Discovered large security hole in someone elses website... What to do?

Question

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users.

I went to have a look at it to see what level of knowledge he had so I knew how to position myself for this potential job.

I tapped a single quote into the login box on the front page and up pops a SQL error. So I tried a simple " a' or 'a'='a " in each box and was immediately logged in as the administrator.

He had written a fairly comprehensive administration site by the looks of things. At the bottom of the page a "Download SQL Backup" button. This is where I stopped.

My question is this. What do I do?

As a developer myself I would appreciate the heads up. But as someone who's hopefully going to be paid to do some work for him I wouldn't want to throw all sorts of trust issues into the mix.

Any ideas?

Now you have a story for this SO thread: [Worst security hole you've seen?](http://stackoverflow.com/questions/1469899/worst-security-hole-youve-seen/3242261) — user16764, May 27 '11 at 18:46

Brimstedt · Answer 1 · 2011-05-27T18:12:15.820

23

I'd tell him. If he gets mad about you informing him rather than abusing your new found knowledge, do you really want to work for him? You owe it to the users of the site as well...

edited May 27 '11 at 18:12

answered May 27 '11 at 18:06

Brimstedt

421
3
4

score 20 · Answer 2 · edited Jun 16 '20 at 10:01

It's important that you take Security Vulnerability Disclosure seriously. Improper disclosure may in some jurisdictions be a crime, and is certainly Not Cool. Good disclosure involves privately notifying the vendor and giving them a grace period in which they must provide a fix and a full disclosure (if customers have been impacted). After that grace period, you may then disclose.

Wiki says:

A responsible disclosure first alerts the affected vendors confidentially before alerting CERT two weeks later, which grants the vendors another 45 day grace period before publishing a security advisory.[27]

A full disclosure is done when all the details of vulnerability is publicized, perhaps with the intent to put pressure on the software or procedure authors to find a fix urgently.

That said, you have to tell him and quickly. The next person to discover the exploit (and this one is trivial, so that will happen quickly) might not be so responsible.

As far as trust issues go, explain to him exactly what you explained to us. Tell him that you haven't disclosed the vulnerability to anyone other than him. If I were him (and I have been in a situation where I wished the attacker had disclosed properly), that would make me trust you more. In fact, I would pay you for the information and for your responsible disclosure.

score 12 · Answer 3 · answered May 27 '11 at 18:05

12

Yeah. I stumble upon security holes while browsing potential client work on occasion as well.

I think you absolutely need to make him aware, but I would not mention it in the context of evaluating the quality of his work.

answered May 27 '11 at 18:05

I'll definitely mention it, It's just the case of how exactly. I don't want to appear as if I could have malicious intent in any way. – bencoder May 27 '11 at 18:14
I'm due to see him next week. But whether to do it over the phone before then I don't know. – bencoder May 27 '11 at 18:14
2

@bencoder if you had malicious intent, you wouldn't be informing him in this way, period. – Rein Henrichs May 27 '11 at 20:46

score 8 · Answer 4 · answered May 27 '11 at 18:17

No question I'd tell him.

I might frame it as you were just poking around doing some research on what's already there, gearing up to jump into the project as quick as possible (maybe mention some things that you think were done well, if nothing else, to stroke his ego).

Then drop the bomb, but immediately follow it be explaining that you are aware of these issues as they're fairly common and the first thing that you'd like to do is to have the opportunity to purge his system of these critical security risks.

score 1 · Answer 5 · answered May 27 '11 at 18:17

1

Ask one of your friends to report it to him. That way, the users are protected, and the trust issues and other problems don't affect your potential employment.

answered May 27 '11 at 18:17

blueberryfields

13,200
8
51
87

2

And most importantly it's *your friend* that gets investigated by the police for hacking, and not *you*. – Simon B Apr 09 '15 at 09:16
@SimonB if that's a worry, then substitute professional security news reporter, like, say http://krebsonsecurity.com/ – blueberryfields Apr 09 '15 at 13:46

score 1 · Answer 6 · answered May 27 '11 at 18:39

1

You could always send a description of the vulnerability in an anonymous email. This allows them to fix it without any possible ramifications on you.

answered May 27 '11 at 18:39

Morgan Herlocker

12,722
8
47
78

Discovered large security hole in someone elses website... What to do?

6 Answers6

Linked