Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 85 guests and 1 member online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Security Disclosure finding problems and reporting them.
EH-Net
May 26, 2012, 10:50:19 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Security Disclosure finding problems and reporting them.  (Read 1162 times)
0 Members and 1 Guest are viewing this topic.
Jamie.R
Hero Member
*****
Offline Offline

Posts: 626



View Profile WWW
« on: October 31, 2011, 04:55:36 AM »

Hi all,

I just wanted to get some view on this when searching website in my own time I have seen and usually come across security problems with that website.

This can be thins like errors that tell me the username is valid but the password is not. Or even
sql injection when searching for things like 0' Donald.

I just wanted to see if anyone else comes across these and do you report them to the company or leave them ?
Logged

OSWP | eCPPT | HackingDojo Nidan
www.jamierougive.co.uk
cd1zz
Sr. Member
****
Offline Offline

Posts: 393


View Profile WWW
« Reply #1 on: October 31, 2011, 08:40:37 AM »

This is similar to your other post but have a look at these articles:

http://www.theregister.co.uk/2011/04/29/security_researcher_threatened/
http://news.cnet.com/2100-7350_3-5606306.html

They are a bit old and I do believe that this way of thinking is changing...IE the bounty programs that facebook and google have for example.

My point is that you wouldn't want to try and "help" and report something only to be sued or pursued for criminal actions. I tend to air on the side of cautious.
Logged

MaXe
Hero Member
*****
Offline Offline

Posts: 507


I've just upgraded myself to a cyborg muahahaa!!1


View Profile WWW
« Reply #2 on: October 31, 2011, 06:46:08 PM »

Be careful if you don't have explicit permission, even if you're just searching for real names on a website. I know that it's morally correct what you're doing, and that it should be allowed to help poorly secure companies like this, because in some cases these entities actually sue the people trying to help them, and later on get compromised by those that doesn't want to report what they've found / abused of course. (These other entities being e.g., blackhats.)

In the information security business of companies, some will take it extremely personal as an attack on their public relations image, even though they should in fact be glad that a named or unnamed researcher, has helped them fix a real or potential vulnerability, that e.g., a script kiddie could've abused, and all of this help they got, was for free, I don't see the point in sueing. Anyway, I should note that some companies, are more than glad to get this kind of help, just be extremely careful if you're going this path.

Of course if it looks like you're blackmailing them or you're trying to sell services this way, then there's a higher chance of getting in trouble, because it will definitely seem like you're trying to force them to buy your services.

So if you absolutely must, go on the safe path anonymously, and never make it look like you're blackmailing them. Always point out you did it entirely free, and that you only wish to see the Internet generally more secure.

I should of course state, that this site is called the ethical hacker network for a reason, not the morally correct hacker network, just a note so I don't get in too much trouble for writing my own personal opinion because of the freedom of speech  Grin
Logged

I'm an InterN0T'er
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.177 seconds with 22 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.