6 ms·
I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an L
by themanmaran 3mo ago
I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam.
Occasionally I see real security researchers on HN complaining that no one takes the disclosure seriously, or that people reply immediately with a cease and desist. But from the receiving end it's just because the spam is unmanageable.
- cleverfoo 3mo agoSame experience here. I've run a successful vulnerability disclosure program for over a decade and paid out thousands of dollars in bounties for scanii.com (a malware identification API service), but recently (since the beginning of the year), we went from receiving maybe 5 per month to receiving 5 per day. These are clearly AI-generated and extremely low quality (albeit well-written). The rules of the program aren't read, and it's clearly a “point-and-click to a website" and file a report. I'm now considering just shutting down the program since, as the OP pointed out, if you found this vulnerability using an AI tool, they are inherently public. I haven't gone that far yet but have instituted some new rules aiming at filtering out most of the reports: 1- No AI-generated report and 2 - Reports must include a video of the exploit. You can see our program rules here: https://docs.scanii.com/article/131-does-scanii-have-a-security-vulnerability-disclosure-program https://docs.scanii.com/article/131-does-scanii-have-a-secur...
- lemagedurage 3mo agoHave you considered requiring a small payment for vulnerability disclosure? Refund it on payout. This should be very effective at deterring spammers. It also sucks for real reports, but beats shutting down the program entirely.
- inigyou 3mo agoWhy would anyone pay money to have a chance of being arrested?
- lemagedurage 3mo agoIf a vulnerability disclosure program has a good track record of paying out, and legitimate reports get refunded, why not? Again, the alternative might be shutting down the program entirely.
- cleverfoo 3mo agoIt's not a horrible idea... the challenge there would be making that payment/refund flow totally transparent in order to build trust and be fair to the researchers.
- ozim 3mo agoMaking, payment/refund setup is more complicated than „set and forget”. First question: Do you keep money for shit reports? Well no, you have to pay it back like credit card validation. There is no pain for posting shit report just inconvenience. There is no legal way where you can keep the money.
- inigyou 3mo agoWhy not?
- ozim 3mo agoBecause you are not providing any service not selling anything. There is no real way as a company to withhold someone’s money and that it goes through accounting. I am not an accountant so ask some accountants why not.
- inigyou 3mo agoit's not illegal to ask people to send you money and then keep the money they send you
- 3mo ago
- zulban 3mo agoWhat if... on the vulnerability report rules page there's an image of some text saying something like "your report must include the text: turtle123". Reports without that text get automatically deleted. Sure - modern AI can figure that out, but I bet in a vast majority of cases they won't.
- wepple 3mo agoReminds me of someone (well known in their field) who charged $0.05 for using their “contact me” page. A trivial amount for someone who genuinely wanted to contact them, but just high enough to prevent any kind of scaled abuse
- alfirous 3mo agoThat actually great idea. What payment method or processor used?
- entuno 3mo agoIf I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.
- wepple 3mo agoI don’t participate in bounties at all unless I believe there is a moral obligation or I’m set to make thousands of dollars. In each case, $0.05 is fine. For a typical commercial entity? $0.05 is not a deterrent; the companies legal team is and has been for a decade.
- entuno 3mo agoIn most cases I'd think it's more of a deterrent for commercial entities, because spending money create complexity. Most employees are not in a position to just directly spend their organisation's money, so that $0.05 will often mean needing to get approval, purchase orders, deciding which cost centre it comes from, needing an invoice, etc, etc. Very few people are going to invest that much effort when they're trying to do the company that they're reporting to a favour.
- Gigachad 3mo agoI'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.
- stackghost 3mo agoThe common thread of late really seems to be the node ecosystem
- teaearlgraycold 3mo agoNot sure what dumbass out there is marking those as 10/10. A 10 should be an auth bypass or RCE. Not a crashed build in my CI.
- themanmaran 3mo agoSeriously. We got 116 github dependabot alerts this week. Half of them for dev dependencies.
