I am hoping I can get some direction on the correct way to go about properly disclosing serious shortcomings with a private web service API (closed source).
Initially I assumed that the API would be relatively well implemented, so I set about sniffing the traffic with Wireshark, intending to reverse engineer it firstly for the the challenge and secondly to hopefully implement it into another product I am working on (open source).
What I discovered plainly horrified me, there are major implementation issues which leave username/password details in clear text on the wire (as an example of just one issue).
The program is not widely used, however the user demographic it appeals to would likely be one where a 'valuable' password would often be used, and as such I feel this should be addressed by the author in some manner.
Naturally, and even though this will hamper my own efforts to integrate with the API if the author resolves the issues, I wish to disclose this to the author initially and then to the public, in the interest of having the problems resolved. To achieve these ends I would assume that I should follow Responsible Disclosure procedures.
This product does have some paying customers, however I am not one of these, and I only use the free version.
To the best of my understanding I should proceed as follows:
- Contact the Author(s) privately, outlining the issues discovered with risks and mitigation options for each.
- Determine a suitable time frame for patching the issues and releasing fixes with the program author.
- Once the time frame expires, I release details of the problems and proof of concept code.
Some worries I have however are:
- What is the best way to convey the message that I am not after any kind of financial gain, and that this is not personal and is not intended to harm the product or the company?
- What if, despite best efforts, the author of the product decides to get 'legal' to try and hide the issues? (Of course you're probably not lawyers, advice will be general guidance only).
- What is a valid release mechanism for the release of the details? I see announcements of this nature on the Full Disclosure mailing list often; is this generally regarded a suitable place for these?
- Would this require applying for a CVE number for the problems found?
- As I potentially would like to enter the information security field full time in the future, should I use a personal name on the disclosure? Or does this expose me to potential legal issues?