Ask HN: How to handle responsible disclosure when a company ignores you | Hacker News Reader

Ask HN: How to handle responsible disclosure when a company ignores you

6 pointsflutas8 comments

Recently I discovered an urgent issue on a website I frequent. This issue is leaking so much user data through a websocket that it's not even funny and requires zero action (aside from loading the site) to get.

Data being leaked includes email addresses, geolocations, private photo (read: nudes) URLs, bcrypted (thankfully at least) passwords and salts, password reset / account activation codes, user agents, IP, fingerprint hashes, staff notes about the accounts and even reports (including reason, text submitted by the reporter, and the reporter itself).

I've tried multiple ways of contacting the company, as the data could seriously harm users and lead to them being stalked/blackmailed but they have given no response whatsoever. Tried to mention/message them on social media, did an email blast with guesses at their CEOs email (didn't bounce back like security@ did), and as a last resort their CS line. Even their CS simply closed the ticket without even a response, so I'm at a loss on how to proceed.

I've considered going to someone like Krebs, but I'm extremely hesitant to simply because of what could happen if this gets out without being patched.

> I've considered going to someone like Krebs

This sounds like a good idea, honestly. Companies' reactions to vulnerability disclosures can be... unpredictable. If security research is not your area, it might be easier to get someone from that industry to handle the disclosure.

> but I'm extremely hesitant to simply because of what could happen if this gets out without being patched.

If you found this vulnerability, odds are someone else will run into it too sooner or later.

> If you found this vulnerability, odds are someone else will run into it too sooner or later.

worse is someone is already extracting data from it, continuously scraping day after day, week after week. it happens.

Are you American? Truth is an absolute defense against libel, so post it on blogspot or whatever then go get some free food down at the weekly lab lunch.

I'm completely serious.

At one point I got mad I couldn't even get an interview at a decent internship despite being an ok-ish hacker, so I wrote up a description of how at the time you could go into about:config in Firefox and just write whatever latitude and longitude you want, and spoofed my location as in the middle of the 2009 green revolution protests in Iran.

Someone kind of chewed me out later, pointed out we don't have diplomatic relations with Iran, I hadn't gotten permission from Zuck or whatever and I kind of shrugged.

(You'd be surprised how much can be accomplished if you start repeating things from classes where the professors read directly from the powerpoint like "I'm just a rational actor responding to incentives" as you reach into your cargo pants and maintain a creepily intense level of eye contact when folks are dumb enough to bring up the internet in real life.)

If it is a larger-profile German or European webpage, contacting c't / heise investigativ would probably be a good idea.

They are the largest German computer magazine, and have a great track record in getting companies to change bad practices and respecting consumer rights. I also consider them trustworthy w.r.t. not inadvertently leaking the problem.

They have a secure contact form under https://www.heise.de/investigativ/

Depending on the countries this website serves you might also want to get in contact with officials (i.e. https://edps.europa.eu/data-protection/our-role-supervisor/p...)

One way to get it fixed quickly is to drop the exploit publicly with a basic PoC. You've tried a responsible path and it's wasted your time.

There aren't laws mandating "responsible disclosure". It's a professional courtesy.

The irresponsible party is the entity operating the service without a security@ email address. Lots of bad actors could easily find this vulnerability independently (probably already have). This means all the service's users are continually at risk right now, every second of every day as long as this doesn't get resolved

1. See if you can connect with someone at LinkedIn.

2. Apply for and interview for a job opening and bring this up.

3. Look up their corporate records and see if there is an attorney on record that helped them file. Report to them.

Krebs via a secure mechanism.

Reply on news.ycombinator.com