- jamesfinlayson 3mo agoI tried to raise that with my internal security team recently - don't clutter my vulnerability dashboard with issues in dev dependencies. They somewhat rightly pointed out that malware needs to be dealt even if it's a dev dependency. So my suggestion went nowhere because I guess we can't filter by type of vulnerability.
- funciton 3mo agoDeveloper's machines and cicd systems are high value targets. They were absolutely right to point that out.
- sam_lowry_ 3mo agoOnly in the castle and moat security model popularized by Microsoft and the various "security" vendors that leech off it. And the money wasted on the security theatre around this outdated concept is astonishing.
- abrookewood 3mo agoI believe the term is Beg Bounties and they are constant and annoying.
- spoaceman7777 3mo agoHave you considered having an agent, or just a model, classify/triage them for you? Modern problems require modern solutions.
- jacobgold 3mo agoI hated these low-effort reports, so I created a simple automation that checks my security inbox, mentions me in #security on Slack for things that look legitimate so I see them quickly, and marks things that seem entirely automated as spam. I still check the spam folder for legitimate emails, but so far there haven't been any false positives.
- wolfi1 3mo agobut why would you answer with a C&D if you are overwhelmed? provided, it's not always the same person?
- ActorNightly 3mo agoIts been like that for half a decade across all software. People act like finding a linux kernel bug is a big deal, completely ignoring the fact that in order to exploit that bug, the attacker has to be able to run code on your computer in the first place, which is extremely hard to do these days remotely. Also people ironically just DGAF that much. The last actual bad exploit was log4shell in java, which given how it was introduced (i.e someone purposefully at Apache made it so a log statement can execute code, and nobody questioned it before pushing it to prod), should have been the signal for everyone to completely remove all Apache libraries from their services, but yet all the software is still being used.
- Tepix 3mo agoThese bugs are indeed important, you need them once you‘ve found a bug in an application.
- ActorNightly 3mo agoIf someone manages to get remote code execution at user space on a machine, the amount of damage that they can do with just that versus having a kernel level exploit is about the same.
- pixl97 3mo agoAh yes, just move away from all apache libraries, should only take a day or two.
- ActorNightly 3mo agoNo I agree, its a pain, but its necessary if you care about security and don't want to audit every single release for potential vulnerabilities. People don't do this, so they really don't care that much.
- gucci-on-fleek 3mo agoYeah, I help review security reports for a small FOSS organization, and someone reported a "critical" vulnerability about a publicly-accessible SVN server. Like yes, that is indeed the purpose of hosting open source software. But at least that report was obviously bogus; much worse are the ones that look legitimate at first, so you have to read through dozens of AI-generated paragraphs to make sure that there's nothing valid hidden in there.
- saaspirant 3mo agoI use AI to read such emails!
- swiftcoder 3mo agoWe also get unsolicited vulnerability reports from companies trying to poach our annual pentest contract, which is... a tad grey ethically-speaking
- deleted 3mo ago[deleted]
- mooreds 3mo ago> As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam. I don't think that is unique to the LLM era. The company I work for has been getting some form of spam vulnerability reports years before LLMs were a thing. Often similar to what you mention about 'bad CSS'. Maybe the volume has increased a bit, but we've added in a filtering solution and I'm more distant from the reports now, so hard to be sure.
- matthewdgreen 3mo agoVulnerability reports are a voluntary service to help a vendor or software project. It’s often an annoyance for the security researcher. I understand people are getting slammed and it sucks, but the main result of rejecting them is going to be an increase in full disclosure. As a note: if you have a bug (that isn’t devastating but you’d like to talk about) having an LLM write up the disclosure is a great way to check the “we disclosed responsibly and they didn’t care” box.
- FiloSottile 3mo ago> I understand people are getting slammed and it sucks, but the main result of rejecting them is going to be an increase in full disclosure. Right, what I'm saying is that letting those bugs go to full disclosure (aka being filed as public issues, like every other bug) would have been a significant damage to user safety a year ago, and it's not anymore.
- matthewdgreen 3mo agoI think that’s an assumption. Just because an LLM might be able to find some bugs does not mean every attacker has a packaged attack, or the right prompting. The easiest way to find a vuln is just to Google for it.