Hacker News Reader

Comment by raducu | Hacker News Reader

I work as a contractor for a bank.

A few months ago everybody was up in arms about a "major" security issue discovered by an auditor (you could see the settings of random users by changing an id in a url). I've just shown them you can credit money to your account, yet this is low priority and they provided a fix that I'm 100% percent sure didn't fix anything, unfortunately the functionality is down on all but the production environment. I'm tempted to just credit myself 1 monetary unit in production and just show them the statement.

View on HN

> I'm tempted to just credit myself 1 monetary unit in production and just show them the statement.

I would be tempted too, though I could bet that this will be a termination of an employment, instead of the problem being fixed.

I would like to be proven wrong on this speculation..

Not just that, I would expect criminal charges to follow.

Yes, that's what I thought as well.I'll just have to suck it up until the test environments are up again and provide a proof of concept exploit.

I'm just impatient because it's a really clever and somewhat complex hack that challenges some multi-threading and transactionability assumptions some people mande and I can't really talk about it(which I'd love to share with my peers).

Raducule, did you did CYA (cover your ass)? E-mail(s) to higher ups responsible in case of a fuck-up that most likely will happen in the future? Do it now if you didn't, or "wave and smile" if you did. Let them burn if you are ignored, no longer your problem.

Sometimes it matters who finds the issue more than what it is....

Not to downplay the issue in question, but you have to be realistic about prioritazation. An exploit of "if I change variable in URL I can see other people data" trumps "if I make multiple concurrent requests with specific input I can give myself monies". I guess not by much, depending on the complexity involved and the know how required to carry one vs the other. Another thing all together is who reported the issue - sometimes it's more of a PR experience, depending on the company

Debit yourself 1 monetary unit, and then say you could just as easily credit money.

Never to yourself. Maybe to a board member. Or all of the board members. But that's a big maybe.

And make sure your contract covers your ass, under production system testing / penetration, or something similar.

I could only exploit this for my own account, and there are only money involved, if it was human lives at stake, I would not have worked at anything else until the issue was fixed.

The bug that lead to me discovering the security issue was mitigated by another developer, the security issue was also deemed fixed, I am 100% it was not, but there's no way to proove it at the moment, except u production, that's why I said I was tempted to actually do it.

Anyway, there's nothing much to gain by me by antagonising another coleague, the management or the bank. It's not worth the ego boost or frustration scratch, worst case scenario, I don't patch the issue in time and the bank looses money and they start taking security more seriously.

You'd get much less reprimand if this information was somehow leaked to someone else who then was stupid enough to do it, although to avoid any legal "abetting" you'd have to have some actual documented cya saying "don't mess with this broken feature".

I don't have any ill feelings against the bank or the management, it's just a stupid setup where the local prophet gets ignored, we are swamped with bugs, new business features, new regulatory features, outdated devops, a lot of teams scrambling to catch the monthly release, understaffed qa, non-functional test environments and so on.

I can understand every piece of the long string of factors that lead to this ridiculous situation where such a serious security issue is not being addressed; any one in particular is not ridiculous, but they all compound to the ridiculous of the end result.

I've fixed another ridiculous security issue in the recent past without making big waves, where only one software architect understood the seriousness of just one option in a maven config file(a whole declarative security module was not being weaved into the bytecode because somone added another module and instead of both being applied, only the most recent one was being applied).

That might be true, but hacking without explicit consent is a good way to get fired with potential jail time.

Reply on news.ycombinator.com