releasing information about security issues to the general public or a selected group.

learn more… | top users | synonyms

3
votes
1answer
72 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
3
votes
1answer
140 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
4
votes
1answer
270 views

Challenges of setting up responsible disclosure for my course

Does anyone have experience in setting up a responsible disclosure procedure for a company? I'm interested in taking up a university assignment involving this. I have read up on my governments ...
9
votes
1answer
195 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
4
votes
1answer
80 views

What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas). We notified the company, they ...
2
votes
1answer
97 views

Getting an employer to secure their website immediately

I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound ...
1
vote
0answers
157 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
2
votes
3answers
201 views

PGP on hibernation files?

I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ...
-1
votes
2answers
121 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
8
votes
4answers
284 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
19
votes
3answers
928 views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
4
votes
2answers
188 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
2
votes
2answers
90 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
6
votes
1answer
115 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
-4
votes
2answers
215 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
1
vote
2answers
95 views

Advice of responsible disclosure

Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the ...
3
votes
3answers
950 views

Ethics question, post-publication of 'DIY hack' that implies security hack

I've read this post at length, but I believe this question is subtly different. Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). ...
0
votes
2answers
93 views

How much detail to publicise when a software vendor patches and issues an advisory? [closed]

I am interested to hear what the community's thoughts are on detail provided by a software vendor along with a fix and a security advisory. For example, let's say that some kind of severe ...
6
votes
1answer
137 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
28
votes
8answers
3k views

Is it legal to find bugs on a website and report them to the website's owner?

I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
4
votes
3answers
185 views

Responsible Disclosures and Getting Sued

Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
13
votes
3answers
1k views

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
11
votes
2answers
282 views

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
2
votes
1answer
105 views

Where can I find articles about identity disclosure attack?

Where can I find more details about identity disclosure attack and it's prevention? If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
13
votes
2answers
901 views

How to not reveal that you are using PHP?

I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
6
votes
3answers
298 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
3
votes
2answers
224 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
5
votes
3answers
155 views

Disclosure in potential loss-of-life situations, with an uncooperative vendor

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
7
votes
4answers
410 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
18
votes
3answers
788 views

Should Stack Exchange be more obscure in its systems' structure?

I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
7
votes
3answers
2k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
2
votes
2answers
556 views

I fortuitously accessed the configuration of unknown router: how come and what now?

I've encountered a strange thing. I connected to an open Wi-Fi, then I was just fooling around. First, I visited 192.168.0.1 and it was a router configuration page but default password didn't work. ...
35
votes
5answers
968 views

How do I respond to a published security vulnerability in my application?

In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity. On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
2
votes
3answers
131 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
23
votes
7answers
652 views

Fostering an environment where honesty and disclosure are valued

UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
26
votes
5answers
3k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
234
votes
22answers
290k views

I found that the company I work for is putting a backdoor into mobile phones

I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval. We are not using this option, and it is probably there ...
3
votes
2answers
231 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
2
votes
1answer
502 views

Found huge bug, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a huge bug which gives me the possibility to get (through ...
1
vote
2answers
262 views

References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA [closed]

There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD. I'd like to know if there are any other references to this issue. This would help ...
5
votes
2answers
294 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
3
votes
5answers
393 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
7
votes
3answers
218 views

Disclosing security vulnerabilities to paying customers first

Particular case An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
7
votes
3answers
299 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
32
votes
6answers
2k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
17
votes
2answers
557 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
12
votes
3answers
789 views

Whistleblowing, business ethics and credit card data

I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view. I work for a ...
3
votes
4answers
945 views

What are the chances of a database being hacked?

How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database. I'm talking about e-commerce websites, and ...
4
votes
4answers
509 views

What particular concerns should one bear in mind when wardriving?

I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks. Right now, I'm still in the planning stages of this ...
4
votes
6answers
896 views

What might be the legal and policy consequences of traffic sniffing?

I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...