RE: Informing Companies about security vulnerabilities...

So you are admitting publicly that you and a class of students that you teach are illegally testing random public
websites for the purpose of learning about security vulnerabilities? Sounds like you/your company need to speak
with a lawyer.

- Robert
http://www.cgisecurity.com/ Application Security news and more
http://www.cgisecurity.com/index.rss [RSS Security Feed]

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Joseph McCray
Sent: Wednesday, October 04, 2006 3:07 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Informing Companies about security vulnerabilities...

This probably won't sound like that big of a deal, but it still bothered me so I figured I'd ask the list. I was teaching a Web Application Security class last week and we were performing simple XXS, SQL Injection, etc on the vulnerable web apps I use for class.


Normally, I go to a live public website or two during the class and we talk about common tests to perform and how to approach certain types of websites. A common subject is how to handle large website with tons of dymanic content - so the class chose a major newspaper's website for the discussion.

Usually when we do this we only find a few simple things (XXS for
example) - no big deal right. With this particular website we just kept finding another, after another and on and on. Over 600 instances of XXS, over 200 SQL Injection - this was bad. After a while it started to get boring there was so many....

So I drafted a letter to the editor as well as several other prominent people at the newspaper. It detailed my finding and recommended some possible mitigation strategies. After emailing this I didn't hear anything for a few days, so I emailed it again and followed up with a phone call. After getting no response to the second email and then having been bounced around from department to department when I called I just said forget it.

Has anyone else gone through a similar situation? Was the company receptive? Other companies I've contacted in the past have been quite receptive - I'm just curious if other people have gone through this as well.

No need to fill the list with this, you can email me directly with your inputs and stories.

--
Joe McCray
Toll Free: 1-866-892-2132
Email: joe@xxxxxxxxxxxxxxxxxxxxxxx
Web: https://www.learnsecurityonline.com


Learn Security Online, Inc.

* Security Games * Simulators
* Challenge Servers * Courses
* Hacking Competitions * Hacklab Access

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: CISSP
    ... Unless you've already done a CS or equivalent degree, it's unlikely that you'll have covered some of the architectural or formal methodologies, practices, standards etc that you must know to take the CISSP exam. ... On-the-job learning is an excellent way to learn all things security but you only tend to learn the technologies etc around the environments you're working with. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: OpenSSL Hacks
    ... value of malloc" a security vulnerability. ... without elaboration that you found security vulnerabilities in OpenSSL, ... availability (if you read material on real-world cryptosystems failures such ... Having a very brittle security system isn't going to do that. ...
    (sci.crypt)
  • Re: [Full-Disclosure] GUNINSKI THE SELF-PROMOTER
    ... > development team of security vulnerabilities in its product, ... doesn't fool us Matthew. ... Essentially, Microsoft ...
    (Full-Disclosure)
  • [Full-Disclosure] Re: Windows 2000 Source code .torrent
    ... Yeah, because, you know, this isn't full-disclosure or anything. ... Why would it be appropriate to discuss security vulnerabilities to ... Exposing more of MSFT's secure-through-obscurity source ...
    (Full-Disclosure)
  • OT, Is this suspicious to you too? (was FW: Graduate Student Surv ey)
    ... being the most severe to 5 being the least severe." ... I'm definately not a member of the Computer Security Institute, ... A Survey for Exploring the Cost of Correcting Security Vulnerabilities ... delivering to the intended recipient, be advised that you have received ...
    (Vuln-Dev)