7

So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited.

I was on a government utility (being vague intentionally) website and I was having an issue recovering my password. I noticed that it was able to tell me my security question answer was invalid without requesting a new page and i thought it was odd so i opened my dev tools and found it was relying entirely on Javascript to determine if my answer was correct. To be sure, i had the function always return true and I was greeted with the password change screen, and it (laughably) didn't require the old password. I changed my password and I had access to my profile again, only needing a username to access my information.

I tried to email the webmaster about the issue. No response. I'm concerned because I hadn't done very much on the site and already I had my SSN, bank account routing/acc numbers, personal address, etc.

What should I do? I don't want to hear in a few months that some other amateur hacker got all of the information and sold/leaked it. Thanks!

  • When you get in contact with the right people you could sell them this information under a contract. State you wish to be compensated for the time you spent finding the flaw. Try to come across from a commercial point of view. If they are not interested the media will be your best friend. Just an idea :) – Tim Jonas Apr 14 '15 at 10:00
  • 5
    Be careful with the above advice that your approach may not be taken as some sort of blackmailing by some people. Sadly this wouldn't be the first time that someone try such thing for the sake of security, and gets arrested as a result (motives as reverse egineering, automated system alteration and intrusion, leak or stealing of proprietary or confidential information, etc.). – WhiteWinterWolf Apr 14 '15 at 15:00
7

Any issue with a federal government web application, I would contact the office of my congress-person.

They are becoming increasingly aware of and concerned with security and privacy of government computer systems. You can say what you want about our deadlocked, ineffective congress, but they are still pretty good at making things happen at the various government agencies they fund. Tell them what you wrote above, especially that you never got a response.

If you don't get traction from this, let them know that the congress-person is now in the chain of people who "knew but did nothing" when you finally contact the press.

I think calling them up and demanding money is a risky idea.

2

Most countries have a Computer Emergency Response Team (CERT) that you could contact, ie: US-CERT, CERT Australia, etc. They usually have the correct connections to get the matter addressed. Google CERT plus your country name to get started.

  • 2
    You might also consider contacting some of the white-hat security vulnerability/research companies that do responsible disclosure. They can act as a stronger pressure-point onto this particular Govt website. Also, depending on which Government is running that website, they may have a Govt-wide security reporting ombudsman (usually out of a CIO office) that may be able to "reach down" into the Govt hierarchy to get it fixed. – cybermike Apr 14 '15 at 10:15
  • You can also look in responsible reporting "directories" like HackerOne's. – Andy Apr 15 '16 at 22:50
0

As a former government-contracted web service administrator, my experience is that almost all services follow a mandate to specify a contact person with cognizant ownership of the service itself -- their contact information should appear in the application somewhere, and any substantiable security error will generally result in the type of response you would expect, with escalation to an admin or engineer. If this does not work, it's likely that the parent agency has a web service contact who can direct the issue as well.

In the future, your ability to receive relevant help could be improved by detailing the affected site rather than the exploit. You're now in a dilemma where you can't point out the site to get help finding a contact person, because doing so would potentially implicate you if anything bad were to happen.

e: Just realized I misread the post dates as today, April 15. Feel free to ignore me, though the above answer is probably still valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.