How would I report an international security vulnerability which could cause a lot of damage?

I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. :)) so & I am trying to trade it to free someone.

  • 1
    What kind of a vulnerability? A software vulnerability in a software product from a particular company? – Xander Jul 19 '14 at 16:46
  • ah it's not i don't know how to explain it it's not a webapp vul or something like it's more bigger then that – userwsssqa Jul 19 '14 at 18:00
  • If it's a protocol vulnerability (so it would affect multiple products from multiple vendors) then the people to contact would be the maintainers of the protocol (probably the IETF) and any vendors who implement the protocol. Examples of this being done are Dan Kaminsky's DNS bug from 2008 and the more recent HeartBleed bug. In both cases, much was done in secret by the maintainers and vendors before the rest of us knew anything about it. – Ladadadada Jul 19 '14 at 18:23
  • "international security vulnerability" means nothing. You need to explain exactly where the vulnerability was found (not necessarily what it is) in order for anyone to be able to reasonably help you. – Xander Jul 19 '14 at 19:08
  • @Ladadadada Hearbleed was actually an implementation error, not a protocol error. It was a missing bounds check on an array, as far as I remember. – Steve Dodier-Lazaro Jul 19 '14 at 20:28

You need to privately contact the person who manages the software in which you found a vulnerability. Tell them about the vulnerability you found, including how you think it can be exploited and what you think it can do. Give them some time (often in the range of a few months) to verify your claims and provide a solution.

Once they have fixed the issue and a link to a patch has been made available to their customers, contact the CVE list and ask for a CVE number if you're out for the glory.

Edit: be aware that some software providers are morons and refuse to acknowledge their mistakes, so they try and sue whoever presents them with a vuln in order to quiet them and avoid the shame of having security issues in their software. Some cryptology researchers I've met have had this issue time and again with smart card manufacturers. If you suspect you're facing this type of individual, stay anonymous when reporting.

| improve this answer | |
  • i haven't found it on software it's an international sec vul it may bring down part of the web it's bigger then software vul example like the google network imagine that we only have the google search & the google went down – userwsssqa Jul 19 '14 at 17:54
  • As said above "international vuln" means nothing at all. Vulnerabilities arise from defaults in software or hardware, or from software/hardware being misconfigured. In any case there's an entity handling the different components that lead to the vuln existing. – Steve Dodier-Lazaro Jul 19 '14 at 20:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.