4

I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound packet capture and lo and behold there were my credentials plain in view for anyone to see. What's worse the credentials were sent back over the wire once again in plain text if the login failed.

On the upside, they're not affected by heart bleed because they don't even allow HTTPS traffic...

I have read Reporting vulnerable sites and similar but I believe this question is a bit different as first of all I'm personally affected and forced to use the site regularly as I'm employed by the company owning the site (albeit not responsible).

I have informed the IT department and got a response in the form

We have prior to your e-mail contracted a security firm that has done an extensive pen-test and among other things found your reported vulnerability. We're assessing the situation and will take action shortly.

Which to me means:

Hi we know we're leaking your passwords and we might patch it up in the coming months or maybe next year. Meanwhile, why don't you go down to the church and pray that no one empties your paypal account.

Motivated by the fact that I could just park my cellphone on wifi outside their office with wireshark running to grab the credentials of most people in the office. To me, their response is not good enough. Further more, all they need to do is to force HTTPS for all traffic as a stop-gap. This doesn't take more than a few hours for a system administrator who knows what they're doing. And it doesn't have a negative impact other than some performance (provided they have patched OpenSSL if they're affected).

My question is, how do I get them to first enable HTTPS for all traffic immediately and then inform all affected parties that their username/password credentials may have been compromised and that they need to change them at all places they use that combination. Without loosing my job.

For the record, yes, I have changed my passwords already. And I had a random 128bit password to their site to begin with because I got a feeling it was dodgy from first sight.

  • 3
    An immediate response is not likely. Patience is required, methinks. – Deer Hunter Apr 13 '14 at 11:11
  • 3
    It is impossible to get anyone to do something immediately in a large organization. Any IT infrastructur change needs to pass the review boards to make an assessment of possible business impact.You did the right thing. The rest is no longer in your hand. – Philipp Apr 13 '14 at 11:26
  • If a Pentest recently found it, chances are they'll fix it. If they didn't care about security or compliance they wouldn't have commissioned a pentest, and they won't pass important business checkpoints like PCI compliance if they have bugs like this outstanding on their internal or external infrastructure. If they have a security team, let them get on with their job. – Matt Apr 14 '14 at 1:31
  • 1
    The two parts of your question that are not explained are pray that no one empties your paypal account and park my cellphone on wifi outside their office with wireshark running to grab the credentials of most people in the office. Is their site integrated with PayPal? Also, is your employee network an open Wifi hotspot - this seems like a vulnerability in itself. – SilverlightFox Apr 14 '14 at 10:13
  • Lots of people use the same passwords for multiple things. Also, the wireless network can be secure, but employees have access, and so there's the vulnerability. – i-CONICA Mar 15 '16 at 15:11
3

There should be an entity responsible for security, such as an (chief) information security officer. It's a usually their job to take reports like yours and find the quickest way to solve the problem without compromising business. Giving it to the IT department often makes it a "support request without stakeholder" meaning you can still work so it's not that bad from their POV.

If you don't have that, you should write a friendly mail to management on the C-Level and inform them about the business risk that problems like this pose if they don't get attention right away. They can give that role of watching over these issues to an employee who is already working in the IT department so they don't necessarily need to hire someone.

Worked for me ;-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.