Hacker News Reader

Comment by justshowpost | Hacker News Reader

Why are the Security Departments of ever company so unfriendly? I feel like every blog post of a disclosed vulnerability has had some form or another of: - no replies - delayed replies - vague replies - playing down the vulnerability - reducing the bounty

It’s like they still treat a white hat hacker as a risk, instead o cooperating with them. I don’t get the corporations. The white hat hacker is in this case your best friend. They proved their ethics already by reporting it to them, and they know it already because they found it. There is literally no reason to try to keep the white hat hacker in the dark, not update them, etc. The white hat hacker could have exploited the vulnerability already!

View on HN

I found and reported a security issue to Microsoft. They responded nearly right away and it was a real person . I was soon talking directly to the right team to explain it to. I provided assets required to replicate and they jumped right on it and fixed it. They even told me what KB* it was resolved in via follow up email. I didn’t want any kind of monetary reward - just happy to have it fixed. I regularly report security issues in open source projects too. Now, I also once tried to report a fairly serious issue that impacted iOS and MacOS X (at the time) and you’d have thought (naively) they’d have been super interested and helpful as Microsoft were. Wrong. In fact their first response basically meant I never ended up getting past their first auto reply.

That's a superiority complex. It can be seen especially well in Russia. I've read stories that their companies even start legal actions against white hackers that submit vulnerabilities to them.

This sounds like it happens a lot everywhere outside large American companies. The reasoning probably goes like “why were you even trying to break in, that’s illegal.”

>why were you even trying to break in

Because you're offering money if a way in is found. I feel like that's most of their hesitance, really, they probably just don't want to pay the bounties.

I’d say it is just incompetence.

The group of people who run these corps are old enough not to be grown up with the internet, and some of them just can’t understand the dangers of this new world, even if you tried explaining it to them.

They are missing the fundamentals.

Not only in Russia. I once accidentally discovered a vulnerability in a rather popular job search site (EU). I reported it to them only to be harassed by their legal department afterwards. No good deed shall go unpunished.

No bad deed should go unpublished.

To be fair, there is also some whining involved on the "white hat hacker" side. Triaging reports is not an easy task.

The issue I have often witnessed, is a higher up wanting to play down a vulnerability, or even make so nobody hears about it because they fear it will impact the stock price. You should not forget that there is a financial impact...

Bug bounty programs tend to get utterly swamped with low-quality reports and entitled researchers.

It can be hard to separate signal from noise.

I submitted a memory corruption bug in glibc realloc() to Red Hat's security email contact, and they replied quickly and friendly.

Even Google Security was really friendly, even as I reported something that seemed like an issue but turned out to be my own fault

Because they're not the only person the security team is dealing with?

Because they need to verify the claim and see what it really affects? If there are other repercussions?

Because you don't want to tell more than you need? (a security researcher should know that)

Vulnerability disclosure is the closest thing to a protection racket that is actually legal. So it's natural that people will be on the edge. Sure, it beats the alternative.

Confirmation bias? If the disclosure doesn't go as expected, that's an interesting event, which is likely to draw more attention than if everything was all right.

Security departments are there to protect against threats to the company. Bad publicity is a threat for companies. So never expect some company official to admit that there is a glaring hole in their security, until they are very, very sure that they have fixed it. Fixing a hole likes this can take a lot of time because you need a lot of testing. Apple is not going to tell the rest of the world what they are doing exactly because of possible bad publicity. When they have fixed the problem there are very good reasons for Apple to downplay its importance, which implies that they should pay some money but not too much.

The signal-to-noise ratio is very poor, especially for large companies running bounty programs. In addition to honest and diligent researchers, there are also scam artists, script kiddies, and soccer moms sending in false reports saying “my ten-year-old found this bug in FaceTime, pay up!”

Maybe because legal needs to be involved.

They get the vuln in all cases if you are talking to them: either for free if you post it to f-d, or for some reduced rate (and hushed up) if you agree to the NDA to get the bounty.

The people selling to rogue states and TAO aren't talking to the vendor in the first place.

Bug bounty programs are, for the most part, bullshit.

Reply on news.ycombinator.com