Attacker Compromises Pornhub, Sells Shell Access for $1,000, Says Columnist (csoonline.com)

An anonymous reader writes: Four days after launching a bug bounty program, Pornhub is said to be compromised. The person responsible used a vulnerability in the user profile script that handles images (not ImageMagick) and is selling shell access on one of their servers for $1,000 USD. This is the second major website the hacker has shelled. Prior to Pornhub, they compromised the LA Times website.
CSO's security columnist notes that Pornhub "announced their bounty program on May 9, but it's a private, invite-only program managed by HackerOne. As such, it isn't clear if there would've been a way to report this flaw and collect a reward to begin with." In addition, on Twitter the attacker reportedly posted "I don't report vulnerabilities anymore, go underground or go home."

Comments

Good. Call them on their publicity stunts.

[Anonymous Coward]

Bug bounties are bogus. Don't make a lottery out of security.

Distractions

[jargonburn]

"I don't report vulnerabilities anymore; go underground or go home."

Perfect opportunity for a semicolon, imo. Such a waste of an opportunity!
/grin

"I don't report vulnerabilities anymore"

[phayes]

"I don't report vulnerabilities anymore, go underground or go home."

Here's hoping I see a future /. story titled "PornHub Hacker arraigned today". I don't give a rat's ass that it's Pornhub, the sentiment that this guy has deserves the consequences in anti-hacking laws.

Re:"I don't report vulnerabilities anymore"

[Anonymous Coward]

All those people that found critical vulnerabilities, reported them in a responsible way and got arrested for doing so are agreeing with him.

Re:"I don't report vulnerabilities anymore"

[Anonymous Coward]

"I don't report vulnerabilities anymore, go underground or go home."

Here's hoping I see a future /. story titled "PornHub Hacker arraigned today". I don't give a rat's ass that it's Pornhub, the sentiment that this guy has deserves the consequences in anti-hacking laws.

As much as I get your feelings on this, the number of people who've been sued after reporting vulnerabilities makes me understand it.

Re:"I don't report vulnerabilities anymore"

[JaredOfEuropa]

The difference is: those other people did not deserve to be arrested. For finding a vulnerability and subsequently selling shell access, this guy does deserve it.

Re:"I don't report vulnerabilities anymore"

[Anonymous Coward]

Here's hoping I see a future /. story titled "PornHub Hacker arraigned today". I don't give a rat's ass that it's Pornhub, the sentiment that this guy has deserves the consequences in anti-hacking laws.

Maybe you haven't noticed, but those anti-"computer hacking" laws are entirely overbroad and completely vague. That means you could be made to feel the full force of those laws for jaywalking* while holding... anything with a "computer" in it. Like your smartphone, but hey, that microcontroller-equipped sudoku game also qualifies. All you need to make it stick is an experienced smooth-talker, which is apparently the point of lawyer school.

So while I understand your bloodthirsty sentiment, shoddy laws make everyone into targets of opportunity for promotion-hungry prosecutors, and this is a shoddy law. Worse, it came about exactly from abuse of "hacker", and "hacking", words that originally meant something quite entirely different from the complete nothing wrapped in vague fear and lots of posturing by the speaker they indicate now, and this veneration of undefined-but-present dread does not make for more competent prosecutors or law enforcement. All it does is make people feel even more powerless, like how you're asking for the perp to be reamed because apparently we can't get at him.

This isn't justice. It's stupidity wrapped in ignorance and tagged with a "guaranteed to shock" price sticker. Both pornhub and this asshole need liberal application of a cluebat until they see the light, or at least stars. Which is not quite the same thing as asking for them to be tut-tutted to the tune of ten to twenty without parole by clueless judges and confused juries. Sure you can hand out ten to twenty, but you can't do so and make it stick without understanding. As long as we keep worshipping ignorance, as computer security has us do, as evidenced by this little spat, we're not going to get anywhere and arseholes like this will continue to be arseholes in public regardless of what lawbooks we try and throw at'em.

* Which is not even a thing in this country.

Re: "I don't report vulnerabilities anymore"

[greenfruitsalad]

haven't you read the article? you can watch pornhub videos through libaa or in 256 colours with libcaca!!!

People Actually Subscribe?

[sycodon]

I watch porn just like every other guy and not a small number of women.

But who actually pays to subscribe to something that is obviously available for free?

If they want me to pay money they'd better send one of those Nubile girls to my house.

Re:People Actually Subscribe?

[Nemyst]

I could see people paying if someone came up with a Netflix for porn: cheap, access to lots of content and some high quality in-house stuff. As it is now, I don't understand, paid porn sites have prices that'd make even cable providers blush.

Re:People Actually Subscribe?

[Anonymous Coward]

...a Netflix for porn

Agreed, there's money to be made here. I mean someone's already made "the Facebook for Sex", which must be doing well as I see ads for it everywhere, AND apparently there's plenty of singles in my area!

Re: People Actually Subscribe?

[brunes69]

You miss the point. This is less about them stealing your info, as using the Pornhub network (which by the way hosts many other port tube sites) to distribute malware (likely ransom ware as it makes a shit load of money) to all their free visitors.

not invite only. I see the submission form right n

[raymorris]

That last sentence is bogus. Their bug-bounty program isn't invitation only. I have the submission form open in another tab right now. The only requirement that differs from any other is that if your first four reports are bogus, they may stop paying attention to you (known as a signal requirement) .

No Thanks!

[FudRucker]

i can view all the porn i want for free, i wont pay some loser geek with leet hacking skills a thousand bucks for access,

Re:No Thanks!

[sumdumass]

lol.. You are not paying for porn, you are paying for a shell account which can allow you to access porn and a lot more. Hell, you can even set up your own website and host your own porn on their servers if your privileges are high enough.

"Back door" access always cost men more

[JoeyRox]

It requires a lot of cajoling or money or both.

Party Foul

[BitZtream]

Dude, not fucking cool.

Certain sites get immunity from hacking just because. They are privy to an unspoken rule where they get left alone because messing with them is like shitting in your own bed.

Thats what you did, you just shit in your own bed, and while I realize they have a section for that, its still not cool.

This is about as uncool as when rootshell was hacked. Again, shitting in your own bed.

making that up? Not in T&C I read

[raymorris]

Do you have a source for that, or are you completely making things up and then believing your own fiction, as so many Slashdotters sem to do? I don't see anything like that in the terms and conditions myself.

Re:Did you know?

[Noah Haders]

I'm really only concerned about mass murder by another nation perpetrated on America, and I'm really only worried about contemporary attacks, not historical. so, I don't think your pan-global pan-historical averages hold up.