Hacker News Reader

Comment by Shrezzing | Hacker News Reader

> Shubham Mittal, co-founder and chief technology officer of RedHunt Labs, alerted TechCrunch to the exposure and asked for help in disclosing to the car maker. The London-based cybersecurity company said it discovered a Mercedes employee’s authentication token in a public GitHub repository during a routine internet scan in January.

That's a strange way to disclose a security security issue.

View on HN

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.

This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.

No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not.

I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.

> publishing a bug bounty program doesn’t mean you’re the good guys

this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope

[1]: https://eu.desmoinesregister.com/story/news/crime-and-courts...

> this is meaningless rabble

That is rich coming from yourself. Are you at all familiar with German law?

It’s less than a 1% chance of financial ruin!m? Sign me up!

I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash

I would probably avoid transportation that kills 1% of its users each trip.

Username checks out. Guess you're going for 100%?

Assuming anyone is reading that email account

Lawyers will.

Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.

It’s pretty dangerous according to German law to disclose security issues.

From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969

This is why I need the CCC in my life

But they have no big influence, they just play the courtjester to a forever demented king.

Thou it would be worse without a jester

And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.

> journalists can protect their sources.

But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.

Wouldn't it be even more dangerous to report them to a journalist?

Sounds like he was just trying to guarantee a mention (advertising and clout) in the subsequent TechCrunch article…

TechCrunch would be very far down my list of publishers were I wanting to responsibly publicly disclose something.

Hard for me to take this particular outfit seriously after they decided to optimise for engagement by running to Entertainment Tonight.

The'd be on my list if my goal was tie in someone who will give me easy, and very visible, publicity to the process.

"I contacted unrelated people and all the press to help them"

Call it what it is, a totally rat move placing Mercedes in risk for pure self-promotion purposes - instead of going via the vulnerability disclosure channel (first result on google when googling "mercedes security disclosure".)

I hope nobody is stupid enough to ever engage with this firm after this publicity stunt.

The only thing putting Mercedes at risk are previous sentences going heavy handed on ethical security researchers that bothered contacting german companies. You can find some examples online where just "poking" with leaked credentials not unlike OP was not looked favourably upon.

https://www.theregister.com/2024/01/19/germany_fine_security...

https://www.darkreading.com/vulnerabilities-threats/another-...

there's a world of difference in contacting a company via an ethical vulnerability disclosure program and doing so without one in place. it really shouldn't be that difficult to understand. Being "german" has nothing to do with it

Reply on news.ycombinator.com