JungleCats

JungleCats on Hacker News

Re:Ask HN: Worth following up? Publicly facing root passwords on a For... on Friday February 15, 2013 @07:28PM (#5229702)

Yeah, I guess you are right. It's more that I expected a simple "Thanks" for ensuring that they didn't end up on the front of the New York times at some stage.

Re:Ask HN: Worth following up? Publicly facing root passwords on a For... on Friday February 15, 2013 @04:10PM (#5228698)

Slightly off-topic, but check out this great email from PayPal today.

Hi JungleCats,

Thank you for your participation in the PayPal Bug Bounty program.

While we continue to review each vulnerability we receive on a case-by-case basis, we have determined that this bug is not eligible for payment based on the fact the website is in the process of being decommissioned and will be shut down in the near future.

Thank you, PayPal Security Team

yawn

Re:Ask HN: Worth following up? Publicly facing root passwords on a For... on Friday February 15, 2013 @03:40PM (#5228490)

Yeah, I absolutely see where you are coming from.

I considered just emailing the CEO and being all "Hey, thought you should be aware that I've sent multiple emails and just wanted to ensure you are informed"

Ask HN: Worth following up? Publicly facing root passwords on a Fortune 100

Posted by JungleCats on Friday February 15, 2013 @03:13PM
from the ask-hn dept.

Hey there guys! Sorry if this isn't the normal style for posts, I haven't been on here long.Essentially, I recently found a publicly facing document which detailed ALL of the root passwords for a Fortune 100 company. (Amongst other things, it was an open directory which also included all of the staff VPN passwords, and other sensitive information including SQL backups). I immediately reported...

( Read More... | 9 comments | 8 points | on HN )

Re:What is the process for submitting a Zero Day vulnerability? on Tuesday January 22, 2013 @10:05AM (#5097403)

I appreciate the reply, I'll be sure to bookmark the link.

Re:What is the process for submitting a Zero Day vulnerability? on Tuesday January 22, 2013 @06:07AM (#5096542)

Hey there netcorps,

Thanks for the reply. I think that's the way I'll go about it.

Much appreciated!

What is the process for submitting a Zero Day vulnerability?

Posted by JungleCats on Tuesday January 22, 2013 @05:44AM
from the self-post dept.

Hey there guys,I've found a Zero Day vulnerability (Just URI XSS) though it is affecting anywhere in the range of ~6M websites (according to Google).I was wondering what the process I should follow is. (Report to vendor, wait for them to update software then disclose?)I also was wondering the legality of this, am I likely to get into any kind of trouble here?~JungleCats

( Read More... | 4 comments | 4 points | on HN )