15 ms·

I found Prezi's source code

712 points by psychboo 13y ago

toddmorey 13y ago
Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.
- eli 13y ago
  Well of course there have to be rules. Does spear phishing employees email accounts and using their password to access control panels count as a bug? I bet I could hack a lot of companies that way. Does being susceptible to a massive DDoS count as a bug? Cutting power to the building? I can't speak for Prezi, but it seems like they want people to test the security of their app, but not of their employees or back office infrastructure. Maybe you disagree, but it's their bounty and I think those are fair rules.
  - davorak 13y ago
    A simple rule of thumb seems to be is, does it cause a problem if all the bug bounty hunters take the same approach. Phishing employees, DDoSing definitely cause problems if a large number, or one, of bug bounty hunters take on the approach. It seems even if all the bug bounty hunters searched for and found http://intra.prezi.com:8081 http://intra.prezi.com:8081, preformed google searches and tested found logins by hand, no problem would result for prezi. So it seems like Phishing employees and DDoSing are inherently different then the approach in the post.
  - tantalor 13y ago
    > Does spear phishing employees email accounts and using their password to access control panels count as a bug? Yes, because those control panels should require 2FA, so password-only access is a bug.
    - ars_technician 13y ago
      2FA is susceptible to spear phishing if all the attacker needs is a one time login. Remember that credentials and tokens can be relayed.
      - tantalor 13y ago
        Not necessarily. FIDO fixes this. http://www.fidoalliance.org/user-experience.html http://www.fidoalliance.org/user-experience.html
        ars_technician 13y ago
        How? A phishing site can relay any of this information by acting as a client to the real site while prompting the end user for the requested credentials. The only way FIDO could prevent this would be to make the credentials dependent on the URL in the browser, but I don't see where it does this.
        tantalor 13y ago
        With FIDO, the user doesn't manually enter a 2FA token into a form field. Instead they press a button or something which directly transmits the token over SSL to the authentication server. MITM is still possible, but there are other ways to combat that, such as TLS Channel IDs [1] or Bearer Tokens [2]. [1] http://www.google.com/intl/en/chrome/browser/privacy/whitepaper.html#tls http://www.google.com/intl/en/chrome/browser/privacy/whitepa... [2] http://www.browserauth.net/ http://www.browserauth.net/
  - fleitz 13y ago
    Yes, it does. Customers do not care how the intruder got in only that they got in. Spearfishing is an attack that makes the company look dumb. Leaving the credentials for your source code on the web makes you look even dumber. To qualify for the bug bounty he should have inserted code into their codebase and then exploited that. Fuck these guys.
    - dllthomas 13y ago
      Flooding communications channels (in particular, mental bandwidth of front-line employees) with attempts to spearfish is an attack that interferes with operations even when unsuccessful. It does not make sense to ask the world at large to persistently try such attacks. This case is not like that, though.
  - nostrademons 13y ago
    Large tech companies routinely run pentest exercises against themselves that involve phishing their own employees. Good security has to include educating the human element as well: if you have great technical security but all you have to do to get in is ask an employee their password, you've lost. Large companies also invest significantly in protection against massive DDoS and power cuts to the building, along with drills for earthquakes and zombie apocalypses.
    - eli 13y ago
      I wasn't trying to say those things aren't really security problems... just that they perhaps aren't things you'd want random people on the internet attempting to exploit.
    - danielweber 13y ago
      They also control the rate at how their own employees get phished, especially if they want the employees to report any suspicious attempts. Constant barrages from outsiders will make the employees stop reporting.
- RyanZAG 13y ago
  Having these kinds of rules on bug bounty programs is excellent for hackers though. If I wanted to hack Prezi I now have a lot of very useful information. 1) Prezi is not interested in blocking access to people who already have the ID of the presentation. This is good news since it means I can enumerate the IDs and get access to private presentations - some of which could have useful private data. 2) Prezi is not interested in blocking attacks which enumerate user ids, etc. This is great news - I can get a list of likely email addresses to use later. 3) Prezi disallows any forms of attacks that utilize outside services. That means that while Prezi's core systems have now been nicely screened, other systems are going to be wide open because nobody has bothered to test them properly. This works well with the list of email addresses from above and possibly data obtained from the private presentations above. EDIT: Just want to add that this shows a very large misconception in the corporate security world. Security is not something you can get a "B - good effort" for. Security is all encompassing. You either get an A+ and the hacker does not get in, or you get an F and your data is gone. There is no middle ground. Putting parts of your security off-limit means you shouldn't have even bothered to begin with.
  - dllthomas 13y ago
    'Just want to add that this shows a very large misconception in the corporate security world. Security is not something you can get a "B - good effort" for. Security is all encompassing. You either get an A+ and the hacker does not get in, or you get an F and your data is gone. There is no middle ground.' That's not true. There are substantially different levels of security required depending on the expected resources an attacker can devote to attacking you, and you can be better or worse at resiliency and recovery (where dollars and hours very much form a continuum).
