Slashdot Mirror
Casino Accused of Withholding Bug Bounty, Then Assaulting 'Ethical Hacker' (arstechnica.com)
An anonymous reader quotes Ars Technica:
People who find security vulnerabilities commonly run into difficulties when reporting them to the responsible company. But it's less common for such situations to turn into tense trade-show confrontations -- and competing claims of assault and blackmail. Yet that's what happened when executives at Atrient -- a casino technology firm headquartered in West Bloomfield, Michigan -- stopped responding to two UK-based security researchers who had reported some alleged security flaws. The researchers thought they had reached an agreement regarding payment for their work, but nothing final ever materialized. On February 5, 2019, one of the researchers -- Dylan Wheeler, a 23-year-old Australian living in the UK -- stopped by Atrient's booth at a London conference to confront the company's chief operating officer.
What happened next is in dispute. Wheeler says that Atrient COO Jessie Gill got in a confrontation with him and yanked off his conference lanyard; Gill insists he did no such thing, and he accused Wheeler of attempted extortion.
The debacle culminated in legal threats and a lot of mudslinging, with live play-by-play commentary as it played out on Twitter.
Ars Technica calls the story "practically a case study in the problems that can arise with vulnerability research and disclosure," adding "the vast majority of companies have no clear mechanism for outsiders to share information about security gaps."
A security research director at Rapid7 joked his first reaction was "man, I wish a vendor would punch me for disclosure. Boy, that beats any bug bounty." But they later warned, "It's on us as an industry not only to train corporate America on how to take disclosure, but also we need to do a little more training for people who find these bugs -- especially today, in an era where bug outings are kind of normal now -- to not expect someone to be necessarily grateful when one shows up."
What happened next is in dispute. Wheeler says that Atrient COO Jessie Gill got in a confrontation with him and yanked off his conference lanyard; Gill insists he did no such thing, and he accused Wheeler of attempted extortion.
The debacle culminated in legal threats and a lot of mudslinging, with live play-by-play commentary as it played out on Twitter.
Ars Technica calls the story "practically a case study in the problems that can arise with vulnerability research and disclosure," adding "the vast majority of companies have no clear mechanism for outsiders to share information about security gaps."
A security research director at Rapid7 joked his first reaction was "man, I wish a vendor would punch me for disclosure. Boy, that beats any bug bounty." But they later warned, "It's on us as an industry not only to train corporate America on how to take disclosure, but also we need to do a little more training for people who find these bugs -- especially today, in an era where bug outings are kind of normal now -- to not expect someone to be necessarily grateful when one shows up."
Just sell it and let the casino get robbed instead. Casinos are shitholes, addicts are the product as soon as they walk in the door.
Gee, it's not like we haven't seen casino orders try that one before, even trying to create fake evidence of 'machine malfunctions' or other fraudulent claims trying to get out of paying a jackpot.
It's a casino. Assume it's corrupt and run by criminals.
"Once upon a time, there was a wonderful and profitable company that made perfect products that never failed, and were perfectly secure. They had an iron-clad confidentiality framework to protect the privacy and anonymity of their customers, and data breaches never happened to them. They made lots of money, and the investors lived happily ever after."
But Grandpa, what about that time when --
BILLY! WHAT DID I JUST SAY!? -- I said IRON CLAD, PERFECTLY SECURE, and BREACHES NEVER HAPPENED!
But Grandpa, that's not..
BILLY, GO TO YOUR ROOM!
[This is essentially what goes on with security disclosures, except instead of a senile patriarch insisting on an absurd bedtime story's plot, you have corporate leadership refusing to budge even an inch in the face of reality about their companies, their products, and their business practices-- Lest the investors get scared and withdraw their investments. They treat every bit of truth or fact that detracts from their carefully manicured narrative as a direct personal attack, because it is worth more to them than the losses incurred by the problem itself. A researcher asking when their bug bounty payment will be sent, is immediately 'EXTORTION!!', because "disclosing the dirty secret!" that their product actually is not fairytale perfectly secure, is a deadly thing to their corporate image, don't you know! Because lying to investors is an industry staple these days, apparently. They would rather send Billy to his room and keep him there forever, than admit that the fairytale is a fairytale.]
