releasing information about security issues to the general public or a selected group.

learn more… | top users | synonyms

44
votes
6answers
6k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
37
votes
6answers
5k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
6
votes
2answers
1k views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
13
votes
3answers
1k views

Reporting vulnerable sites

Take this scenario: You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
9
votes
3answers
476 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
22
votes
3answers
500 views

As a student, how do I safely and responsibly disclose a serious security issue in a school environment?

I am a student at my local school. About eight months ago, I stumbled upon a security hole that could allow any user to discover any student's ID in the entire district, and I am aware that the IT ...
3
votes
1answer
1k views

Found security vulnerbility, what should I do? [duplicate]

Possible Duplicate: How to disclose a security vulnerability in an ethical fashion? Reporting vulnerable sites I've found a security vulnerability which gives me the ability transfer money ...
67
votes
10answers
8k views

How to report vulnerabilities without being regarded as a hacker?

I just discovered that my university alumni's login page is just plain HTTP. Wireshark confirmed that the credentials are sent using an HTTP POST message. I did a bit of research and, as I thought, ...
16
votes
3answers
2k views

Which companies facilitate payment in return for vulnerability disclosure?

If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
19
votes
2answers
807 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
3
votes
5answers
481 views

Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?

This is a multi-part question.... In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better? ...
112
votes
7answers
9k views

How do I report a security vulnerability about a trusted certificate authority? [duplicate]

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
78
votes
2answers
16k views

I'm a White Hat and I develop my own viruses. Should I report it when almost all scanners say the executable is safe?

I develop my own viruses for 'scientific' purposes, namely to see if they pass the test of Virustotal.com. They all do, except for one or two scanners. Is this considered something you should report ...
37
votes
5answers
1k views

How do I respond to a published security vulnerability in my application?

In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity. On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
7
votes
2answers
415 views

Ethics and economy in security research

How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way? Assume a market where the participants are governments, ...
11
votes
2answers
382 views

Progress in market approaches to software vulnerability disclosure?

In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder software ...
9
votes
4answers
677 views

How should I escalate a vulnerability that is dismissed by the vendor?

I've come across a vulnerability that secure@microsoft does not think is worth pursuing. I would estimate that there are many, many customers affected by this issue. I do not want to start a ...
6
votes
1answer
1k views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
6
votes
1answer
123 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
3
votes
1answer
212 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
4
votes
2answers
266 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
4
votes
1answer
49 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...