Tell and sell a (web app) vulnerability legally

Question

If someone discover an unknown vulnerability for a given online service or website, is there a decent way to sell it directly to the concerned entity.

Answer 1

There is no guaranteed safe solution for dealing with found vulnerabilities. There have been recent cases where researchers have been threatened with prosecution simply for reporting a simple URL vulnerability to a bank. The bank accused them of hacking, because it was a violation of their TOS to attempt to manipulate their URL.

They are under no obligation to deal with you. They did not contract with you to search for vulnerabilities. So don't expect much in the way of cooperation.

Consider using a third party remailer to contact them. You could anonymously offer them the vulnerability, along with a code word, then approach them later after they agree not to prosecute.

You could also approach them through one of their vendors. If you see that their site is hosted on IIS, you could contact Microsoft's security team instead of the organization.

Answer 2

The only 'decent' way to make money off of found security bugs, unless you were contracted to do so in advance, is through 'bug bounty' or similar programs. If you contact a company to inform them of the bug and request money before telling them, you will quite likely be in legal trouble for extortion.

There is really only one way I have seen in which you could possibly prevent the extortion claim. That would be to give them a signed NDA, basically saying that you will not release information on the bug to anyone other then them, even if they decline your offer. The offer being that you give them info on the bug if they chose to pay you, otherwise you take it to your grave. But this would still be a tough go.

It's likely better for you to release the information via normal methods, professional security mailing lists, etc... Get your name out there as a security researcher, get more contracts, etc.

Edit: as pointed out in the comment, I didn't mention third party programs, i.e. zerodayinitiative.com which depending on what you've found, would certainly be worth looking into.

Answer 3

It's simple, call them, ask about what you are trying to report.(If you can't find anything online about a bounty or reward for bug-reports of some sort)

Ask them if they'll have some program of that kind of stuff, if they say NO, well your only way is contacting someone who can change this, like the "president" of the company (just speaking out of my head).

But, bug-reports all applications and web services have... if you'd found an exploit, that would be a different thing, and most big companys award big money for that, (google, facebook and so...).

If you could post what company exactly, it'd be more helpful because that kind of things depend in each and everyone of them.