Hot answers tagged

312

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


125

Ask your boss to put the request in writing before you do it. Make sure to keep a copy of the request in your own personal files. Ideally a paper copy at home, or maybe an email in your own personal email account. You say that you already have a better job to go to, so just give your notice now and leave the company as soon as the notice period is up. ...


111

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


102

Don't do it. I did something unethical once for an executive and I am still troubled by it to this day. For legal reasons I cannot tell anybody. It is unethical and you have another job lined up. Don't let him bully you. If he fires you then make sure you have in writing his request and you have legal grounds to sue for wrongful dismissal in most ...


70

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


67

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


61

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you. Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right. That said, your suggestion to try ...


54

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


44

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


42

Does your company have an ethics officer, internal auditor or internal council? If so, then you should contact that person, explain what you have been asked to do (in writing), and let them handle it. If it is a small company without any of these positions, then take your concerns to the owner/president (also in writing). As far as your company is concerned,...


39

Disclaimer: I'm not an IT guru nor a security expert. First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.) Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...


34

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


27

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


27

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


25

If you have your boss' request in writing in any form (paper, e-mail, etc.), make a copy for yourself that can be stored somewhere outside of your boss' control. Depending on the sensitivity of the information stored in the logs he's requested you to modify, you may also want to keep your own copy of the logs. (This is to say: If the logs have any data ...


25

Congratulations! Sounds like a major find. First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened. You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that ...


23

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


23

There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...


23

This is a bit of a load question with a few different parts, but I think it is answerable overall. Is there a Hacker Ethos Yes and no. The main problem is the wide diversity of hacker groups that differ by targets and thus ethical code. Just to name a few: white hats usually follow the "do no harm"-type of ethics and try to close security-leaks. Regarding ...


22

There are a few drawbacks to hiring a blackhat "hacker" instead of a security company. They are harder to trust Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass ...


18

I have worked as a solo security consultant, hired and vetted security testers, sat on the standards committee for CREST (the UK gold standard in penetration testing) and managed security teams of up to 100 people so I have a pretty broad experience of how this works. Risks An attacker goes "rogue" - having a contract with an established, reputable company ...


18

Do not do it. Even in writing it does not matter. At the end of the day its your butt on the line. If you're boss asked you to shoot someone with a gun, and you got him to write permission in writing, do you think anyone in the court would care if your boss gave you permission or not? Regardless, you will be held accountable, not your boss. If your boss ...


18

Legality of reverse engineering depends on the country. As a rough summary: In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal. The DMCA also ...


18

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/ They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it. While CERT generally advises you to ...


17

-- Edit: This answer addressed the idea of applying for a job based on the discovery of a vulnerability. -- The chances are high that you would not get the job if you applied on the strength of the fact that you successfully hacked their user security. Trust me, if someone walked into an interview with me saying, "Oh, by the way, I found a hole in your ...


16

If the owner invited people to hack the site, then he accepts such things as DoS. It is possible that he configured the server to limit brute-force attempts by instituting rate-limiting. If he did, then you did not exceed the limit for his pipe, just the limit he gave you. Either way, no need to write an apology.


15

It is unlikely that you can legally make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability. Note that in the US, hacking is illegal. The ...


15

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; ...


15

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


13

Treat it as a security vulnerability you have discovered and report it to to, for example, CVE. Anonymously if you wish.


Only top voted, non community-wiki answers of a minimum length are eligible