8

Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input filtering and a simple "<script>alert(1)</script> was possible.

When looking for a contact email to report the vulnerability I only found addresses for specific departments, like finance@badwebsite.com.

Since I did not want to just send the vulnerability report randomly I called the company, explaining that I found a problem in their website and that it would be a good idea to get it fixed. I explained that I would like to get in touch with someone from IT or someone who has any relation to the people that maintain the website.

The person on the phone got quite aggressive, told me to take a hike (used a bit less friendly language) and told me I had nothing to do with their IT department of website.

How can I convince people about the importance of a vulnerability and the disclosure when they are not familiar with IT? Especially when no email contact is possible?

FYI, I believe I was very polite and calm on the phone.

Improve this question
3
  • 2
    In short - I would speak to someone in a higher up position than the person you spoke to. Whoever spoke to you on the phone clearly has not heard of good customer service and I think this is where you should go in over their head so to speak. I realise you said no email contact is possible, I would phone up and ask to speak to a manager (perhaps find out who works there via Linkedin or something and tell the person who answers you're looking to speak to X person.)
    – user173641
    May 17, 2018 at 12:15
  • @JoshJones I believe you are 100% right, however in this case my attempt to get someone higher resulted in her getting aggresive and not being helpful at all. The only way to get higher up that I can think of would be LinkedIn and I am not too sure that is a good idea: EDIT: I see you added the looking at LinkedIn and then asking for him/her on the phone, that might actually be a good idea, thank you!
    – toom
    May 17, 2018 at 12:16
  • Yeah that's just awful customer service - you'd expect better but ignorance is bliss and all that. Yes that's the only other thing I can really think off short of calling them and hoping A. someone else picks up or B. somehow obtaining and email address of a supervisor.
    – user173641
    May 17, 2018 at 12:27

1 Answer 1

Reset to default
3

The ground rule is, if a website does not have a responsible disclosure policy any security team looking after their public resources is an indication that they neither care about the security of their resources nor they are going to consider any report from a random person yet. If I find some major issues in certain major company's website, I would report it through right communication channel and remind them couple of times and that should be it.

The person on the phone got quite aggressive, told me to take a hike (used a bit less friendly language) and told me I had nothing to do with their IT department of website.

You are a nobody and he is right. I guess he's not aware of things like bug bounty, independent security researcher. So it is hardly likely he's going to honor anything coming out of you. There have been numerous cases where the website owners got pissed and created problems for the researchers. The wise thing to do here is just let go and look for somewhere else where your efforts are appreciated. They have no written policy or procedure which can defend you if they were to ask you why you generated such malicious traffic on our website.

How can I convince people about the importance of a vulnerability and the disclosure when they are not familiar with IT? Especially when no email contact is possible?

The convincing in this case is to be done to the respective person and here you have no contact. You can't randomly go explaining the bits of weakness of their website to the guy who picks up the phone or sending the report via social media channel like Facebook. This would not be responsible disclosure.

The right thing to do is ask for their security team's contact information on their official contact email without explaining the issue. If you do get an official response then act accordingly otherwise they don't care and so should't you. You can send two or three polite weekly reminders and that's it.

Improve this answer
5
  • 1
    "He is right" I don't think getting aggressive over the phone is ever "right". That's just poor customer service if you're ignorant in an area getting aggressive at someone (even if you don't quite understand) is never an answer. How can you say that?
    – user173641
    May 17, 2018 at 12:53
  • What customer service are you talking about? Do they offer service like come and SQLi or XSS our website. When called ...you are acting as a security researcher with a security related concern. The customer service part is nonsense.
    – Youbecks003
    May 17, 2018 at 12:58
  • So you really believe that if you work for a company getting aggressive down the phone is okay? The person who answered represents that company every time they answer that phone, for them to get aggressive all that does is show the company in a poor light.
    – user173641
    May 17, 2018 at 13:00
  • The aspect here highlighted is "convincing one to act upon security issue". I answered it from a security searcher's point of view and what he seeks. I have no idea what you're talking about and points towards some HR, customer relations stuff which has nothing to do with .php?id=1 or "<script>alert(1)</script> or how to report the mentioned two or convince people to take the mentioned two seriously. Please stop.
    – Youbecks003
    May 17, 2018 at 13:12
  • While I get what your saying the first step is to be actually get in touch with someone related to Security. In this case that was not possible by an employee that believes I can hack their IT by getting their email address
    – toom
    May 17, 2018 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.