Hot answers tagged

312

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


114

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


69

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


68

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


54

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


44

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


35

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


27

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


27

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


25

Congratulations! Sounds like a major find. First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened. You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that ...


23

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


23

There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...


23

This is a bit of a load question with a few different parts, but I think it is answerable overall. Is there a Hacker Ethos Yes and no. The main problem is the wide diversity of hacker groups that differ by targets and thus ethical code. Just to name a few: white hats usually follow the "do no harm"-type of ethics and try to close security-leaks. Regarding ...


19

Legality of reverse engineering depends on the country. As a rough summary: In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal. The DMCA also ...


18

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/ They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it. While CERT generally advises you to ...


17

-- Edit: This answer addressed the idea of applying for a job based on the discovery of a vulnerability. -- The chances are high that you would not get the job if you applied on the strength of the fact that you successfully hacked their user security. Trust me, if someone walked into an interview with me saying, "Oh, by the way, I found a hole in your ...


15

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; ...


15

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


13

Your reaction is sound, and on a gut instinct level means that you care about one or more of: your customers' privacy, your company's public image, your codebase's quality, your own skin. In my workplace, I would be senior enough to know it a security bug (and not there by company intent, or mandate from the government) - and remove it. It sounds like this ...


13

Treat it as a security vulnerability you have discovered and report it to to, for example, CVE. Anonymously if you wish.


12

Do absolutely nothing else with or at the site. Don't make things worse. In many jurisdictions you may have already crossed the line into not so legal. (You should get legal advice from a computer crime specialist lawyer in your jurisdiction about what you've done, by the way.) You have notified the site owner, which we commend you for, and your lawyer ...


11

Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.


10

You have a known security vulnerability, and your company is only one of an infinite number of parties which could exploit it. Any exploit of that hole, by any party, could reasonably result in a liability the scale of Sony's after the root kit fiasco. Their cost in both dollars and reputation soared into the hundreds of millions of dollars, in a directly ...


10

Sadly I think that such situation isn't new and isn't going to disappear in the near future. I don't know if you ever read the Hacker Manifesto? This text was written in the eighties, but chances are that you will recognize yourself in some aspect of this text... It is interesting in your text that you first explain that you had difficulties to make friend, ...


9

Although your intentions are good, schools and colleges are notorious for being heavy-handed with this kind of thing. They may well want to kick you out for (a) violating school policy and (b) making them look like idiots. My advice would be to detail the problems you found in an anonymous letter, explain very clearly that you're not trying to be malicious ...


8

You can Make a Responsible Disclosure with ZDI (Zero day Initiative), They are well known for their work and you have a good opportunity to earn some money depending on how strong exploits can be plotted upon the vulnerability you have found. Many security experts submit CVE's to ZDI, Its legal and secured in case you are afraid of company to sue you. ...


8

Contra Position I wish to take the position of Devils Advocate here. Your schooling/future is WAY more important to you than the security of the schools network. You should take the point of view that NOTHING good can come of you mentioning this issue. Consider the following scenarios: The School actually investigates this issue. You become the prime ...


7

I would seriously counsel against immediate whistleblowing. Not least because there's a good chance this happens because someone from the CIA/FBI had a little chat with the head of the company who ordered it to happen through trusted management channels, and that's why it happens even though everyone should recognise that it's a shitty excuse. You are ...


7

It's ok to worry about it, don't worry, your reaction is normal ^^ I would do one of two things: I would update the user agreement explaining that this possibility exists, therefore asking for the user's consensus (if the people in charge really don't want to take the backdoor away) I would remove the backdoor completely (better option in my opinion) Also,...


7

Any issue with a federal government web application, I would contact the office of my congress-person. They are becoming increasingly aware of and concerned with security and privacy of government computer systems. You can say what you want about our deadlocked, ineffective congress, but they are still pretty good at making things happen at the various ...


Only top voted, non community-wiki answers of a minimum length are eligible