Hacker News Reader

Comment by EarlKing | Hacker News Reader

...and that is why you never try to help businessmen. EVER. You just laugh and move on. At best you tell people privately not to do business with them, but you NEVER stick your neck out. There is absolutely no way this wasn't going to end in a lawsuit. Don't be this guy. Seriously. No matter how much of a duty you think you have to report security matters you find this episode vividly illustrates the fact that no good deed goes unpunished.

And people wonder why even in the future nothing works.

View on HN

This is why you leak anonymously and let the wolves take care of it as nature intended.

Issue is, he will be stored in logs traversing through accounts not his.

If you're going spelunking you'll take precautions to mitigate the risk of it being traced back to you.

Yeah but that wasn't the situation. Twas a bit late for that by the point OP discovered there existed a security issue in the first place and they had even already "exploited" it.

I think a lot of hackers start with just seeing what’s going on without any intent to dig deeper. But then something too good to pass up gets them high, and with weakened inhibitions, they make bad decisions that require responsible disclosure (in lieu of saying and doing nothing and possibly getting into more trouble). Of course a responsible disclosure is always prudent, and these companies certainly did not deserve one, but the hacker here got too excited. They didn’t cover their tracks first, necessitating a responsible disclosure.

I'm not sure an unprepared one can leak anonymously and safely.

just post your findings from an internet cafe on 4chan and watch the competitor burn

Serious question: are internet cafes still a thing?

Admittedly this is from a small sample of Seattle-area coffee shops but most of my experiences with non-home non-work WiFi is at coffee shops that provide the WiFi but expect you to bring your own device (laptop, phone, etc).

Is it still common to go someplace and rent time on a computer provided by the owner (i.e., at an internet cafe?)

Here in Germany there are still a lot of them around. Though any rando WiFi hotspot would propably do the trick

You can do it for free at a library.

I don't think places you can rent machines are common (except libraries as noted but these may require ID) but the steps "buy machine with cash, take machine to anonymous cafe outside your area and get wifi password, upload info" still seem reasonably secure. You can throw the machine off a bridge later if you're paranoid - and work hard at sanitizing your info while you're at it.

Can you just spoof your MAC address instead of buying a new machine?

possibly but will you bet jail time on it?

>Serious question: are internet cafes still a thing?

I live in a capital city and am aware of at least three of these still kicking around.

>are internet cafes still a thing?

I don't know about internet cafes specifically, but pretty much all cafes have internet these days.

Public libraries are much better for this and easier to find.

Eh, quick DM to Wall Street Journal or Financial Times and if it's a decently large bank the PR fallout will quickly prevent any potential retaliation.

Probably not. Bugs like these happen all the time at big financial firms.

... or report the vulnerability anonymously?

It's not a leak to publish your own original research.

From what little I know of the world, this kind of litigiousness is more peculiar to the US than the rest of the world (or maybe at least the ones who usually speak English?).

Yes, in the EU he would simply be serving time, with little to no lawyer involvement from the companies - the government would have taken care of the whole thing.

This is beyond delusional. Absolutely no evidence or case studies to support this.

The Dutch public prosecution doesn't prosecute when responsible disclosure guidelines were followed. For the computer fraud part obviously; card fraud would be investigated (and there's no helping that this person will be a suspect, but without evidence or motive that should not be a big deal). That's not "this person would simply be serving time". Quite the opposite.

Can't speak for other European countries, I'm not familiar with their practices, but I haven't heard in recent years that anyone got prosecuted for responsible disclosure. A few months back a company started a civil case: that was unusual enough that it made the news (and it was dropped). About a year or so ago, someone was convinced while claiming to be white hat, but they emailed the company something like "pay me and I'll tell you what the problem is. Wouldn't want reputation damage now would we?" Again, unusual enough that it makes the news, and in neither case was a legit white hat "serving time".

It's not.

Germany is way worse.

Yeah seriously, people talk about the UK's defamation law being bad, but in Germany you can get in trouble simply for insulting someone or making a rude gesture (Beleidigung).

