2

I have just finished building a CMS targeted at a certain industry and built a test site to see how everything works. I wrote a program to check for SQL injection vulnerabilities and the program followed a blog link to an external website.

The program discovered that the external site had a massive vulnerability that left it open to practically anyone who could then access every bit of data on their MySQL Server and run queries etc. The thing is this external site is the brand leader in their industry and do millions upon millions of sales per annum. I have tried contacting them to let them know and even went as far as contacting the company that built their platform but I was pretty much brushed off and haven't heard back from them. Their database would contain the details of hundreds of thousands of customers and all their data. I could easily make myself site admin etc in a few seconds but they won't listen to me even though I have offered to share the vulnerability with them and help in anyway I can.

Is there anything else I can do because it is one of the biggest security risks I have ever personally come across. Is there any other steps I should take to report this?

migrated from serverfault.com Aug 23 '14 at 13:51

This question came from our site for system and network administrators.

  • 1
    In my experience, most big companys ignore it until someone goes full disclosure. – user36976 Aug 23 '14 at 20:07
  • "Anyway I wrote a program to check for sql injection vulnerabilities and the program followed a blog link to an external website." - How confident are you that there's actually a vulnerability? A mere SQL error doesn't necessarily imply it's exploitable and there's already dozens of automated vulnerability scanners which mostly return false positives. – thexacre Aug 24 '14 at 1:14
  • thing is it checked the vulnerability and it was able to view any part of their databases, aswell as input any query I wish so it certainly is not a false positive – Ciaran87Bel Aug 24 '14 at 9:05
  • Since you had used the exploit yourself (with good intentions), you are now in an awkward position. If it's serious as you say, there is a good chance that someone else will exploit it and you could be put on the list of people who take the blame (something like "hey, someone stole our data, and this guy said he knew how to do it"). It's not uncommon for big companies to "shoot the messenger", instead of listening to him. Perhaps you could contact a security agency and discuss the vulnerability with them. Their reputation would shield you from repercussions. – Diego Aug 25 '14 at 10:35
  • As for the next action to take, I tend to agree with Nick and Ian, who posted an answer. If your concern is for the safety of information, going for full disclosure through a security firm would probably be the best way to make the company react quickly. Some heads could roll, but they were the ones who didn't listen in the first place. As I wrote to Ruwan, be careful if you are trying to get a reward, as it could backfire. Blaming you for any issue could save the involved parties' faces, and the rolling head could become yours. It would be unfair, but not unheard of. – Diego Aug 25 '14 at 10:46
3

Check out how Secunia deal with it. Might help you along:

http://secunia.com/community/research/policy/

If no security contact is known for the vendor, an e-mail requesting the security contact e-mail address may initially be sent to certain public e-mail addresses associated with the vendor. It is Secunia policy to never submit vulnerability information via online forms. However, these may be used to request security contact information.

When a security contact or other relevant e-mail address has been identified, a vendor initially receives a mail with vulnerability details along with a preset disclosure date (usually set to a Wednesday two weeks later).

If the vendor does not respond to the initial mail within a week, it is resent.

If no response has been received at the day of the preset disclosure date, the vulnerability information is published immediately without further coordination attempts.

If the vendor responds to either the initial mail or the resent mail, a new disclosure date may be set in case the vendor cannot meet the preset date.

Secunia expects vendors to provide continuous status updates on the progress. If none are provided by default, the vendor will be contacted about once a month with a status update request.

Should a vendor not respond to a status update request, it is resent a week later.

Should the vendor not respond to two consecutive status update requests, a mail is sent to the vendor advising that the vulnerability information will be disclosed a week later if no response is received. Has no response been received by this date, the vulnerability information is immediately published without further coordination attempts.

Eventually, the vulnerability information will be published by Secunia Research when:

a) The preset/agreed disclosure date is reached.

b) The vendor issues a fix and/or security advisory.

c) Information about the same vulnerability is published by a third party.

d) Either a half or full year has passed from the initial contact date (see #10 and #11 for more information).

By default, vulnerabilities are coordinated for no more than 6 months. About one month prior to the ½ year mark, the vendor is informed about a fixed disclosure date set by Secunia Research at the ½ year mark. At that time, a Secunia advisory is published regardless of patch availability.

A vulnerability may in certain cases be coordinated for up to one full year if the vendor is communicating a clear intention to address the vulnerability and can commit to a date within that period and the vulnerability is considered to be complex to address.

0

usually most of companies reply with their contact email address . or you can contact their webmaster by checking the footer bar who developed the site . if you are looking for bounty or send them a email with the proof and saying if they can pay a certain about you can also secure their web application . 1.checked weather they have facebook page / or employee in social network ( they sure have).
2.else your last option would be contact through hotline .

after all it's up to them about taking action. if they not fixed their bug, certainly some random guy will exploit the system with random google dork any soon

  • 1
    In my opinion, looking for a bounty could put him in trouble, as it could be interpreted as extortion. It's like going to a bank and tell them that you found a way to take the money out of the vault without anyone noticing, and that you would tell them how only if they pay you. As soon as one penny disappears, you would be the prime suspect. – Diego Aug 25 '14 at 10:40
  • Agree with the @Diego Suggestion. it's really depend on how you act in the situation . – Ruwan Ranganath Aug 25 '14 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.