    - RyanZAG 13y ago
      I disagree here - you've either lost the data or you haven't. You can make guesses as to the expected resources of the attacker, but if you're wrong and the attacker has more resources, then you might as well have not even bothered. As an example, you have some fairly non-sensitive private health records. Here are three approaches: (1) No security at all. You hope nobody is going to bother taking them and using them for anything malicious. (2) You put in decent security, but a contractor for a new feature left open a vulnerability you didn't know about. (3) You make sure everything is secure and have security audits over the code that closes the vulnerabilities that a contractor made. The data for (1) and (2) get hacked and used in a bigger hack on a different service that results in money being stolen. Now you could say that (1) gets an F, (2) gets a B because at least they tried, and (3) gets an A+ because the data wasn't stolen. This is rubbish - both (1) and (2) resulted in data being stolen and lost customers / lost money / insurance penalties / whatever. The security teams for both (1) and (2) failed utterly and get an F. If (2) had guessed correctly and nobody had actually devoted those resources then (2) gets a flying colors because the data is safe - but it's just pure gambling. Gambling with security will always be a losing bet in the long run. Rather just make it secure. Going off some strange 'expected resources' is just asking for the time when your data somehow becomes valuable and those resources get brought (or more likely, one of your employees annoys the wrong person with too much free time). Explaining to your customers that their email addresses weren't valuable enough to do proper security is a great way to lose me as a customer.
- columbo 13y ago
  I can see why they would want to set up rules instead of allowing anything to happen. For example, if I was to set up a bounty I really wouldn't want people at random contacting current or former clients trying to phish for passwords; I completely understand this is a threat, but I would want to personally manage something like that. With that said, if something like this was found I'd pay the person. There's a point where you just recognize "Oh shit, that's a big hole, pay the man.".
  - jarrett 13y ago
    Your point is good. I'd solve the problem like this: Instead of whitelisting certain kinds of attacks and parts of the company for bounty eligibility, I'd create a very limited blacklist. This blacklist would consist of actions which, despite being good-faith security research, would cause unacceptable damage to the company. For example, blacklisted actions might include: - Deleting the company's data. - Stealing from customers. - DDoSing the site. If you find a bug by taking any of the blacklisted actions, you get no bounty. This approach protects the company without unduly limiting the thoroughness of the review.
  - jbverschoor 13y ago
    Well, this social engineering is what got kevin mitnick in jail
- deleted 13y ago
  [deleted]
  - moocowduckquack 13y ago
    This is a no-brainer. Surely the risk of putting off skilled people from your bug bounty program due to the press from this could cost you a lot more than $500.
    - deleted 13y ago
      [deleted]
      - jessaustin 13y ago
        Someone at your company should probably be thinking about Prezi's reputation. That person should probably have a discussion with whomever is running the bounty program.
      - moocowduckquack 13y ago
        Bug bounties have a purpose and it is not to generate press or to be an equality outreach program. It is to find bugs. If the rules are getting in the way of what the organisation is actually trying to use those rules for, then to be a stickler for rules is nuts when the same organisation wrote the rules in the first place and can change them at will. edit - and if it is neccessary due to corporate legal waffle to always be a stickler for rules, then make a rule that details the protocol for exceptions.
  - timje1 13y ago
    Someone that hacks your systems won't be limited to a single system or domain, I don't see why your reward system should be. Would you rather that vulnerabilities discovered in out-of-scope systems be sold on forums instead?
  - tallanvor 13y ago
    It seems that he pointed out a security vulnerability in your infrastructure - something you do have control over. And if a vulnerability is found in an external service you use, do you feel that you don't have a responsibility to mitigate the risk posed by the service whether or not you have direct control over it?
- dpeck 13y ago
  > Why even have a limited scope on bounty programs? Theres a few reasons, most of them having to do with managing day to day operations and keeping the business operating, etc. It'd be great to have everything wide open and and getting hammered until anything resembling a vulnerability is found, but that is sadly not really practical in most businesses. Most bounty hunters aren't using precision. Without a doubt some are very meticulous, but a great many will throw every possible tool/option at their disposal at an application. This is great if it finds bugs, but it can also cause a lot of problems if their script generates a few hundred thousand help desk tickets that put your support/sales team way behind at a crucial times. Theres also a lot of politics thats come into play. A lot of times these bounty programs have a split fanbase within company management and anything that interrupts the business, causes "bad" PR, and such will be quickly pointed out as reasons why the program should be discontinued. Bug bounties != pen tests. Penetration testing takes a lot more for teams to work with and get something out of, and honestly a lot of organizations don't get anything out of a pentest. They either get a vuln assessment that a scanner jockey exported to pdf and showed up in a sports coat to present, or if they get an actual pen test by some of the people really doing it they get their ass handed to them so badly they have no idea what to do. Bounties are to help a company understand the problems they have and get them fixed. Pen testing is about seeing how well you respond when everything goes to hell around you. Smaller orgs being constantly beat down isn't going to let them get a lot done to do anything except put out fires. (beware, physical world analogy ahead) Learning to defend yourself involves working with an instructor, and constantly getting better, not paying someone to whip your ass daily until you can't stand. Some people can work through the latter and become very well adapted to mitigating the attacks, but most will just get beat down and quit. Maybe Prezi was trying to take a stand by not paying the guy for being out of scope, and thats fine they're certainly dealing with the consequences of that decision, but its completely understandable as to why they'd want some sort of scope to begin with.
