Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly security vulnerabilities.

How can I make this information public, without compromising a platform that's used by thousand of people?

From my point of view, simply communicating this to the bank's development team is insufficient; I'd like to be sure that they subject the platform to vulnerability assessment.

  • 5
    Is a 500 error all you have? A 500 error could mean a range of things, most of which have no security implications. In fact the 500 error could be a security measure itself if it's being thrown because some irregularity is being encountered. – thexacre May 2 '14 at 11:04
  • Yes I know. They have for the "soft fail" the error landing page with html and everything nice, but for this one I get plaintext horrible list of errors with exceptions etc. – Igor May 2 '14 at 11:16
  • I suppose the errors are due to bugs in back end code, possibly security vulnerabilities. That's a pretty big assumption. If you go to them with this as proof of a security vulnerability, I doubt they will take you seriously. – Abe Miessler May 2 '14 at 18:11
  • 1
    Banks in most countries have to prove to their regulators that they take reasonable steps to protect their systems, they usually provide a security hotline or email at the least. They are balancing risk, if you don't think they are secure enough for you, you should look elsewhere. – Eric G May 2 '14 at 23:37

A 500 server error might hint that you did something the developers weren't expecting, but it does not mean that there is a vulnerability. Maybe it just outputs a "hacking attempt averted" message in the log and gives you a nondescript error to not give you any useful information.

When you are convinced the software is unsafe, you could spread some FUD online about the software and the banks using them, but any reaction you will trigger would be a cease&desist letter for slandering. Unless you have a working exploit which proves that there is a vulnerability, nobody has a reason to believe that you really found one.

But trying to find and use such an exploit on a production system you do not own can be a criminal act in many parts of the world and can bring you into serious legal problems. When you want to do penetration-testing on a software, you need to set up your own, private instance. When the software is not freely available, this can be quite difficult to do.

Informing the developers that you might have found a bug in their software is really all you can do. When they believe that the bug is not exploitable and unlikely to be triggered by a normal user and thus not worth fixing, that's their decision.

| improve this answer | |

You cannot make a vulnerability public and expect it somehow not to be exploited. You need to tell the bank about any vulnerability you have found and give them an opportunity to fix it. If they don't fix it then going public is one possible way of naming and shaming them to rectify the problem, but it's generally considered a last-gasp opportunity.

As for how the bank fix it that's their problem, not yours.

| improve this answer | |

I'd say just contact their customer support and mention you experienced an error and post a print screen. Based on what you've described I don't think you've got sufficient proof of an actual vulnerability, so I don't think you really have an obligation to ensure they resolve it to your expectations.

I suppose it depends on the country, but I'd also be very surprised if you gave them a print screen with a stack trace or similar to their customer support and it didn't get escalated to their security team immediately. Banks tend to take security very seriously and it's in their interest to investigate it thoroughly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.