In Korea, defamation is a criminal charge and you may be sentenced to 5 years in jail if guilty. As a lovely cherry on top, truth is not a defense, although it does lower the maximum sentence to 2 years.

https://seoullawgroup.com/defamation-laws-in-korea/

I feel that in so many cases as a developer, the best thing for me to do is to let things fail.

Scrum incentivizes waiting for bug reports from production.

Low tenures for employment mean there is no reason to care much about maintainability or security.

The pay difference between excellence and mediocrity is 2%.

What a world we live in.

Which one gets 2% more?

In theory the excellent one. In practice, the one that negotiates better.

> There is absolutely no way this wasn't going to end in a lawsuit.

That’s what you call an inaccurate cynical view.

Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly.

Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...

Doing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.

I guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.

> and my employer would not fire me over such hearsay accusations from a competitor

So you think but you might be very wrong.

I might be, I suppose. Without going into details since this account is trivially traceable to my name, this wouldn't be the first thing the Internet tells me to never pull on my employer that went swimmingly. I do have some faith in my boss; it's a small company and security is a small world, and rich enough to not need backstabbing and politics a lot, thankfully. And I've got access to sensitive customer information on a daily basis (unpatched vulnerabilities), some trust is required in this field. If that wasn't there, I'd never have been put on projects or at least not lasted for very long.

Also note that I'm not in the USA and it's not this 2 weeks' notice wild west style employment (from my point of view).

> Using anonymisation proxies just makes it all the more suspicious

If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer or anything of the sort, it's just the macOS equivalent of Fiddler: a localhost HTTP/HTTPS proxy that lets you decrypt TLS traffic (provided the client software isn't using certificate-pinning, which it wasn't).

From TFA:

> Wondering how I could feed them to the app, I set up Charles Proxy and pointed my phone to it. I honestly thought this wouldn’t work – who at this time doesn’t have SSL Pinning?

https://www.charlesproxy.com/

https://www.telerik.com/fiddler

As a curious user of other applications I've done the same thing the the author has described, so this kinda stuff isn't uncommon - except in my case I've never had an opportunity to stumble across anything as bad the author.

As for phone-app' insecure back-end web-services: that's about par for the course thesedays, even for banking and other "secure" services. It's depressing. I have plenty of my own pet-theories as to why things seem worse today than they were 10 years ago, but that's another discussion.

> If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer

I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.

You have a lot of trust in your employer.

One of the reasons that I like working there.

> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work.

Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.

I've familiarized myself with the relevant computervredebreuk legalese and read that our public prosecutor doesn't prosecute cases where all the responsible disclosure guidelines were followed. (Of course they'll still check that they were, since not every claimed white hat is truly a white hat.)

Other jurisdictions are not so sensible.

These cases of just crossing the threshold are not that interesting to prosecutors unless affecting some company with a lot of political capital. If there is no restitution, no safety implications, no children harmed, and the case is a bit confusing, why take it? Prosecutors prefer to take the slam dunk cases where any normal person can agree it was an intrusive or fraudulent access.

... or report it anonymously to a higher authority like the CERT for your location.

Your IP is still in the access logs. The advice is good and we do this sometimes when not wanting to spend work time to deal with corporate politics around the reporting (though frankly the back-and-forth with the CERT is often a game of its own), but it wouldn't have helped in this case.

This is why it is a good idea to use Tor or a VPN for most things or even just for when you casually go reverse engineering a competitor's product :)

As I wrote in a comment elsewhere in the thread, I'm not sure if that is really the best idea.

> Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...

But yeah it all depends on the circumstances. Given how these companies are handling it, it couldn't have gone much worse I suppose. On the other hand, if the company suspects it was a black hat then you have to be very sure you can hide all tracks completely and, if found out, you have a lot more to explain.

I wouldn't even restrict this to security matters; don't stick your neck out for your employer at all for any reason, unless the risk has already been taken or you're a shareholder. The nature of capitalism and employment is one of control and risk management. Unless you're guaranteed to be rewarded (very well), don't do anything beyond your basic responsibilities. More than that costs extra. You either have control, or you don't, and as a normal employee, you don't. This is how I learnt not to care about doing very high-quality work, because it costs me disproportionally more than it costs my employer, and it usually doesn't matter if they're big enough.

Reply on news.ycombinator.com