- mpeg 13y ago
  I think it's ridiculous, I've reported similar "out of scope" bugs and got no bounty for them. Even worse are the companies that DON'T state any kind of bug bounty or instructions to report a security bug... I found a data leak issue in one of the web properties of an S&P 500 company last week and I'm not sure if I should report it, because I feel that if misunderstood it could have negative consequences for me; and not having a security contact means I can't be sure the person I'm talking to understands my motives.
  - kitsune_ 13y ago
    Sorry, I have some problems with this attitude of expecting a reward for each and every action that benefits other human beings. Whatever happened to altruism?
    - mpeg 13y ago
      I don't think you understand, it's not about a reward; it's about having a clearly defined process to report security bugs that is inclusive of every kind of bug. If you don't have that, people don't know if they are breaking the law by sending you a bug report, and they might not report the issues. Most of the time, the bounty is not going to pay for my time anyway; I just do it for the fun of it, but it definitely says "security issues are welcome"
    - jablan 13y ago
      Since when the word "altruism" applies to corporations? I believe that word is intended to relate to people, not businesses.
- azernik 13y ago
  Often this is to keep from having to pay out for bugs you can't fix (the most common things to be out of scope are third party services). In this case the problem was actually on Prezi, but I imagine the rule was written to exclude bugs in their version control system from the bounty program.
- tlrobinson 13y ago
  The only reason I see is if you provide immunity in exchange for following the rules you don't want to allow actions that can degrade your service like DDoSing, online brute forcing, vulnerability scanners, etc. That doesn't really apply in this case though.
nezza-_- 13y ago
Bad judgement call on the site of Prezi imho. He didn't abuse it and notified them immediately after verifying his finding as it seems.
- Vivtek 13y ago
  And they sat on the decision until he pestered them. Not good at all.
ddoolin 13y ago
"Out of scope". Wow. Even more worthwhile that such a huge out of scope bug was found. These companies seem to try anything to keep from paying bug bounties.
- gnur 13y ago
  To be fair, there was a scope set, and the author was fully aware of it: > I had spent a total of 2 hours sifting and crawling through their services which were in scope, but wanted to see if I could locate any other subdomains, with the assistance of google. While I agree that he most certainly found a "bug" (perhaps flaw would be a better word), it was out of scope. And using credentials from an employee to log in is nearly always out of scope.
  - 3JPLW 13y ago
    That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.
    - eli 13y ago
      Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.
      - shawabawa3 13y ago
        > Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil". i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black
        meowface 13y ago
        You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code. Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.
gnu8 13y ago
There should be a database of these bounty programs that can tell you if a company pays or not, sort of like a credit bureau.
- alexkus 13y ago
  https://bugcrowd.com/list-of-bug-bounty-programs https://bugcrowd.com/list-of-bug-bounty-programs
colinbartlett 13y ago
There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste. Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.
- wodow 13y ago
  Do it!
- terhechte 13y ago
  That could be done with Bitcoin contracts, too.
  - err4nt 13y ago
    Bitcoin is much easier (and faster) to acquire than to liquidate. I'd rather be paid in cash.
    - shiftpgdn 13y ago
      You can liquidate bitcoin in about 5 minutes using Coinbase.
      - Datsundere 13y ago
        took me a week to get my bitcoin.
        shiftpgdn 13y ago
        Are we talking cash to bitcoin or bitcoin to cash? I haven't done cash to Bitcoin but the bitcoin to bank deposit was done instantly.
- DavidChouinard 13y ago
hablahaha 13y ago
"We're pretty sure your actions were taken in good faith". Ouch, their email response contained barely an iota of gratitude and it was almost on the verge of passing judgement on his character.
dutchbrit 13y ago
Finder should receive the highest bounty possible IMO.
- frankblizzard 13y ago
  a unicorn tear
eli 13y ago
It was out of scope. The rules are pretty clear: http://prezi.com/bugbounty/ http://prezi.com/bugbounty/ and he broke at least two of them. And it seems like he knew it was out of scope when he submitted it too: "I had spent a total of 2 hours sifting and crawling through their services which were in scope, but wanted to see if I could locate any other subdomains..." Now I think Prezi should probably have paid him anyway because that's a pretty boneheaded error and I'd be very grateful if someone politely pointed it out to me... but they aren't obligated to. You can put your pitchforks down.
- nowayman 13y ago
  Sometimes people and companies have their heads stuck so far in procedures and policies that they can't see the forests from the trees. The Finder provided tremendous value by discovering this issues and reporting it responsibly. He certainly should be rewarded with something more substantial than swag. Would Prezi have preferred that the Finder just not report this issues?
  - eli 13y ago
    It's not like they got him on some legalistic technicality. The bug bounty clearly doesn't cover the bug he reported. And I don't usually go looking for them, but if I come across a security problem (e.g. someone left login credentials unsecured in bitbucket) I would let them know because it's the right thing to do, not because I expect cash.
    - TillE 13y ago
      It's not a technicality, but you're just saying "well, that's the policy" without considering whether the policy is the best way to accomplish certain goals. That's the point.
