedly contact you with sufficient documentation and the offer for more of their time for free to walk you through it. Twice. Security consultants get paid a lot of money and this service is offered for free of charge because of some hackers curiosity. The next step is not usually full disclosure but often, "I have written this blog post detailing the vulnerability and intend to post it in N days unless I hear from you" Then it is pretty fair game for full disclosure.