Timeline for Should I report a security vulnerability?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 12, 2019 at 0:21 | comment | added | Ángel | @ConorMancone the national CERT will care about that, enough to forward the report to the proper recipient. In case it wasn't a US company, I would recommend contacting instead the respective national CERT (you can find most of them on FIRST), but other than that, a working CERT that receives a proper report for a company under their constituency, will (attempt to) report it to the affected party. It is their job! | |
| Nov 11, 2019 at 16:47 | comment | added | Mike Ounsworth | Thanks @EsaJokinen! I've borrowed that into my answer! | |
| Nov 11, 2019 at 16:47 | history | edited | Mike Ounsworth | CC BY-SA 4.0 |
Edit incorporating comments.
|
| Nov 11, 2019 at 16:38 | history | edited | Mike Ounsworth | CC BY-SA 4.0 |
added 1438 characters in body
|
| Nov 10, 2019 at 0:49 | comment | added | CJ Dennis |
This is the first time I've heard of .well-known. Ironic, isn't it?
|
|
| Nov 9, 2019 at 11:34 | comment | added | Esa Jokinen | "Things that are sometimes ok" could include running the scanner in the first place. Unless you are hired to do that or there's a bug bounty program, it could be interpreted as a hacking attempt. | |
| Nov 8, 2019 at 19:27 | comment | added | Conor Mancone | So basically I was wondering if US Cert might be the sort of organization that would get involved in something so tiny, or if they were more interested in "substantial" threats. If you're not sure though then I'll google or maybe just contact them anyway | |
| Nov 8, 2019 at 19:27 | comment | added | Conor Mancone | There is a local app here that has some severe weaknesses. I found them without even doing any actual penetration testing - their application effectively has zero security at all. It's a tiny system, but has probably a few thousand users (with passwords) in a database that is wide-open to easy SQLi. I sent a full disclosure report to the vendor but was completely ignore (contacted through multiple channels). They might take it more seriously if someone other than an anonymous person contacted them. | |
| Nov 8, 2019 at 19:07 | comment | added | Mike Ounsworth | @ConorMancone Which chat channel? I don't know a ton about US CERT, except that they will act as an intermediary where a researcher is too small to get noticed, wants to maintain anonymity, or the researcher feels they will be legally intimidated by the vendor. From the linked site: "CISA will attempt to coordinate all reported cyber vulnerabilities with the affected vendor of industrial control systems or information technology products." | |
| Nov 8, 2019 at 18:37 | comment | added | Conor Mancone | This is the first time I've heard of US Cert. If you have time, would you mind joining me in chat so I can ask you a question about it? Obviously no big deal if you can't | |
| Nov 8, 2019 at 17:52 | history | answered | Mike Ounsworth | CC BY-SA 4.0 |