Re:Nike.com allows easy account take over
by nutbear on Tuesday July 19, 2022 @01:05PM
(#32154749)
Thanks for sharing your story!
A decent amount of disclosure programs explicitly call out social engineering as unacceptable conduct and submissions.
However, social engineering is a very valid method for attackers and in many cases, offers the path of least resistance.
While I understand why companies don’t want good faith security research to call and try to trick the human factor, this is still a very real attack vector that needs attention and to be fixed as in what you’ve described.
A decent amount of disclosure programs explicitly call out social engineering as unacceptable conduct and submissions.
However, social engineering is a very valid method for attackers and in many cases, offers the path of least resistance.
While I understand why companies don’t want good faith security research to call and try to trick the human factor, this is still a very real attack vector that needs attention and to be fixed as in what you’ve described.