Questions tagged [disclosure]
releasing information about security issues to the general public or a selected group.
155
questions
365
votes
22
answers
303k
views
I found that the company I work for is putting a backdoor into mobile phones
I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.
We are not using this option, and it is probably there ...
- 3,001
142
votes
8
answers
16k
views
How do I report a security vulnerability about a trusted certificate authority?
I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers.
Specifically, I am able to get a valid signed certificate for a domain ...
- 1,041
130
votes
10
answers
16k
views
Should I contact the manufacturer if their product allows access to other users' location information?
I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness.
While testing out my product, I noticed that the ...
- 1,143
82
votes
5
answers
23k
views
How to proceed with a white-hat hacker claiming a vulnerability?
I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member.
They were reporting on our website being indexed by googlebot (metadata, thin ...
- 866
82
votes
2
answers
17k
views
I'm a White Hat and I develop my own viruses. Should I report it when almost all scanners say the executable is safe?
I develop my own viruses for 'scientific' purposes, namely to see if they pass the test of Virustotal.com. They all do, except for one or two scanners. Is this considered something you should report ...
- 819
79
votes
10
answers
11k
views
How to report vulnerabilities without being regarded as a hacker?
I just discovered that my university alumni's login page is just plain HTTP. Wireshark confirmed that the credentials are sent using an HTTP POST message. I did a bit of research and, as I thought, ...
user29170
79
votes
6
answers
16k
views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
- 5,089
71
votes
7
answers
18k
views
How do I inform a company I found a leaked database of theirs on the Internet? [duplicate]
Recently I found a leaked database of a company and I do not know how to go about contacting the company. It is so weird because I cannot find any type of Information Security contact email to report ...
- 807
64
votes
3
answers
6k
views
Are staggered roll outs of security patches bad?
Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
- 698
56
votes
7
answers
12k
views
Open Source vs Closed Source Systems
My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, ...
- 5,072
55
votes
3
answers
8k
views
Where to disclose a zero day vulnerability [duplicate]
We discovered a vulnerability in wide range of Ricoh printers, where with a simple PostScript file sent directly, it is possible to crash the device.
To recover you need physical access to the ...
- 682
53
votes
8
answers
5k
views
How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]
I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware.
I had look at similar question however ...
- 3,853
50
votes
4
answers
6k
views
Why submit a website to plaintext offenders?
I've read this question and to quote from the accepted answer
Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case.
...
- 543
47
votes
2
answers
16k
views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked.
Check this ...
- 633
40
votes
4
answers
7k
views
How do open-source projects prevent disclosing a bug while fixing it?
I understand that many open-source projects request vulnerabilities not to be disclosed on their public bug tracker but rather by privately contacting the project's security team, to prevent ...
- 3,088
39
votes
4
answers
11k
views
Is demanding a "donation" before disclosing vulnerabilities black hat behavior? [closed]
We have been contacted by an "independent security researcher" through the Open Bug Bounty project. First communications were quite OK, and he disclosed the vulnerability found. We patched the hole ...
- 7,672
39
votes
6
answers
10k
views
Software vendor refuses to fix security vulnerability - what to do?
I work as a consultant for a large corporation that uses some software, in which I have found a security vulnerability. I notified both my client and the software vendor about a year ago. They ...
- 423
38
votes
5
answers
2k
views
How do I respond to a published security vulnerability in my application?
In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity.
On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
- 3,887
33
votes
1
answer
17k
views
What is an n-day security attack?
There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?
- 339
32
votes
8
answers
8k
views
Is it legal to find bugs on a website and report them to the website's owner? [closed]
I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
- 447
30
votes
5
answers
7k
views
How do you tell a website they have expired security certificates?
I often go to more obscure pages on NASA websites, and I have gotten used to running into an expired security certificate now and then. Over the last week, it started coming up a lot more, to the ...
- 425
29
votes
4
answers
1k
views
As a student, how do I safely and responsibly disclose a serious security issue in a school environment?
I am a student at my local school.
About eight months ago, I stumbled upon a security hole that could allow any user to discover any student's ID in the entire district, and I am aware that the IT ...
