157
votes
Accepted
Should I contact the manufacturer if their product allows access to other users' location information?
Yes, you should notify the problem to the company - with caution.
Update: a shorter, very complete answer was supplied by @crovers. But if you have patience...
...the problem here is not simply the ...
- 23k
114
votes
Should I contact the manufacturer if their product allows access to other users' location information?
Yes. They ought to be using a long, unguessable string instead of a predictable, short one.
I would consider this a security flaw that is relatively simple for them to fix.
However, I would caution ...
- 6,391
95
votes
Accepted
How do I inform a company I found a leaked database of theirs on the Internet?
Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will ...
- 132k
73
votes
Is demanding a "donation" before disclosing vulnerabilities black hat behavior?
To my understanding, this is no longer in line with responsible 'white hat' behavior. Am I right in this assertion?
White (and grey/black) hat are vague terms. There is no fixed universal definition. ...
- 11k
65
votes
Accepted
How to proceed with a white-hat hacker claiming a vulnerability?
To answer each of your questions:
1. Basically how to proceed or even should we?
I recommend proceeding. You will be able to acquire valuable information that can immediately be put towards ...
- 2,736
61
votes
How to proceed with a white-hat hacker claiming a vulnerability?
Hackenproof appears to be a website anyone can sign up for, so saying you're a member of Hackproof is equivalent to saying you're a member of Facebook. This is not an exclusive hacker group.
There'...
- 21.6k
57
votes
Accepted
How do open-source projects prevent disclosing a bug while fixing it?
They don't. By releasing code, they automatically "disclose" the issue to those who can reverse engineer the patch. But they can delay explaining or providing the details for easy ...
- 132k
56
votes
Is demanding a "donation" before disclosing vulnerabilities black hat behavior?
The researcher did not create the vulnerability and has not threatened to release or exploit what he has found. If you do not wish to pay for his work then don't and your company is no worse off than ...
- 401
49
votes
How to proceed with a white-hat hacker claiming a vulnerability?
I don't know that there are any hard-and-fast rules here. Let's treat this as game-theory:
What the researcher wants
Usually:
Public credit for the discovery, such as a CVE or a research paper.
...
- 59.3k
47
votes
How do you tell a website they have expired security certificates?
In this case, the answer is (sort of) in the certs (which is not that uncommon):
openssl s_client -connect sservi.nasa.gov:443 | openssl x509 -text
<...snip...>
Authority Information ...
- 3,661
47
votes
Accepted
Is demanding a "donation" before disclosing vulnerabilities black hat behavior?
I'm a bug hunter and I have no idea why everybody here thinks it's perfectly fine of him to attack your website without permission, determine a bounty amount himself, and threaten to hold back ...
- 45.1k
43
votes
Should I contact the manufacturer if their product allows access to other users' location information?
To add to the other answers - be aware of the risks of reporting the problem yourself:
If you're inexperienced with reporting security issues, you might come across to them as dodgy and potentially ...
- 45.1k
38
votes
How do I inform a company I found a leaked database of theirs on the Internet?
One option if you're not having luck finding contact details is to contact the CERT (Computer/Cyber Emergency Response Team) in your's or the entity's country List of global CERTs. These organisations ...
- 559
37
votes
Where to disclose a zero day vulnerability
You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this.
You can then disclose it on security mailing lists like Bugtraq or ...
- 620
31
votes
Software vendor refuses to fix security vulnerability - what to do?
It sounds like you're insisting on an issue being treated as high priority, but there is little evidence for this. In your own words from comments,
Think of it like a really bad vulnerability (like ...
- 1,091
29
votes
Accepted
Is a responsible disclosure for hardware-based vulnerabilities even possible?
The idea of a responsible disclosure is to protect the customers both in the short term and the long term. What this exactly means in terms of disclosure timelines and details depends on how severe ...
- 208k
27
votes
Software vendor refuses to fix security vulnerability - what to do?
Things you can do:
Go for full disclosure, but as you've pointed out, this will probably do little more than strain the relationship further
Do you have a working proof of concept that shows how the ...
- 8,465
23
votes
Should I contact the manufacturer if their product allows access to other users' location information?
If I were you, I would say something like
Hello,
I have mistyped my ID (e.g. 12345) and pressed enter instead of backspace,
and I was dumbfounded to find that the page loaded and found
the location ...
- 433
22
votes
Accepted
My old job has massive security exploits in their product, but they dont care
A quick word of caution
You sound very invested in trying to do something. If I can be frank, it sounds like you are at least partially motivated by your frustrations with the way the company treated ...
- 31.7k
21
votes
How do open-source projects prevent disclosing a bug while fixing it?
The same way they prevent disclosing the report: by not disclosing it.
Since you mentioned the Linux kernel specifically: only a vanishingly small number of users build their kernels directly from the ...
- 1,290
17
votes
How do open-source projects prevent disclosing a bug while fixing it?
Coincidentally I have a tab open about CVE-2020-17640 in the Eclipse Vert.x project where the product maintainers are discussing this exact issue!
Julien Viet 2020-09-28 13:07:31 EDT
So I just need ...
- 59.3k
16
votes
How do you tell a website they have expired security certificates?
Finding the "right people" can be tricky at the best of times. Is it the web developer? The server admins? The network admins? If the pages are obscure, they might be handled by obscure departments ...
- 132k
14
votes
Acceptably resolving a serious vulnerability disclosure
Certain parts of this question concern matters of opinion. Those are out of scope for Security.SE.
Well, in this highly "hypothetical" scenario, I would expect the researchers to publish ...
- 52.1k
13
votes
Accepted
Software vendor refuses to fix security vulnerability - what to do?
This is the really old topic on how to disclose vulnerabilities.
(note on terminology: I am using 'company' for the one that made the software, 'researcher' for the one who finds the vulnerability and ...
- 19.1k
13
votes
Is a responsible disclosure for hardware-based vulnerabilities even possible?
to bypass JTAG locks or read-out memory protection
In most cases, this only poses risk of exposing manufacturer's own intellectual property. Code read-out protection is not the only way to protect ...
- 1,457
11
votes
Is demanding a "donation" before disclosing vulnerabilities black hat behavior?
He doesn't need to disclose- but he knew coming in during the second round you don't pay. So what is his motivation? You cannot know- so he is using that gap to create pressure on you to pay.
However-...
- 111
11
votes
Accepted
Why were Meltdown and Spectre disclosed at the same time?
*Update: This article seems to cover everything.
The attack papers share many of the same authors and use similar but previously unknown attack vectors.
Both exploits resulted from the same (or at ...
- 11k
11
votes
How to report a vulnerability in a site that wants to call the FBI?
If you're really just trying to help out for the greater good, you can send a message anonymously using something like Guerrilla Mail over Tor. Believe there's also a Tor hidden service for/like this, ...
- 2,412
11
votes
How do I inform a company I found a leaked database of theirs on the Internet?
Initial premise: Finding was obtained lawfully
You need to dig up who is their security contact, who in the org should be contacted around disclosure of security faults. How that is (or isn't) ...
- 3,951
10
votes
How do you tell a website they have expired security certificates?
NASA websites should have a Responsible NASA Official (RNO) listed on the home page for the site. That person probably won't be the webmaster for the site, but should know who to contact to have any ...
- 221
Only top scored, non community-wiki answers of a minimum length are eligible