- duiker101 13y ago
  So because it was out of scope it means that it could not have harmed the company so he should have just left it there?
randallsquared 13y ago
Wow, I hope you didn't send them your physical address after this. We often hear of companies sending the police after people trying to be helpful.
jwr 13y ago
I don't understand why companies start those bug bounties and later try to avoid paying out the rewards. If it were me, I'd book the reward amount as "spent" the minute I decided on a bug bounty hunt. I think this is (yet another) lesson that participating in these kinds of bounty hunts is very risky and should only be done if the company is reputable (which this one apparently is not).
- DougBTX 13y ago
  How is this not reputable? They are pretty clear about when they will not sue people trying to hack their systems, a bounty is a bonus.
jcromartie 13y ago
Simply by logging in he could be thrown in jail. I hope some prosecutor doesn't get wind and decides to bring charges.
- err4nt 13y ago
  Why is that? Weren't the login credentials posted publicly?
  - Heliosmaster 13y ago
    If you leave your door open and someone enters without your knowledge, would you call the police?
    - girvo 13y ago
      Christ I hate that analogy, considering the government applies it like that for us, but not when it comes to them slurping our data.
    - davorak 13y ago
      It is closer to find someones home key in a public place and deciding to see if it opens their door or not before giving it back. You did not enter the house you did not explore. You turned the key, the knob, and made sure the door would open a little. Not something I would recommend, especially since the key had the address and the owner name and address attached to it. But not as bad as someone entering the home and looking around.
      - foldr 13y ago
        The analogies are beside the point. Logging in to a system which you don't have permission to access just is illegal in many countries, whether you think that it ought to be or not.
        davorak 13y ago
        > The analogies are beside the point. It helps decide weather or not the legal response if any is reasonable. > whether you think that it ought to be or not. I was not trying to comment on what I think ought to be.
daviddoran 13y ago
I think they acted pretty fairly by pointing out that it's the logging in that they have issue with. Although it's not as satisfying, I think Shubham could have submitted the link and credentials to Prezi without actually accessing the repo. In particular, the report email contains the snippet "... I explored the nexus console to confirm that ..." and I can understand Prezi not wanting to encourage pen testers to explore their systems, even if they find them open to the world.
- shawabawa3 13y ago
  > I think they acted pretty fairly They absolutely didn't. I don't get how there seems to be absolutely no human side to these cases. Guy discovers critical vulnerability and could have completely fucked the company over. Instead he responsibly reports it, and he gets back a big fuck you. How can you possibly think that's fair? The fact that it's out of scope only means they should give him an out of scope reward - much higher! Saying he could have not checked the credentials is a bit silly, because if the credentials were invalid (quite likely), it goes from CRITICAL to MINOR. And isn't the entire point in bug bounties to encourage pen testers to explore your system? Sure, you don't really want them poking around your source control, but better that than black hats. All of the above aside. They really couldn't spare $500 for someone who could have caused $millions of damage?
  - daviddoran 13y ago
    > Guy discovers critical vulnerability and could have completely fucked the company over. We all frequently have the opportunity to cause damage, but we don't get rewarded for _not_ doing so. I think Prezi may have given the cash reward if the pentester hadn't logged in and browsed around. They probably don't want to set a precedent (take the data you find, get cash reward). > ... because if the credentials were invalid (quite likely), it goes from CRITICAL to MINOR. Agreed, but either way the pentester won't be able to fix it. All he can do is report his findings. > ... but better that than black hats. Agreed, but if you stray outside the terms of the bounty then you're no longer guaranteed the rewards. I think the pentester tried his best to report responsibly but I don't think Prezi are obligated to give the reward, based on the terms.
6cxs2hd6 13y ago
> "Anyways, they did try and get it right, by emailing me an apology as well as responding to my constructive criticism. This blog post, is by no means attempting to discourage people from participating from Prezi’s bug bounty, but rather just a blog post about how finding Prezi’s source code was not eligible for their bug bounty." Passive aggressive much? I think he should have got a bounty -- if not the official one, then a special, bigger one. However, this is an odd way to conclude the post. "Oh, I'm not at all trying to discourage others for participating, oh no no". Of course he's trying to discourage others. With justification. I don't get it.
- RyanZAG 13y ago
  Probably doesn't want anybody pointing legal fingers at him for harming Prezi or something.
  - 6cxs2hd6 13y ago
    Oh I see. You mean like, "Here's my experience; I decided to stop participating. But I'm not advising you to. Offer not valid in all areas. Yada yada..."
- ganeumann 13y ago
  I think he's just being humble: he disagrees with their policy, but isn't claiming that everyone else should just because he does--make your own decision. Fair enough.
nikcub 13y ago
Exhibit A of why having a scope for bug bounties is a terrible idea. What is the point of testing your app for esoteric bugs when your entire source code and passwords can be Google dorked?
- nowayman 13y ago
  > Exhibit A of why having a scope for bug bounties is a terrible idea. Case closed.
- mtrimpe 13y ago
  Or for expanding the scope when you realize it's obviously too narrow.
girvo 13y ago
Ignoring the bounty thing for a second, their email response "we think it was in good faith" seems... Not right to me. Am i reading that weird or did they seem pissed about him finding something like that? He plugged a huge issue for them, and they screw him over due to "scope"... That's their choice, but it still seems bureaucratic to me.
