New answers tagged

0

How anonymously did you report the vulnerability? If they have no way to contact you back (eg. a random email on a free provider, or on a system like mailinator), maybe there are some reasons they haven't addressed it yet, but have no way to tell you. Or perhaps they tried to reproduce it but failed (some instructions where ambiguous, it only happens when ...


2

You should endeavor to disclose the vulnerability in a responsible and ethical fashion. look for a contact email of the individual who owns the site as well as anyone that does admin on it. Look up whois, this may have contact information for the person who registered the domain or a contact page on the site, I do not recommend using any information that ...


2

Thebluefish omitted to mention "Responsible Disclosure" where a trusted third party provides an escrow service for a limited amount of time, allowing the vendor to fix the fault while ensuring the discoverer is credited. CERT sponsor such an approach. But per the previous answer you need a proof of concept. Sadly, "security" products more often introduce ...


43

It would be a matter of opinion on how you should proceed. We already have a question explaining different ethical ways to report a vulnerability. First off, for something this big I would personally recommend you remain anonymous at first, while leaving a way to later prove it was indeed you who discovered the vulnerability. Create a brand new PGP key (not ...


8

You will want to verify that this is an actual vulnerability, typically by creating a Proof-of-Concept. From there, you could: Contact the vendor of the software in private, explain your findings and the problems associated with it, attaching the PoC for them to analyze. Release the vulnerability to the public, hoping that the extra attention will persuade ...


5

You want to take credit but you don't want to be known? That just won't work. Decide what's more important: Credit, or making the vulnerability known anonymously. If making it known is more important, I see you have a fresh account etc., that's good. (if it is really that big I hope you have a fresh OS on a new device, no browser profile, and Tor too. If ...


4

One of the methods you can use to create a baseline would be to go to sites like PacketStorm find say the last 50 vulnerabilities/exploits disclosed, then find out whether or not they have CVEs issued on Mitre. A baseline will give you just that, a baseline average. There are a few things to take into considerations: Not all exploits/vulnerabilities are ...


1

Honestly it really depends on the company. Every company handles their vulnerabilities differently, even some researchers who follow the process get screwed by it, just like this guy who filed a bug for Instagram. For those entered through the bug bounty program (if they have one), they will generally publish the information on their site or email to the ...



Top 50 recent answers are included