Hacker News Reader

Comment by onewaystreet | Hacker News Reader

This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?

View on HN

Well.. you didn't read the first couple lines? Notably:

> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration, but in my eyes, they really aren’t seeing the severity and danger of this situation, and really are not reacting quick enough.

> This document is being released due to several high profile companies being infiltrated using the recent Shellshock vulnerability, and what I have deemed as an improper response, or lack thereof ...

Seems pretty straight forward: hackers have already downloaded all the personal data out of these organizations and are probably using it in ways harmful to the general public already. This guy is forgoing his probable bug bounty payouts as this is, as he says, a really serious issue.

Thank you to him!

> I’ve notified both Yahoo! and the FBI New Orleans field office of the infiltration

And the feds are standing at his front door in 3 .. 2 .. 1.

Looks like you only read the first couple lines. What I'm referring to:

> I’ve also emailed Marissa Mayer and contacted her via twitter, both of which yielded zero results and no response. There are no publicly available contact methods for Yahoo! that have yielded any luck with trying to contact them regarding this.

I think the "that have yielded any luck" part of that quote is pretty important.

The point I'm making is that he didn't do the obvious thing and search for their actual security report address which they have, respond to, and pay people money who report bugs to. He found the hacked servers by doing a search but couldn't do this?

I don't see how you're reaching this conclusion. He said, there are no publicly available contact methods that have "yielded any luck". He didn't say there are no publicly available contact methods or that he didn't e-mail yahoo's "security" e-mail address.

I'm reaching this conclusion because the only person he mentions emailing is Yahoo's CEO.

Pretty sure that if he's actually talking with Yahoo and the FBI then someone would have pointed him to that address if he really hadn't found it himself! More likely, they just told him "hang on, we'll look into this.. eventually" and he felt this was important enough that a delay like that is unacceptable. Which it is. If you know you've just lost all your customers data, you don't wait a few days to tell them - you schedule a press release for same day release.

> that have yielded any luck with trying to contact them regarding this

Might be the important part of the quote you missed.

He didn't email the right address and didn't bother to look for it. Yahoo, like google and facebook, has a large security department but if you send your report to support@yahoo.com and not security@yahoo.com and don't get a response you don't get to say Yahoo is lax in security because you didn't take a second to google for the right address.

Dude your screen name is really telling.

He reached out, and didn't have any luck. Companies truly need to learn how to deal with these breaches in a way that re-invites the public trust

You seem to be missing my point. I've repeated it in a bunch of other comments but I'll do it again here: You don't get points for "reaching out" when you don't spend a second to search for the right address to reach out to. Yahoo has a page dedicated to reporting bugs. If he had used that page he would have gotten a response. Yahoo has paid dozens of people for doing this https://hackerone.com/yahoo?show_all=true.

I'm not quite sure why you seem so sure he didn't also send an email to that address (or use that form)? I didn't read the article thoroughly, did he enumerate somewhere which ways of contacting Y! he tried?

if he had sent it to the other address, why would the person who responded pointed it out as the email to contact? If he had already sent an email to the Yahoo Security contact, why would he then be told to do the same thing twice?

According to this[1] article about the current issue:

"Before releasing this information, Hall emailed Yahoo and tweeted at its engineering team and CEO Marissa Mayer.

It was confirmed to him that its servers had been infiltrated but Yahoo refused to pay him for alerting them as it was not part of the company’s bug bounty programme."

[1]: http://www.independent.co.uk/life-style/gadgets-and-tech/new...

EDIT: The quote previously included "Yahoo is notorious for its disregard of bug bounty hunters, having last year rewarded one such hacker who identified three bugs in Yahoo's servers with a $25 voucher for company merchandise." but I moved it here as it caused confusion regarding which issue the article was referencing.

Please read the follow up:

http://yahoodevelopers.tumblr.com/post/62953984019/so-im-the...

(and HN discussion: https://news.ycombinator.com/item?id=6488897)

That article is poorly reported. Yahoo didn't have a bug bounty program at all at that time. And their response was blown totally out of proportion.

They keep insulting bounty hunters like that, they'll end up on the wrong side of black market bug trades every time some new exploit comes up. And I won't be defending Yahoo when that happens.

Are these people concerned with security or are they running a protection racket? The way you put it is starting to sound like the latter.

This has nothing to do with "protection racket" and downvoters are going to be in for one hell of a reality check if you don't believe that this will happen.

Bounty hunters do this stuff for a living. If the company pays with $25 vouchers and the black market pays on the order of tens/hundreds of thousands, who do you think "these people" will go to?

I frankly don't believe you. I think you vastly overestimate how much you can sell a vulnerability for and vastly underestimate the morals of white hat hackers reporting bugs for a bounty.

There are close to zero companies that pay tens/hundreds of thousands for a bug, and yet clearly bounties are being paid and not 100% of bugs end up on the black market.

Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049)

Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discove...)

Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewa...)

Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.

Mitnicks security company recently started a vulnerability marketplace. For vulnerabilities that meet the criteria (they have to be of a certain severity, not already known, etc), they are sold for a minimum of $100,000.

I'd say: "Are these people concerned with receiving income for difficult, highly specialized, valuable work, or are they running a charity?" I guess it's a matter of perspective.

Not really. We have a system for ensuring that people get paid for valuable work: they're called contracts.

Yes, the market for security vulnerabilities is essentially a protection racket, and everyone knows it.

Found this email from him archived on Seclists:

    I identified that a few major sites were actually compromised using the vulnerability - Yahoo! being one in 
    particular. Tripod/Lycos and WinZip.com were also compromised. Yahoo! reached out and gave me a response, albeit a very 
    weak one, only after the FBI, media and CEO Marissa Mayers was contacted... WinZip patched their boxes and didn't 
    bother responding or notifying me that they got it done.

And, amusingly, an apology for his rambling:

Please do excuse the scattered nature of the email sent to Marissa Mayers @ Yahoo! - there were other correspondences that are currently being kept private, and at the time that I wrote that one, I had been awake for roughly 48 hours and was fueled on caffeine and nicotine.

From http://seclists.org/nanog/2014/Oct/158

Then he wouldn't bring attention to his consultancy firm. "Gee, these guys sure did show the Yahoo CEO! We need to hire them!" Says the MBA.

And this is different from what everyone else on HN does...how?

Reply on news.ycombinator.com