- rtkwe 13y ago
  They're talking about viewing the source code and testing the login. The author could have just reported the leaked credentials and not logged on. Testing them especially since it wasn't part of the program falls under potentially extremely malicious.
jrochkind1 13y ago
What this guy describes doing (using accidentally exposed credentials to log in to somewhere) is quite a bit more than what other people have been successfully prosecuted for violations of the CFAA for. I'd be careful.
- Vivtek 13y ago
  You mean that Prezi, a Hungarian company, would prosecute the author, an Australian, under an American law? The Internet isn't just something happening in the United States.
  - kelvin0 13y ago
    Oh, someone should tell the NSA that.
  - foldr 13y ago
    It's a fair point, but a lot of other countries have similarly strict laws.
    - Vivtek 13y ago
      Hungary doesn't. I live here.
      - foldr 13y ago
        Really? According to this monograph even logging into a non-password-protected wifi network which doesn't belong to you has been treated as a case of theft in Hungary: http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=UqvV5tuTyB&dq=cybercrime%20laws%20in%20hungary&pg=PA260#v=onepage&q&f=false http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=Uq... Not exactly the same situation, but it suggests that the law is fairly strict.
shabble 13y ago
One wonders if he wouldn't have been better[1] off downloading their app source, and using that to find 'in-scope' vulns much easier than everyone else. They might catch on if you're too effective though. Maybe a spot of plausible parallel construction. [1] Except for the totally illegal aspect, obviously. And the not-telling-them-their-source-is-open-to-the-world bit.
thrillgore 13y ago
Dude needs to lawyer up right now. Doing the remote login has been seen as a violation of the CFAA.
- jpatokal 13y ago
  Prezi the company is in Hungary, not the US, and intra.prezi.com (70.38.38.86) seems to be in Montreal, Canada.
  - Vivtek 13y ago
    And the dude in question is in Australia. None of this happened in the United States at all - it's amazing! Non-Americans also have businesses!
    - balls187 13y ago
      Not very good ones, apparently.
eranation 13y ago
So let me get it straight, someone, aware of their bounty program or not, found their closed SOURCE CODE, and is getting a T-Shirt? How much do you value your own source code? at least 10,000$ right? ;) (probably much, much more) who cares about the scope, if someone found my wallet on the street which had 10,000$ in it, I would give them a bit more than a T-Shirt, I would buy them a whole wardrobe. Think if someone found the source code for Windows / Office / Photoshop, without any bounty program, and responsibly disclosed it to the respective companies. If he didn't walk away with nice amount of money, he could easily just put it in the nearest torrent site* without even feeling guilty (*this is wrong, and illegal, don't do it)
- girvo 13y ago
  If you found Adobes source code, they'd probably sic the cops onto you.
mimog 13y ago
Nexus isn't a source code repository. What you found was their internal artifact server, i.e compiled jar files.
- ollysb 13y ago
  If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.
  - mimog 13y ago
    But.. that can be said about any java (jar) programs class files. It is also not difficult to decipher the asm of a disassembled exe file, but to equate that with finding the source code of the program would be disingenuous.
    - tptacek 13y ago
      Decompilation of executable C files is much less accurate and usable than decompilation of Java class files, which usually produce verbatim Java source code. I don't know if source was or wasn't directly disclosed here, but if they leaked vanilla Java class files, that's basically equivalent to their source code.
    - phaed 13y ago
      You can drag drop that jar file into http://jd.benow.ca/ http://jd.benow.ca/ and in two clicks you have 100% of the source code, variable names and all. It's not the same as decompiling an C executable by any means.
      - mimog 13y ago
        Having tested http://jd.benow.ca/ http://jd.benow.ca/ I must admit it seems to do a near perfect job. Impressive and scary at the same time.
- brown9-2 13y ago
  Assuming they are building in Java, it's pretty common to publish source JARs to the repository along with the compiled classes.
if_by_whisky 13y ago
Why not offer him the bounty in exchange for signing an NDA? If they're actually worried about not setting a precedent..
tbastos 13y ago
It would have been easy for him to steal the source code and blackmail them for bitcoins... companies are encouraging others to turn to the dark side by not giving fair rewards. I'm pretty sure there are lots of smart people living in difficult economic conditions who will now think twice before reporting a serious vulnerability at the risk of an unfair reward. If Synack can solve this it would be a major win for everyone.
Yhippa 13y ago
Are bug bounties roughly the market value of security holes in software? I wonder if this guy or less scrupulous developers could make more for them on the black market?
- girvo 13y ago
  If the exploits are for the right targets, you bet they're worth more on the black market, but with great reward comes great risk: now you're doing something that can possibly get you jail time.
ansible 13y ago
So the question I haven't seen asked in this thread is: Why is anyone still using something other than SSH to connect to their version control system? Why is any software still using usernames and passwords stored in plain text anywhere? With SSH, you create SSH key pairs and set a passphrase on the private key... which shouldn't end up in any public place, ever.
- brown9-2 13y ago
  Well the credentials in the properties file shouldn't have ended up in a public place ever. So if you replace username/password with a key, a human can still accidentally publicize the key.
pccampbell 13y ago
Having stringent terms for a bug bounty program basically means you're trying to get the community to do your team's job. Agree with @nikcub - it should be wide open, because finding this out was huge, no matter how "simple" it may have been.
