3 ms·
I never asked for any money. Here's my full initial email to them: "Hi I would like to inform you about a critical security vulnerability on your site. The v
by sebiw 11y ago
I never asked for any money. Here's my full initial email to them:
"Hi
I would like to inform you about a critical security vulnerability on your site.
The vulnerability allows an attacker to reset the password of an account by simply knowing the targets email address.
Please reply with a signed S/MIME message and I will precisely explain the vulnerability to you.
Kind regards,
..."
- vinhboy 11y agoDang, that's terrible that they did not respond immediately. Goodluck. I hope you get a favorable resolution.
- zorked 11y agoWhile the whole situation is bad, you are being hit by a case of bad customer support, not necessarily a company that does not care about security. They didn't understand your message. It's bad. But it's still reasonable to not assume the worse. Email the CEO or try to reach some developer on LinkedIn or Twitter.
- edent 11y agoThe problem is, companies get a tonne of emails like this - usually from crackpots who think that they've found a vulnerability when they haven't. May I suggest an email which establishes your credentials and gives a bit more details - without necessarily telling a customer service agent the full details. For example: > My name is Bob, I'm a security researcher at FooCorp. I've discovered a serious security vulnerability with your XYZ system. It is possible to reset customers' accounts without any authorisation. I've been able to replicate this on test account abc@123. I think this is caused by a misconfigured widget. Please can you forward this message on to your head of security. You can see my previous security work at http://... http://.... Something like that may be more likely to get some positive attention.
- nmrm2 11y agoI've been able to replicate this on test account abc@123. I'd leave that out unless you're confident the company isn't going to screw you. Speaking from experience.
- marcuzhn 11y agoI am not sure why all this hate, as I said we fucked up the way the initial ticket has been handled and it's sorted now. :P FYI we plan to release the fix shortly and sebiw has already been rewarded via our official bug bounty program.
- monatron 11y agoYou're not exactly making things much better with the professionalism of your replies.
- hluska 11y agoDo you actually want an answer to that question??? It may just be a rhetorical question, or you may genuinely be wondering why you aren't getting the reaction you want.
- 16bytes 11y agoI think that you are misinterpreting this statement as a general caution. Sending a company proof that you've accessed a security hole (e.g. demonstrating it to them) can and has been prosecuted against has a hacking attempt and/or unauthorized access. This is something every security researcher should know, and not necessarily pejorative against Nexmo in particular.
- nmrm2 11y agoSorry, I really didn't mean that as hate toward your company at all! The parent was offering general advice for working with companies, and I was offering a general observation about that advice (namely, don't admit to technically-a-crime unless you know you're working with someone in good faith). Nothing personal, and it sounds like you guys have handled things professionally :-) Edit: In particular and to clarify, my negative experience was not with your company.