Security Researcher Threatened With Vulnerability Repair Bill

mask.of.sanity writes "A security consultant who quietly tipped off an Australian superannuation fund about a web vulnerability that potentially put millions of customers at risk has been slapped with a legal threat demanding he allow the company access to his computer, and warned he may be forced to pay the cost of fixing the flaw. A legal document (PDF) sent from the company demanded that the researcher provide its technical staff with access to his computer. The company acknowledged the researcher's work was altruistic and thanked him for his efforts, but warned that the disclosure, which was not previously made public, may have breached Australian law. The researcher had run a batch file to access about 500 accounts, which was then handed to the company to demonstrate the direct object reference vulnerability."

Comments

Lesson learned

[nurb432]

If you find a vulnerability, don't tell the people at risk, sell it or use it.

Either that or move to a less stupid country.

Re:Lesson learned

[LifesABeach]

Well, lets just backup here a bit. If my neighbor discovers that part of my fence is broken, and walks onto my property to tell me so:
1. Is the neighbor guilty of Trespassing?
2. Is the neighbor guilty of causing the fence to be broken?
3. Is the neighbor guilty of being the cause of the broken fence?
4. Is the neighbor guilty of Negligence because the fence is broken?
5. Is the neighbor guilty of Indirect Negligence because the fence is broken?
6. Is the neighbor guilty of not maintaining the fence?
7. Is the neighbor guilty of any damage because the fence is broken?

Some Lawyer in their first year of business is going to carve up a Hedge Fund like a Christmas Turkey. Cheers!

As the old idiom goes:

[magsol]

No good deed goes unpunished.

Being punished for doing the right thing tends to bias people towards hiding this sort of information, which would imply that your vulnerability isn't made public until someone slightly less kind happens upon it. Which is apparently the way these folks would prefer it be made public.

Better do a cavity search, for good measure.

[FyberOptic]

"Oh thank you sir for finding my wallet! Now please let me search your house to make sure you didn't take anything of mine."

Re:Suppose you live in an appartment.

[Onymous Coward]

That's your idea of a closer analogy? I daresay you are biased and painting things with deceptive license.

Let's make an honestly closer analogy:

When opening my apartment door I notice that my key has the apartment number written on it in a special way. Being a locksmith, I get an idea: Does the fancy lock just read the number to determine if the key's good? Because that would be bad. In the same style, I write a different number on my key, the number of my neighbor's apartment, and try it there. It works. We have a problem. I check the whole floor -- all vulnerable to this silliness.

I call up my locksmith friend and tell him how stupid this is. We have a good laugh and talk about what I should do. The next day I call the apartment manager, explain we've got a real problem, and I tell him what I did. I even walked his handyman through the steps so they could clearly understand. The manager has the problem fixed the next day. Job done, right?

The thing is, the super sends the cops to talk with me. With my having been a locksmith contractor to the same police force, it went okay, but it left me shaken. I mean, I talked with the super directly and gave him all my contact info. He knows who I am. Why send the cops?

Later on, the apartment manager sends a notice to everyone in the building, telling them there was a security problem, but it's fixed, and he sincerely apologizes. In particular he says:

It has come to our attention that a resident of our building devised a way to open your door. Access to your apartment was limited and rectified immediately.

Please note: This incident was not the result of a targeted attempt to access your apartment. This resident alerted us to the ability to open your lock and advised that your door was only opened when testing the security of his own apartment. The member advised that he has not taken pictures of your apartment or taken any items.

And now they've sent me a letter telling me they had to inform the police about how I got into the other apartments because it could be a criminal act; that tell me they've locked me out of my apartment; they say they had to spend money to fix this whole lock problem because of me — the nerve! — they say they have the right to get the money it took to fix their problem from me — what! — they say that they want complete access my keys, pens, desk, and tools; and they say that they want me never to look for security problems in the building again.

Your darn tootin'! If this is the thanks I get! Some people!