Re:My car insurance exposed my location
by tptacek on Saturday December 09, 2017 @11:11AM
(#15886392)
Not much. It's a good finding; as a bounty submission (for a good company), I could see it getting $1-$2k. But I don't think there's a market for these kinds of information leakage bugs. As a rule of thumb: if you can't plug a vulnerability directly into a business process that was already built and operationalized on some other vulnerability, it's probably not worth anything on the black market.
Re:My car insurance exposed my location
by jdavis703 on Saturday December 09, 2017 @11:17AM
(#15886417)
It might be good for class action lawyers and bounty hunters to start teaming up. Then the company either settles up to avoid a trial and bad publicity, or else they have an expensive court battle with potential negative PR coming out.
Re:My car insurance exposed my location
by tptacek on Saturday December 09, 2017 @11:47AM
(#15886579)
Something like that already happened with Justine Bone and Medsec.
This seems like the kind of bug that can cause a lot of harm (if a malicious actor wants to track someone's location) but not so much profit (no generic mass-account-stealing).
And that's a situation that the US legal system isn't well set up for.
> The company fixed the leak 3 weeks later by providing new Web services endpoints that use authenticated calls. The company mailed its users saying them to update their App as soon as possible. The old Web services have been shutdown after 1 month and half since my first contact with the CERT Nazionale.
> I could be wrong, but I suspect the privacy flaw has been around for 3 years because the first Android version of the App uses the same APIs.
> I got no bounty.
> The company is a leading provider of telematics solutions.
I wonder how much that flaw would have fetched from a malicious actor?