7

It's not so much a technical vulnerability, but rather a sloppy security practice by a web design consultancy. They use a CMS which they've augmented with an admin login. As it happens, the admin users are stored in a table and the password field is plaintext.

Having seen which username/password they used for my client's site, I am 99% sure that it's the same password on other sites they've designed. A dozen websites in their portfolio have an identical admin login form, but obviously I cannot legally test whether the site is vulnerable, because the only way to do that would be to actually attempt to log in.

Would it be a reasonable course of action to contact these sites individually, tell them about my suspicion and suggest how they can fix it?

More importantly, am I putting myself at risk by doing so? The smarter owners will figure out that if they are vulnerable, so are the other sites in the portfolio, and could do nasty things, at the same time as I tell those sites that I happen to know how to access their admin areas. Sounds like fingers could be pointed at me. Any suggestions?

  • If you change the admin password is it hashed? I think it's more than reasonable to contact them about your concerns. – RoraΖ Oct 16 '14 at 15:20
  • There's no obvious feature to change the admin user passwords; it's probably only changeable via direct DB access. – user58816 Oct 16 '14 at 18:32
6

Unless they have some form of bug bounty type program, you are putting yourself at risk by disclosing to organizations that haven’t hired you. The organization can turn around and say “You’re hacking us, this is proof. We’re suing you.” I have had to fight senior leadership at past jobs to not take that course of action. Or similar minded BS because they see it more as an attack against them. They think it’s more secure to attack you then disclose that information.

If these are smaller organizations, there is less of a risk of this. Generally, your information will go to the people that will care and want to fix it first. They will generally (not always) be thankful for the feedback and want to back it better. At larger organizations it will go to legal first and they decide how to respond before it would go to the people that would potentially fix it.

If you choose to disclose it, take every possible precaution to ensure they can’t track it back to you. Personally, I wouldn’t disclose this unless they have a bug bounty type program. It’s not worth risking your career for. That may seem contrary to what we should do as security professionals. Regardless of whether you would win or lose in court, your reputation will take a hit and employers, as well as your current employer, may think twice. The organizations may go after your current employer as well. How would they respond to that?

  • 3
    How sad. I think I'll follow your advice though. – user58816 Oct 25 '14 at 15:39
  • It is sad but unfortunately that's where things are at. :-/ – Paraplastic2 Oct 26 '14 at 17:23
  • I'm not pleased about upvoting this, but it's absolutely practical advice, so +1. If I were in the position of having a client using something like this, I'd fix it in their deployment and call it a day... a not-feeling-great-about-myself-but-still-justified day. – kungphu Jun 21 '16 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.