Systemic33 13y ago
What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.- The only thing this causes is exceptionally bad PR, or even worse for the company; someone just got access and you don't know. Access to source code is like the gold mine of finding an exploit, because you will know exactly where a vulnerability is, and you won't even have to blindly test it.
- raverbashing 13y ago
  Exactly In the end, everything matters An out-of-band attack in the datacenter, VPS? Compromise of a developer machine to get inside the network? Social engineering? in the end, if it caused loss or extraction of service/data, it doesn't matter how it's done.
- gabemart 13y ago
  > What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.- This suggests that anything less than perfect security is worthless. Which is better, having pentesters look for vulnerabilities in 50% of your surface area, or having pentesters look for vulnerabilities in 0% of your surface area? Setting up a bug bounty program has a cost, both in terms of processing the data submitted and in potential disruption of the provision of services. This cost will differ from attack vector to attack vector. Having pentesters dress up as utility workers and attempt to sneak into your company offices to install keyloggers will have an extremely high cost in terms of disruption. This cost may be higher than the potential benefit of learning about the company's vulnerabilities in this area. There are also some attack vectors that may be problematic to allow pentesters to probe due to third-party contracts, data protection laws, compliance issues, etc. You may disagree with the particular areas a company chooses to define as out-of-scope, but to claim that having any areas off-limits renders the whole enterprise pointless is reductive and incorrect.
  - deleted 13y ago
    [deleted]
swalkergibson 13y ago
I suspect that the biggest reason is that this amazingly gigantic, critical vulnerability was so ridiculously easy to find that they cannot stand the idea of paying someone a large amount of money to "fix" it, when the fix is to simply deny access to that service from outside a LAN or whatever. Prezi thought that they found all of the easy ones. Not quite.
scotty79 13y ago
I hope he downloaded their whole sourcode. That should make locating in-scope bugs much easier.
- cordite 13y ago
  I don't know about you, but I'm not about to proof read someone else's source code for a system I don't even know.
  - Ensorceled 13y ago
    I'm willing to do it for $500 a bug :-)
    - simplemath 13y ago
      Easy money for an unscrupulous sort
j_s 13y ago
Break the rules, don't get the money. Surprise!!?? After reading the entire email thread, I think Prezi comes out better off than the OP: Actually we're continuously thinking on your case and struggling on the right move. On one hand, your finding was very useful for us, and we learnt a lesson from it. On the other hand, intra.prezi.com is out of scope, and by using the credentials to log in you violated the terms and conditions of our bounty program. ... In the past we turned down the bounty request of people finding issues in out-of-scope services. We had a lot internal discussions about your request: if we were about to pay, we couldn't justify our out-of-scope decisions for anyone else.
- jessaustin 13y ago
  ...if we were about to pay, we couldn't justify our out-of-scope decisions for anyone else. What, are we in kindergarten? Does Prezi not have managers entrusted with taking decisions? They can run their bounty program however they want. That they choose to run it in this fashion sends several messages in addition to the obvious, "we are obnoxious miserly prats". While hackers in white hats might be hearing "concentrate your efforts elsewhere", those in black hear exactly the opposite message. Many people who might previously have admired Prezi for their innovation and paid them money for their services, have now heard a reason to find other means to create presentations. Potential acquirers and potential hires have heard that this company's management finds running a bounty program challenging. EDIT: Maybe I'm being too harsh. Apparently this is a largely Hungarian company; it's possible there are cultural misunderstandings in play. From a (perhaps cliched?) American perspective, however, following the rules is less important than accomplishing the goals of the program.
deleted 13y ago
[deleted]
- deleted 13y ago
  [deleted]
Raphmedia 13y ago
So, the message they are sending is "if you find an 'out of scope' bug, sell it on the blackmarket because even if it could wreck havoc, we won't pay you for it." Nice, nice.
edem 13y ago
My problem here is that the OP did not mask the names. Actually he did quite the opposite: he bolded them. This is no good. I can imagine the dev searching for his name in google and finding that post.
- infosec_au 13y ago
  Hi, I'm the author of the blog post. I've masked last names from the post and PDF, hopefully meaning that they wont be indexed with that post. Thanks for bringing that to my attention.
  - edem 13y ago
    Thanks, it is much better now.
    - deleted 13y ago
      [deleted]
darkbot 13y ago
This is definitely out of the scope of their "bughunt", although I think the guy should be rewarded anyway. But I'm also quite upset with the fact that OP is outing the dev. Everybody makes mistakes, no need to out any individual developer because OP is pissed at the company management.
- infosec_au 13y ago
  I realised 2-3 hours after my blog post, and rushed to redact the last names from the post + pdf. I have now also redacted last names from the screenshots. Sorry about that! But thank you for letting me know. :)
  - vertis 13y ago
    FYI, You can still see the url of the user on bitbucket and from there still get a name.
kyberias 13y ago
Why on earth would you ridicule the developer that made the mistake publicly? That is just utterly idiotic and irresponsible.
