312

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


161

Yes, you should notify the problem to the company - with caution. Update: a shorter, yet very complete answer was supplied by @crovers. But if you have patience... ...the problem here is not simply the possibility of tracking J. Random Stranger, but rather that: once your ID has been given to someone, apparently you cannot take it back and it does not ...


137

That's a pointless exercise. Most malware scanners match on fragments of binary code (aka virus signatures), and they check MD5 hashes of known infected code against their blacklists. Unless the virus you wrote has been deployed into the wild and is already on their blacklist, there isn't a chance they'll have your code's exact signatures on file. The ...


116

Yes. They ought to be using a long, unguessable string instead of a predictable, short one. I would consider this a security flaw that is relatively simple for them to fix. However, I would caution you - some companies do not handle situations like this very well. Some argue (in my view incorrectly) that changing that id constitutes hacking and they may ...


111

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


78

To quote their FAQ: Aren’t you worried hackers will use your site to find targets? Yes, but less worried than having this information remain secret and relying on Security Through Obscurity. To be more verbose: There are two possible outcomes from submitting a site there: They fix it - This is more likely to happen when they get publicly shamed. ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


75

To my understanding, this is no longer in line with responsible 'white hat' behavior. Am I right in this assertion? White (and grey/black) hat are vague terms. There is no fixed universal definition. By the wikipedia definitions most researchers would be viewed as Grey Hat seeing as its not uncommon to publish if the software publisher refuses to patch. ...


70

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


67

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


64

To answer each of your questions: 1. Basically how to proceed or even should we? I recommend proceeding. You will be able to acquire valuable information that can immediately be put towards improving the security of your company. You haven't told us what the researcher has sent you, but they will either have a description of the vulnerability or methods to ...


60

Hackenproof appears to be a website anyone can sign up for, so saying you're a member of Hackproof is equivalent to saying you're a member of Facebook. This is not an exclusive hacker group. There's no formalized standard way to proceed with such a situation, since your company, your business, the bug, and the white hat are all going to vary greatly. One ...


59

The researcher did not create the vulnerability and has not threatened to release or exploit what he has found. If you do not wish to pay for his work then don't and your company is no worse off than it was before he contacted you. In fact he has given you a gift of telling you that there is a vulnerability which you can find yourselves or through another ...


58

Simply reporting that it is using HTTP rather than HTTPS for login and that that is insecure shouldn't get you accused of hacking. It is something immediately publicly visible from looking at the site. There are many ways of detecting vulnerabilities which could actually be considered hacking (for example, running a vulnerability scanner against a target ...


58

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


56

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


54

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


49

I don't know that there are any hard-and-fast rules here. Let's treat this as game-theory: What the researcher wants Usually: Public credit for the discovery, such as a CVE or a research paper. Sometimes money in the form of a bug bounty. What you want Usually: Not to be publicly humiliated. To improve the security of your product. How to proceed ...


47

In this case, the answer is (sort of) in the certs (which is not that uncommon): openssl s_client -connect sservi.nasa.gov:443 | openssl x509 -text <...snip...> Authority Information Access: CA Issuers - URI:http://pki.treas.gov/noca_ee_aia.p7c CA Issuers - URI:ldap://lc.nasa.gov/ou=NASA%20Operational%20CA,ou=...


46

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


44

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


43

It would be a matter of opinion on how you should proceed. We already have a question explaining different ethical ways to report a vulnerability. First off, for something this big I would personally recommend you remain anonymous at first, while leaving a way to later prove it was indeed you who discovered the vulnerability. Create a brand new PGP key (not ...


43

To add to the other answers - be aware of the risks of reporting the problem yourself: If you're inexperienced with reporting security issues, you might come across to them as dodgy and potentially malicious. A company that doesn't have experience with handling security issues might forward your report to the company lawyer rather than the IT department. ...


43

I'm a bug hunter and I have no idea why everybody here thinks it's perfectly fine of him to attack your website without permission, determine a bounty amount himself, and threaten to hold back potentially dangerous flaws because he doesn't get the money he wants. Why didn't he ask about your policy beforehand? You never claimed to run a bug bounty program, ...


36

You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this. You can then disclose it on security mailing lists like Bugtraq or FullDisclosure. Security magazines and news sites might also be interested in the vulnerability. You can contact them directly and ask if they are interested to publish ...


34

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


34

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


30

No. You should always assume that the attacker knows everything. Security by obscurity is considered bad practice by most non-govt developers and architects. The obstacle it provides is minimal, and if something is kept secret, it may be so to hide a flaw. Kerckhoffs's principle is important to look at. Edit: This answer discusses security by obscurity in ...


28

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


28

If they ignore your emails, you may try reporting them to organisation responsible for enforcing Data Protection Act. I don't know where are you from, in UK it would be http://ico.org.uk/concerns They have a responsibility to keep your data safe.


Only top voted, non community-wiki answers of a minimum length are eligible