releasing information about security issues to the general public or a selected group.

learn more… | top users | synonyms

1
vote
1answer
50 views

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy?

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013. The ...
1
vote
2answers
34 views

Risk of Production Data in Test / QA Environments

Looking for risks associated with seeding QA or Testing environments with data from production. Other than a compromise of the test environment leading to information disclosure (made worse if that ...
-4
votes
0answers
44 views

How do I report if I find a security exploit? [duplicate]

A while ago I found a pretty bad SQLi in a phpMyAdmin in a site and I dont know how to report it without risking my self. Any ideas?
7
votes
1answer
81 views

How does responsible disclosure work, once vendor says it's not a security bug?

I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not ...
60
votes
3answers
4k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
4
votes
2answers
205 views

What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas). We notified the company, they ...
19
votes
1answer
1k views

What to do after you get a CVE?

I recently reported a security vulnerability and it was patched. The patch (and associated issue) are both out in the open in a Github repo (aka public). I contacted cve-assign@mitre.org to get a CVE ...
3
votes
1answer
43 views

How to contact a tech company's CERT?

Given I discovered a vulnerability in a product, e.g. a networking product, and can't find the email address of neither their CERT nor a disclosure contact, how should I report the vulnerability? ...
7
votes
3answers
166 views

I anonymously submitted a security vulnerability, but it was not resolved. What now?

This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment? More than four months on after I ...
7
votes
3answers
214 views

Found a security vulnerability on gov related site

So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited. I was on a government utility (being vague intentionally) ...
52
votes
9answers
4k views

How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]

I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware. I had look at similar question however ...
36
votes
6answers
5k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
4
votes
1answer
49 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...
51
votes
4answers
5k views

Why submit a website to plaintext offenders?

I've read this question and to quote from the accepted answer Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case....
5
votes
2answers
257 views

How to widely advertise a fixed important threat in widely used open source software?

6 months ago, I found a buffer overflow in git which has the same impact as this vulnerability (with the execption that it allow server side code execution). It got several cve assigned to it and was ...
78
votes
2answers
16k views

I'm a White Hat and I develop my own viruses. Should I report it when almost all scanners say the executable is safe?

I develop my own viruses for 'scientific' purposes, namely to see if they pass the test of Virustotal.com. They all do, except for one or two scanners. Is this considered something you should report ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
5
votes
1answer
372 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
3
votes
2answers
147 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
3
votes
1answer
1k views

Found security vulnerbility, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a security vulnerability which gives me the ability transfer money ...
1
vote
2answers
290 views

References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA [closed]

There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD. I'd like to know if there are any other references to this issue. This would help ...
5
votes
1answer
71 views

How to deal with found security issues on third party websites?

Some time ago I discovered a security flaw regarding the password policy of my cellphone provider which basically makes the website, which includes access to personal information and invoices, ...
7
votes
2answers
158 views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
4
votes
1answer
115 views

Approach business(es) with security vulnerabilities

As a security researcher, I have become familiar with different related tools and software packages. The other day, I opened up one of those software packages and was attempting to attack a personal ...
22
votes
3answers
485 views

As a student, how do I safely and responsibly disclose a serious security issue in a school environment?

I am a student at my local school. About eight months ago, I stumbled upon a security hole that could allow any user to discover any student's ID in the entire district, and I am aware that the IT ...
9
votes
2answers
3k views
111
votes
7answers
9k views

How do I report a security vulnerability about a trusted certificate authority? [duplicate]

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
4
votes
1answer
71 views

Where should a Vulnerability Disclosure Policy be published?

In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf Part of the recommendations ...
27
votes
1answer
3k views

What is an n-day security attack?

There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?
13
votes
3answers
994 views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
4
votes
0answers
151 views

What to do if I accidentally DoS a site? [closed]

A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
2
votes
2answers
91 views

Disclosure and HTTP status codes

Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely. These days it's supposed to be a good practice to ...
5
votes
5answers
313 views

Should you notify software vendors that their software has been cracked?

Apologies if this is not the right place to ask this question, I will happily move it to another Stack Exchange site if need be. Before I explain the rationale behind the question, let me clear up a ...
9
votes
3answers
472 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
5
votes
2answers
307 views

My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]

Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
67
votes
10answers
8k views

How to report vulnerabilities without being regarded as a hacker?

I just discovered that my university alumni's login page is just plain HTTP. Wireshark confirmed that the credentials are sent using an HTTP POST message. I did a bit of research and, as I thought, ...
301
votes
22answers
295k views

I found that the company I work for is putting a backdoor into mobile phones

I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval. We are not using this option, and it is probably there ...
2
votes
1answer
385 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
3
votes
1answer
211 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
4
votes
1answer
299 views

Challenges of setting up responsible disclosure for my course

Does anyone have experience in setting up a responsible disclosure procedure for a company? I'm interested in taking up a university assignment involving this. I have read up on my governments ...
9
votes
1answer
250 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
3
votes
1answer
219 views

Getting an employer to secure their website immediately

I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound ...
2
votes
3answers
268 views

PGP on hibernation files?

I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ...
-1
votes
2answers
202 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
8
votes
4answers
337 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
5
votes
2answers
1k views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
6
votes
1answer
123 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
-4
votes
2answers
382 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
1
vote
2answers
132 views

Advice of responsible disclosure

Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the ...
3
votes
3answers
1k views

Ethics question, post-publication of 'DIY hack' that implies security hack

I've read this post at length, but I believe this question is subtly different. Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). ...