- deleted 13y ago
  [deleted]
tantalor 13y ago
The rules seem to allow a reward for this kind of vulnerability, What’s up with other vulnerabilities? ... we will consider if they are eligible for a bounty or not What is the bounty? ... we will increase it at our discretion for distinctly creative or severe bugs Prezi explicitly designed the rules to be flexible, so they could give the award in this case, but decided not to because "intra.prezi.com is out of scope". The rules about scope appear to exclude vulnerabilities in 3rd-party services such as AWS, not backends, e.g., the backends for our iPad and desktop applications are in scope http://prezi.com/bugbounty/ http://prezi.com/bugbounty/
mankypro 13y ago
Silly PR move on their part. They should've given this guy some shush money to prevent this (now) PR nightmare. Shoddy security practices, shoddy marketing and PR. Tsk, tsk.
psychboo 13y ago
I'm noticing yet another instance of HN modifying post titles. I originally titled this post "Finding Prezi's Source Code" specifically because I did not write the article. Now the post title reads (at first glance) as if I'm taking credit for the author's hard work.
- meowface 13y ago
  So, you found Prezi's source code huh? How does it feel? (I kid.)
- welder 13y ago
  Both titles are misleading. The title should be: "I found Prezi's client-side source code"
lifeformed 13y ago
The redacted names are kind of pointless, because they're not redacted in the images of the emails.
- infosec_au 13y ago
  I redacted their names from the post and PDF only, to prevent Google from indexing and associating the blog post with them. By doing this, future employers hopefully will not see the blog post when searching their names.
  - lifeformed 13y ago
    Oh I see, that makes sense.
sophacles 13y ago
My $.02 on this is that Prezi should have not awarded the researcher the cash under the bug bounty program, however they should have given him a reward anyway. Awarding the money as part of the bug bounty wouldn't be fair play under the rules of that program, but he potentially saved them a TON of money and problems. As such, he should be rewarded somehow. Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I think Prezi should have done something like this: * Acknowledge the problem and the seriousness of it * offer a reward, but not under the bounty, just a "thanks" * Have him sign an NDA about the source itself, and the specific details of the issue, and the amount of the award * Allowed him to write up the experience should he choose (good PR for prezi) * (maybe) offered a contract for the researcher to find more such issues, or announced a different program as a result of it. The reasoning behind doing it outside the program is that Prezi needs to walk a fine line between saying "just attack everything and we'll pay you!", "we are too process driven for our own good", or they end up getting bad press from people who tried to follow the rules not getting anything, but cheaters are getting paid.
- AGuyNamedChris 13y ago
  >Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one. The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.
  - Ensorceled 13y ago
    I think he meant scan the source code for security issues and then report those bugs one by one ...
    - sophacles 13y ago
      That is what I meant, I should have been more clear.
oskarth 13y ago
Presumably the goal of the bounty was to make Prezi more secure. OP found a serious security hole, without using a "violent" approach (spear phishing, cutting the power, etc). OP reported this security hole. In a legal sense, they aren't obligated to pay. There are a lot of legal loop holes. By not paying for something that they obviously want to know, they are discouraging other security researchers to disclose "out of scope" holes. To what end? If you succeed, we will give you cash. That’s right; we’ll pay cold hard currency into your bank account. Think of it as a thank you. (Prezi bug bounty site) I guess the right way to read this is as a (legal, of course) fuck you.
jayferd 13y ago
"...and all I got was this stupid T-shirt"
JoeAltmaier 13y ago
A bounty program is to get 'white hat' hackers to find and report vulnerabilities. The bounty is small, nowhere near what an extortionist could charge to keep the source secret for instance. By paying nothing for what could have been sold back to them for a huge sum, they may disaffect hackers, who could do them real harm. You become a sucker to volunteer for their 'bounty', and decide to turn to the dark side instead. I think Prezi are very silly to be splitting hairs about this. They stuck the stick in the hornets' nest, now they are arguing with the hornets.
3223f 13y ago
This sends a worrying message to others - in future don't bother reporting vulnerabilities to Prezi, just obtain the source and sell exploits to the highest bidder. It's no wonder security researchers turn to black hat methods, when they're treated/compensated like shit for their effort. "Swag" in return for your source code? What a joke
- eyepulp 13y ago
  "It's no wonder security researchers turn to black hat methods" -- this seems such a binary and pointless reduction of the options available. Yes, Prezi could have turned this into a PR and security win, and failed to capitalize; but the assumption that now the only option for a security researcher is to turn to the dark side is... pretty ridiculous. Those who "turn to blackhat methods" do so because they want to make money and don't place a premium on the potential moral/legal/ethical issues at play in how they're doing it. They make a choice, irrespective of the shortsightedness on display by Prezi here. Don't conflate the two behaviors.
rohitv 13y ago
Here's the cached version of the commit: http://webcache.googleusercontent.com/search?q=cache:https://bitbucket.org/flash42/config/commits/1934298e907b95234dca40050a2d0f6f http://webcache.googleusercontent.com/search?q=cache:https:/... The Nexus Repositories URL (http://intra.prezi.com:8081/nexus/content/repositories http://intra.prezi.com:8081/nexus/content/repositories) is still not restricted
eyeareque 13y ago
Bug bounty program or not, I would be pretty afraid to try to log into a source code repository without authorization to do so. It seems like a lawyer could really go after you for doing something like this.
jbverschoor 13y ago
I say release the code in the wild! Where it already was
IanDrake 13y ago
Anyone else notice that "Adam <Redacted>"'s full name and contact info are not redacted in the screen print of the email?
