releasing information about security issues to the general public or a selected group.
2
votes
3answers
83 views
Responsible Disclosures and Getting Sued
Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
3
votes
1answer
63 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
12
votes
2answers
638 views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
6
votes
3answers
202 views
How and where can I best announce an XSS vulnerability in a relatively well-known website?
I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
2
votes
3answers
126 views
PGP on hibernation files?
I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time
Seem to me that PGP and other sensible tools have to lock memory to ...
3
votes
2answers
189 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
5
votes
3answers
136 views
Disclosure in potential loss-of-life situations, with an uncooperative vendor
I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
18
votes
3answers
751 views
Should Stack Exchange be more obscure in its systems' structure?
I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
0
votes
0answers
79 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
6
votes
3answers
495 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
31
votes
5answers
772 views
How do I respond to a published security vulnerability in my application?
In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity.
On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
2
votes
3answers
102 views
How to make an outbound request to users to update their passwords?
Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
203
votes
22answers
287k views
I found that the company I work for is putting a backdoor into mobile phones
I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.
We are not using this option, and it is probably there ...
0
votes
0answers
107 views
Submitting a Vulnerability / Exploit [closed]
Regarding submitting a vulnerability to sites like packetstorm or exploitdb,
I have found a SQL Injection flaw in version 7.0.0 of a piece of software. There are currently no submitted vulnerabilities ...
3
votes
2answers
165 views
How can I report an ecommerce site in violation of security practices?
I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
2
votes
2answers
275 views
I fortuitously accessed the configuration of unknown router: how come and what now?
I've encountered a strange thing. I connected to an open Wi-Fi, then I was just fooling around. First, I visited 192.168.0.1 and it was a router configuration page but default password didn't work.
...
1
vote
1answer
361 views
Found huge bug, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a huge bug which gives me the possibility to get (through ...
2
votes
2answers
240 views
References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA [closed]
There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD.
I'd like to know if there are any other references to this issue. This would help ...
23
votes
7answers
599 views
Fostering an environment where honesty and disclosure are valued
UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
6
votes
2answers
249 views
Ethics and economy in security research
How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way?
Assume a market where the participants are governments, ...
5
votes
3answers
208 views
Disclosing security vulnerabilities to paying customers first
Particular case
An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
6
votes
3answers
256 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
3
votes
4answers
649 views
What are the chances of a database being hacked?
How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database.
I'm talking about e-commerce websites, and ...
12
votes
3answers
546 views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
17
votes
2answers
433 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
20
votes
5answers
1k views
Open Source vs Closed Source Systems
My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, ...
4
votes
6answers
539 views
What might be the legal and policy consequences of traffic sniffing?
I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
10
votes
2answers
246 views
Progress in market approaches to software vulnerability disclosure?
In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
11
votes
3answers
724 views
Which companies facilitate payment in return for vulnerability disclosure?
If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
5
votes
5answers
263 views
Effect of Source Code Leakage of a security suite on security
I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:
...
8
votes
2answers
187 views
How do you address a social engineering and or software weakness/concern in a company or organisation?
Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
7
votes
1answer
811 views
Is there a way for a consumer to report PCI non compliance?
Is there a way for a consumer to report PCI non compliance?
5
votes
1answer
523 views
Tools to identify and report hacking attempts originating inside reputable organizations?
Re: Should I report hacking attempts? - Server Fault
Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
11
votes
2answers
318 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
4
votes
4answers
382 views
What particular concerns should one bear in mind when wardriving?
I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks.
Right now, I'm still in the planning stages of this ...
9
votes
3answers
279 views
Reporting vulnerable sites
Take this scenario:
You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
7
votes
4answers
346 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
3
votes
5answers
318 views
Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?
This is a multi-part question....
In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better?
...
24
votes
6answers
881 views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
