4

Some time ago I discovered a security flaw regarding the password policy of my cellphone provider which basically makes the website, which includes access to personal information and invoices, vulnerable to brute-forcing (in a significantly short amount of time) and DoS. I reported it to their customer support but they didn't really care about. I was contacted by a technician telling me it's not a big deal but they will look into it. Now, months have passed and nothing has changed.

My question is: Are there any best practices how to deal with this situation (especially forcing the company to fix the issue and protect others) without me getting sued? If publishing the issue is an option: Where should I do that? (I don't have a blog, so that's not an option.)

Improve this question
2
  • What, specifically, is the vulnerability?
    – John Wu
    Commented Dec 2, 2015 at 8:38
  • I'd love to tell you but then I had already publicly disclosed the issue and the whole point of asking the question is gone. Let's just say an attacker is able to know the username and brute-force every password of every user in under 3 years or alternatively block access to every account permanently.
    – 23785623985
    Commented Dec 2, 2015 at 8:48

1 Answer 1

Reset to default
4

You can report it to CERT using this form below. Depending on the vulnerability, CERT will contact the vendor on your behalf:

https://forms.cert.org/VulReport/

Here is a quote from the link above for your reference:

If you believe you have found a security vulnerability that has not been resolved, please complete the following form. As our vulnerability disclosure policy explains, we send information submitted in vulnerability reports to affected vendors. By default, we will share your name with vendors and publicly acknowledge you in documents we publish. If you do not want us to share your name or publicly acknowledge you, select the appropriate responses in the form.

You can also reference the CERT policy for disclosures here:

http://www.cert.org/vulnerability-analysis/vul-disclosure.cfm

If CERT does contact the vendor the vulnerability will be disclosed after 45 days per the first paragraph from the link above:

Vulnerabilities reported to the CERT/CC will be disclosed to the public 45 days after the initial report, regardless of the existence or availability of patches or workarounds from affected vendors.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .