Tag Info

Hot answers tagged

9

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you: Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just ...


8

You can Make a Responsible Disclosure with ZDI (Zero day Initiative), They are well known for their work and you have a good opportunity to earn some money depending on how strong exploits can be plotted upon the vulnerability you have found. Many security experts submit CVE's to ZDI, Its legal and secured in case you are afraid of company to sue you. ...


7

I think the most likely outcome would be delayed patches to fixes at the behest of friendly governments. Consider: Deliberately introducing flaws is not an easy thing. Anyone from the organization could look at the code and see the flaw - so the details might leak. Continuing point one, if the flaw causes an issue for customers, that would be bad rep for ...


6

The ethical approach is to report, confidentially, and to not combine the reporting with a request for payment to fix it, which could be seen as extortion. Explain how you found the problem, and possibly include steps to remedy what you found, but leave the fixing to them. As a Security Manager for an insurance company, I can tell you that I would be ...


6

If you are new to hunting I recommend starting out with WebGoat or Damn Vulnerable WebApp (DVWA). This is because it frames each vulnerability nicely, you just have to point and shoot. You can practice exploitation, and working with a real vulnerability. "The shooting range" There are real applications that where intentionally written to be insecure ...


5

There are a variety of approaches to promote the discovery and fixing of software vulnerabilities. The most common ways to provide compensation to researchers are bug bounties (run by vendors) and vulnerability brokers (who buy and sell information on vulnerabilities applicable to popular software). These are well described in A Comparison of Market ...


4

Although the question can be seen as subjective (I agree with that and suspect that you will be flagged) there is a very objective answer: "ask the software owner how they would like disclosure managed." If they are a reputable organization they will have a formal disclosure procedure to follow, so follow it. In most cases this involves submitting a CVE ...


4

Not all SQL errors can be exploited, however you need to investigate why the SQL error was generated. Often it's a sign of bad input validation, even when not exploitable (by you) it should be fixed. Furthermore, in production environments, error messages should be generic and not disclose any details about the error or your system's configuration.


3

The main risk of SQL errors being displayed is that if the input is vulnerable to SQL injection, it makes life far FAR easier for an attacker. They can input bad queries and the error message will tell them the source of the problem and thus give them information about the database. If the query that is erroring can not be altered by any user input, or the ...


3

You can't form good relationship with security researchers. The first problem is within your own company. When they report a bug, employees in your company go into a denialism phase, trying to prove it's not a bug. It doesn't matter how you feel, even if you are the CEO. One reason for this is that indeed, most vulns reported by security researchers are ...


3

There are several sites that support ethical disclosure. The movement is often referred to as "No More Free Bugs" A Google search for the same brought up this list of bounty/reward sites that seem legit, of course I can't vouch for all of them... http://blog.nibblesec.org/2011/10/no-more-free-bugs-initiatives.html


2

Of these market types, the first two can benefit individual security researchers, but must be initiated by the vendor. Therefore, only vulnerability information regarding vendors participating in such a solution would be valuable under such a mechanism. Depending on the level of participation, this could deeply hamper a security researcher. Vulnerability ...


2

Check out Stanford SecuriBench. It is a collection of open-source Java web applications that have had a variety of vulnerabilities, and which were used in some previous research papers to evaluate research tools. The collection is old (2005?) but it might still be useful for your purposes. The benchmark includes both artificial applications that were ...


2

Take a look at SpringMVC jPetStore it has a number of nice vulnerabilities. See http://o2platform.wordpress.com/category/java/spring-mvc/jpetstore/ for detailS, examples, code samples and fixes


2

Finding people who can get a clearance and program is going to become a priority, just like in the Aerospace/Defence industry, getting people who can do engineering and get a clearance is a priority. Dead wood people who have a clearance will have job security. Some kind of certification (of people) and "flight certification" of software will be common, ...


2

Which vulnerability scanner did you use, as I know a lot of them show up as false-positives (not exploitable but still need to be addressed as a lot of the time it can give out private information such as schema information, user information, etc). Also if you want to and is applicable, it may be an idea to run SQLMap or SQLNinja on it and see what it comes ...


1

There is no guaranteed safe solution for dealing with found vulnerabilities. There have been recent cases where researchers have been threatened with prosecution simply for reporting a simple URL vulnerability to a bank. The bank accused them of hacking, because it was a violation of their TOS to attempt to manipulate their URL. They are under no obligation ...


1

Use the company's "about" page or "contact us" to reach out to the right person. Also try emailing abuse@company.com, support@company.com, webmaster@company.com or postmaster@company.com You could also check the company's whois page, or do an ARIN lookup and email that contact


1

Derivatives as a solution to imbue IT vulnerabilities with economic force appears to be a confused idea with potentially disastrous consequences. The date of the paper on that subject should be considered in its review. In the heady days of 2007 prior to the fat tail event that we now know as the Great Recession risk swapping was all the rage. It turns ...



Only top voted, non community-wiki answers of a minimum length are eligible