- 593
25
votes
4
answers
4k
views
What to do when I find a possible security vulnerability of public interest? [duplicate]
Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide.
I am not an expert in security, but there ...
- 269
23
votes
7
answers
869
views
Fostering an environment where honesty and disclosure are valued
UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
- 5,072
20
votes
3
answers
1k
views
Should Stack Exchange be more obscure in its systems' structure?
I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
- 475
20
votes
4
answers
5k
views
Is a responsible disclosure for hardware-based vulnerabilities even possible?
In the last decade side-channel attacks like fault injection attacks (e.g., voltage glitching attacks) have been used to bypass JTAG locks or read-out memory protections. Such vulnerabilities might ...
- 311
20
votes
4
answers
3k
views
My old job has massive security exploits in their product, but they dont care [duplicate]
A company I used to work for developed a Point Of Sale system that also has an eCommerce portion. While working there, I discovered massive flaws with their security model.
Simply put, there is 0 ...
- 311
19
votes
1
answer
1k
views
What to do after you get a CVE?
I recently reported a security vulnerability and it was patched. The patch (and associated issue) are both out in the open in a Github repo (aka public). I contacted [email protected] to get a CVE ...
- 193
18
votes
2
answers
1k
views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
- 285
17
votes
3
answers
3k
views
Which companies facilitate payment in return for vulnerability disclosure?
If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from ...
- 423
17
votes
3
answers
6k
views
Reporting vulnerable sites
Take this scenario:
You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
16
votes
2
answers
5k
views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
14
votes
2
answers
7k
views
Is there a way for a consumer to report PCI non compliance?
Is there a way for a consumer to report PCI non compliance?
- 1,141
13
votes
2
answers
4k
views
How to prevent email discovery in forms?
Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
- 242
13
votes
3
answers
2k
views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
ethically_minded
13
votes
2
answers
643
views
How do you address a social engineering and or software weakness/concern in a company or organisation?
Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change ...
- 1,672
13
votes
2
answers
730
views
How to deal with responsible disclosure "catch and kill"
My coworkers and I discovered a significant security issue in a popular cybersecurity tool, which shall go unnamed here for reasons that will become obvious.
We reported the issue to the tool's ...
- 231
12
votes
3
answers
870
views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
- 223
12
votes
3
answers
1k
views
Responsible disclosure: company is dedicated to security but doesn't answer
Context: recently I found a vulnerability in a webapp for a big company. They have a full policy on responsible disclosure which I followed to avoid legal issues.
The company commits itself to ...
- 121
11
votes
1
answer
626
views
How to report a vulnerability in a site that wants to call the FBI?
I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not ...
- 111
11
votes
3
answers
551
views
Progress in market approaches to software vulnerability disclosure?
In A Comparison of Market Approaches to Software Vulnerability Disclosure (2006), Rainer Böhme describes the profound role of economic "market failure" in the industry dynamics that hinder ...
- 20.8k
10
votes
1
answer
13k
views
Found security vulnerability, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a security vulnerability which gives me the ability transfer money to ...
- 307
10
votes
4
answers
2k
views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
- 50.9k
10
votes
3
answers
1k
views
Responsible Disclosures and Getting Sued
Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
- 2,108
10
votes
1
answer
493
views
How to legally blog about Windows internals
In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people ...
- 305
10
votes
1
answer
683
views
How does responsible disclosure work, once vendor says it's not a security bug?
I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not ...
- 553
10
votes
1
answer
564
views
How to encourage responsible disclosure (and react appropriately otherwise)
As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
- 233
9
votes
2
answers
466
views
How to report a security vulnerability involving multiple unrelated companies?
While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products.
All those issues aren't security ...
- 14.7k
9
votes
1
answer
413
views
Physical security - responsible disclosure
I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
- 2,071
9
votes
4
answers
611
views
I anonymously submitted a security vulnerability, but it was not resolved. What now?
This is more or less a continuation of my previous question: As a student, how do I safely and responsibly disclose a serious security issue in a school environment?
More than four months on after I ...
- 593