Slashdot Mirror
Security Researcher Threatened With Vulnerability Repair Bill
mask.of.sanity writes "A security consultant who quietly tipped off an Australian superannuation fund about a web vulnerability that potentially put millions of customers at risk has been slapped with a legal threat demanding he allow the company access to his computer, and warned he may be forced to pay the cost of fixing the flaw. A legal document (PDF) sent from the company demanded that the researcher provide its technical staff with access to his computer. The company acknowledged the researcher's work was altruistic and thanked him for his efforts, but warned that the disclosure, which was not previously made public, may have breached Australian law. The researcher had run a batch file to access about 500 accounts, which was then handed to the company to demonstrate the direct object reference vulnerability."
If you find a vulnerability, don't tell the people at risk, sell it or use it.
Either that or move to a less stupid country.
---- Booth was a patriot ----
No good deed goes unpunished.
Being punished for doing the right thing tends to bias people towards hiding this sort of information, which would imply that your vulnerability isn't made public until someone slightly less kind happens upon it. Which is apparently the way these folks would prefer it be made public.
"I'd just like to emphasise that taking a million years isn't a metaphor here..." -Rich Bradshaw
In meatspace, there are Good Samaritan laws that say that if you help someone who is in danger, you are not to be sued. Pulling someone from a burning car is not something that should bankrupt the rescuer.
We need this for e-space.
If you find a flaw and report it to appropriate people, you should not become a target because you made someone look bad.
The alternative is to never report a flaw. And no, the argument that you can do it anonymously is bullshit too, because people will fuck that up like they already do.
--
BMO
If you find a vulnerability, disclose it. Publicly.
and anonymously.
Give me Classic Slashdot or give me death!
"Oh thank you sir for finding my wallet! Now please let me search your house to make sure you didn't take anything of mine."
That's your idea of a closer analogy? I daresay you are biased and painting things with deceptive license.
Let's make an honestly closer analogy:
When opening my apartment door I notice that my key has the apartment number written on it in a special way. Being a locksmith, I get an idea: Does the fancy lock just read the number to determine if the key's good? Because that would be bad. In the same style, I write a different number on my key, the number of my neighbor's apartment, and try it there. It works. We have a problem. I check the whole floor -- all vulnerable to this silliness.
I call up my locksmith friend and tell him how stupid this is. We have a good laugh and talk about what I should do. The next day I call the apartment manager, explain we've got a real problem, and I tell him what I did. I even walked his handyman through the steps so they could clearly understand. The manager has the problem fixed the next day. Job done, right?
The thing is, the super sends the cops to talk with me. With my having been a locksmith contractor to the same police force, it went okay, but it left me shaken. I mean, I talked with the super directly and gave him all my contact info. He knows who I am. Why send the cops?
Later on, the apartment manager sends a notice to everyone in the building, telling them there was a security problem, but it's fixed, and he sincerely apologizes. In particular he says:
And now they've sent me a letter telling me they had to inform the police about how I got into the other apartments because it could be a criminal act; that tell me they've locked me out of my apartment; they say they had to spend money to fix this whole lock problem because of me — the nerve! — they say they have the right to get the money it took to fix their problem from me — what! — they say that they want complete access my keys, pens, desk, and tools; and they say that they want me never to look for security problems in the building again.
Your darn tootin'! If this is the thanks I get! Some people!
Hm. The URL has my account number in it... I wonder if all accounts are accessible by that param alone? Nah. Well, let's see... I'll just increment the number.
ACCOUNT=1234
while true; do
ACCOUNT=$((ACCOUNT+1))
wget -nv url://site.with.FAIL.security/showstatement?acct=$i > log.$i 2>&1
done
By the time I press Ctrl-c I've hacked over 500 accounts!
You go to a web cafe and post it on 4chan, as Anonymous of course. That is what the system has encouraged.