Threatening to release it unless they pay you is extortion, a felony. At the federal level it carries a prison sentence of up to three years.
Colloquially, it's called blackmail, though in federal law blackmail is only if you threaten to tell about a crime they committed.
To not commit the crime of extortion, one would need to be clear you WILL release a warning to customers so that customers can protect themselves - whether or not the company pays. The company would be paying for details of the problem, not paying to prevent information from being released. Alternatively, don't mention releasing the information at all. You don't want to give the impression that you'll release it unless you're paid, because that's extortion.
If company comes back offering payment in exchange for an NDA, that would be an interesting legal situation. Is it extortion if the "victim" proposes it? Probably not at the federal level. At least if the communication accepting the NDA offer is kept short - "I accept your offer". You wouldn't want to restate the offer "if you pay me I won't release it", because that could be considered a threatening communication (extortion).
I haven't read the text of the law in every state. It could still violate state law if you accept an NDA in exchange for payment after you've already mentioned releasing it.
Seriously, is there nothing of real value to read, think, and talk about anymore?
Anytime you want to extort someone legally, you need a fucking lawyer. They know exactly how it's done. It's a legal specialty, some lawyers make careers out of it.
As always, get a good one. Find someone with ADA experience.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
I would say it is in the realm of contract law.
"Hey, I will give you money if you disclose flaws directly to me, so I can fix them before the word gets out!"
Is an offer for a contract.
Creation of a bug bounty program, with rules and verbiage on how to participate, how to submit a bounty, et al-- are all terms and conditions established for the transaction of that contract.
Creating a bounty program, and telling a researcher that "Hey, I will tots pay you if you tell me first, and then keep it under wraps for awhile!", waiting for some researcher to take you up on that offer, then suddenly shouting "EXTORTION! EXTORTION!" is pretty much straight up barratry and contract violation.
If you said "I'll tell people the bridge is defective unless you pay up", that would be extortion.
Which is why I didn't say that. The bug information will get out. Its already in the hands of an independent entity. And that's the nature of information with financial value. The casino is paying for knowing earlier and before potential attackers. They didn't pay up. What do you expect to happen next?
Here's the federal statute, 18 U.S. Code $â875 (d) -- ... any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee
First, the researchers had already given the information to the casino, the casino was reneging on payment. The casino was a deadbeat who wasn't paying up. The researchers said, well we know about a bunch of other stuff and won't tell you before we release publicly since you are a deadbeat who doesn't pay their bills. And since you are a deadbeat who has exhausted their credit, we'll tell everyone else and nobody will tell you anything. That's not a threat, that's normal business practices. No pay, no play. A threat would be we'll steal all your money. Releasing publicly is the responsible behavior for security researchers. That this will open up the casino to every hacker on the planet is immaterial. And pointing that out isn't a threat. Pointing out that poking Mike Tyson in the chest while insulting his mother is likely to result in bodily harm isn't a threat. I think you are still confused as to what a threat is. The researchers have to release publicly, that's the responsible thing. If the casino doesn't pay all their security guards how long till they get robbed? Pointing that out isn't a threat. A threat is if you don't pay me, I'll rob you. Anything else is a gross twisting of the meaning of a threat.
"Those that start by burning books, will end by burning men."
If company comes back offering payment in exchange for an NDA, that would be an interesting legal situation.
Isn't that exactly the situation described in the article?
According to the article the original deal between the casino and the researchers did not include any monetary compensation, but neither did include any NDA: the researchers planned to disclose the vulnerabilities found in a security conference.
It's the casino which, without being prompted by the researchers, at some point initiated a negotiation to get a NDA from them. The researchers then provided a quote for it and things seemed to proceed toward a deal.
Now the casino apparently doesn't want to pay anymore for the NDA, but neither wants the researchers to disclose the vulnerabilities they have found, so they went with a C&D legal letter. On the other side the researchers are still not under any NDA and are IMHO pretty justified in stating that if the NDA deal never got finalised they are free to disclose the information as previously planned.