when you find a security issue better stay away from Bugcrowd - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 15, 2022, 12:35:47 pm
content: Bug bounty platforms, like Bugcrowd, are meant to help security researches to report secutity issues and earn a few bucks. But Bugcrowd has changed to a quite disturbing stance: When Soatok Used Bugcrowd and Got Banned for Doing the Right Thing (https://soatok.blog/2022/06/14/when-soatok-used-bugcrowd/).

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: June 15, 2022, 12:46:08 pm
content: Sigh.The question I have is if this chap found a sec flaw because he happened to be poking around, why didn't anyone else?

author: madires
author_rank: Super Contributor
timestamp: June 15, 2022, 01:25:14 pm
content: There aren't many security experts with a deep unterstanding of cryptography.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: June 15, 2022, 01:32:30 pm
content: Quote from: madires on June 15, 2022, 01:25:14 pmNo, I suppose not. Maybe the peeps who don't shouldn't be coding this stuff in the first place. Relying on bounties is a awful way to perfect code.

author: magic
author_rank: Super Contributor
timestamp: June 15, 2022, 03:52:21 pm
content: QuoteAKA how to get banned from an Internet website by having level 1000 autism

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 15, 2022, 05:27:07 pm
content: Quote from: magic on June 15, 2022, 03:52:21 pmJust FYI, level 1000 autism beats being an asshole, every single time.

author: bd139
author_rank: Super Contributor
timestamp: June 15, 2022, 05:50:00 pm
content: Quote from: madires on June 15, 2022, 01:25:14 pmFrom experience there aren’t many security experts out there full stop.I found a major vulnerability in a very well known security scanning product by pointing it at itself. Instead of getting thanked for the report I got asked to sign an NDA by a lawyer. I declined this and let them fix it at their leisure. It took 7 months.And that’s as far as any company in the security space is worth be it technical or consultancy.

author: magic
author_rank: Super Contributor
timestamp: June 16, 2022, 08:16:14 am
content: Quote from: Nominal Animal on June 15, 2022, 05:27:07 pmQuite the opposite, because outcomes are the same either way, but the former at least has achoiceAt any rate, a quick rundown of what happened:1. Through Bugcrowd, Comcast advertises to pay for exploitable vulnerabilities in some 3rd party software they use.2. Soatok finds a potentially exploitable bug in that software and reports it to Bugcrowd.3. After initial hurdles due to lack of a working exploit demo, they forward the matter to Comcast.4. Due to lack of a working exploit, Comcast can't decide if it's a real problem, asks to reach out to the original author.5. Instead of seeking private contact with the author, dude files a public bug report on G**Hub6. Bugcrowd learns about it, claims it's against their ToS and threatens to ban him if the bug report isn't taken down.7. Full nuclear meltdown nerd rage mode activated:- OMG it's emotional blackmail, you can't threaten to ban me like that, I'm not giving in to bullying- tough luck motherfuckers, I'm privileged enough that I don't actually need your stupid account anyway- for those with less privilege, I'm taking a principled stand - ban me if you dare!- have you never heard of Streisand effect???!!! Here's an archive of the bug report (did the guy actually create it himself?)Who is the asshole here?

author: wraper
author_rank: Unknown
timestamp: June 16, 2022, 08:27:29 am
content: Quote from: magic on June 16, 2022, 08:16:14 amIt shows snapshot was made 2 minutes after posting. So certainly way before Bugcrowd had any chance to complain.

author: magic
author_rank: Super Contributor
timestamp: June 16, 2022, 08:42:29 am
content: LMAO, you are right.It looks like his whole purpose in publishing this bug was to stir up a shitstorm and get an opportunity to write an angry blog post complaining about their demands for working exploits.

author: wraper
author_rank: Unknown
timestamp: June 16, 2022, 08:42:48 am
content: Quote from: magic on June 16, 2022, 08:16:14 amQuoteAFAIK there is no way to privately contact maintainer on Github. So them suggesting this meant doing so in public.

author: magic
author_rank: Super Contributor
timestamp: June 16, 2022, 08:48:24 am
content: Every git commit contains the name and email address of the author.99% of serious projects fill these fields correctly and I just checked that JSBN is no exception.There is also a link to the maintainer's personal page on his GH profile.It took me less than 5 minutes from reading your post to having Andy's personal email address.

author: wraper
author_rank: Unknown
timestamp: June 16, 2022, 08:50:30 am
content: Quote from: magic on June 16, 2022, 08:48:24 amYes you could find an email. But it would not be engaging on repository. So would be doing not what they suggested.

author: magic
author_rank: Super Contributor
timestamp: June 16, 2022, 08:53:56 am
content: Yes, retarded corporate droids asked him to do a retarded thing and he did the retarded thing and other retarded corporate droids couldn't believe that the former retarded droids are that retarded so they banned him.Everybody involved got what they deserved, including other "innocent" users who rely on JavaScript software for anything important.

author: wraper
author_rank: Unknown
timestamp: June 16, 2022, 09:09:32 am
content: I would not say it was THAT retarded. It was not some bug which could be readily exploited. It was a flaw in algorithm which would need some serious work to make any use of. Nor it was revealed to the public immediately without notifying maintainer:https://github.com/andyperlitch/jsbn/issues/43Quote

author: Nominal Animal
author_rank: Super Contributor
timestamp: June 16, 2022, 11:08:42 am
content: Quote from: magic on June 16, 2022, 08:16:14 amYou misunderstand. Those with autism make for damn good auditors, bug checkers, and so on. In this story, nobody has autism, even if you claimed so.Quote from: magic on June 16, 2022, 08:16:14 amSeveral of them for sure, but none with autism I can see.(No, I don't have autism myself, just poor social skills. But I'll take poor social skills or even autism, over being an asshole, every day. Even those with hygiene issues can be trained; assholes cannot.)