- infosec_au 13y ago
  I removed the last names from the blog posts and from the PDF, as they could be indexed by Google. I have now also removed them from the screenshots. Thanks. My intention was not to negatively affect these developers careers.
  - _puk 13y ago
    Commendable, though you probably need to redact the bitbucket link in the screenshot too as that has Adam <redacted>'s full name as owner of the repo. Where does it end?!
icambron 13y ago
This would be unethical and I would never do it, but the interesting scenario would have been if he'd secretly pulled the source code and used his access to it to find a bunch more bugs. He would look like a genius and pocket a bunch more money.
supercanuck 13y ago
Seems like acting nefarious is more profitable than doing the right thing.
deleted 13y ago
[deleted]
SeanDav 13y ago
The guy found and brought to their attention a simple exploit that could have seen valuable source code released into the wild and the guys at Prezi are debating about paying him a bounty? Does this mean that Prezi do not value their code and don't believe there would have been any significant loss if that code became public? Are they saying that the next person that discovers serious flaws in their security should just keep quiet - or sell it on to some hacker, where at least they can make some money from it? Just what message are the Prezi people trying to send by nit-picking over $500?
joering2 13y ago
What an asshole approach [1]. Please, next time someone find a critical bug in the system, don't bother emailing them; just post it on Twitter. [1] http://i.imgur.com/v3W9FD6.png http://i.imgur.com/v3W9FD6.png
- SideburnsOfDoom 13y ago
  The picture says "intra.prezzi.com is out of scope". Because yeah, real attackers would definitely not go looking for a back door instead.
phaed 13y ago
We should start an independent bounty in btc for whoever can find and release their sourcecode into the public. I can donate 1 btc to the cause.
pepe_kriek 13y ago
Seems like Prezi has changed its mind about not paying. Prezi being a Hungarian startup made a buzz in the local media with this story and one of the leader news site reached out to them and got this reply: "Prezi: Hibáztunk és fizetni fogunk" witch means: "We made a mistake, we will pay" They also said that they will release a blog post and they will change the bounty program, so mistakes like this will not happen again (hopefully)
chatman 13y ago
Prezi deserves to be boycotted for cheating Shubham out of his bounty based on stupid "out of scope" excuse. If cracking an internal service is possible, a bug exploiting it should be within scope of any bounty program.
d0m 13y ago
One trick to avoid stupidities like this is to tell them what you found, but not how. How much is worth the vulnerability of having access to all your source code. Just ping me if you're interested.
veszig 13y ago
Here's the response from Prezi http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/ http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bu...
prawn 13y ago
Don't worry about the bounty, here, have swag that freely advertises our company. Weak. Why should anyone put up with that? Pay him something outside the bug bounty program. Easy and cheap solution that could've avoided all this mess.
halacsy 13y ago
I'm hp co-founder and CTO of prezi. We learn from our mistakes, we have changed the program: To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users’ information and that their report triggers us to improve our code base. We will also retroactively check to see if other reports found issues that fall into this category. More info at engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/
- agrias 13y ago
  This should be up-voted some more so people can see the resolution. I'm glad you guys decided to reward the bug hunter for his time as well as provide a response.
buremba 13y ago
The main point is the thing that OP found is really important for Prezi. I don't really understand why they have to figure out whether the vulnerability is in "the scope", or not.
infosec_au 13y ago
Hi, I just thought I would update everyone on my experience and the last 12 hours. At the time in which I found the bug and was not awarded for it, I was quite upset, evident from my tone in the email in which I decided that I did not want to receive any of their "swag", but rather give them some constructive criticism. I wasn't expecting the blog post to get as noticed as it did, but as it has, I was able to observe great points on both sides of the argument of whether or not I should be received the bug bounty. These discussions were definitely required as they brought out some important issues with bug bounties today and how security issues should really be dealt with. Prezi, has now both apologised to me and also have offered to pay me for my findings. I have updated my blog post to show this, as well as the emails exchanged between us. I'm glad that it ended this way - all within the last 12 hours. Initially, I did not redact the developers names, and after the blog post became I had to rush to make sure that I had removed them from all places which were indexed by Google. My intention was not to negatively affect the careers of the Prezi developers affected from my findings. I thank everyone here, and generally on the internet, for looking closer into my findings. Thank you, Shubham
deleted 13y ago
[deleted]
thekevan 13y ago
Didn't he not find a bug, but found company resources that had not been secured properly?
jasonlmk 13y ago
In case anyone missed it: Prezi finally decided to pay him the bounty. Still a bad move to have denied him the bounty in the first place, but good to see that they're listening to the outrage.
Fuxy 13y ago
This policy of limiting security assessments/bug bounties to only certain things is really stupid. Do you really think that any extremely motivated hacker would just stick to the arbitrary terms you set. He will do whatever it takes to get in and by limiting security research you're making yourself vulnerable in other areas not defined in that assessment request.
toryt 13y ago
good article

712 points by psychboo 13y ago

Why even have a limited scope on bounty programs? (This is not the only time I've seen that.) Is it only to limit payout? Are their legal reasons? For example, their client tablet applications are ineligible. I just don't get the reasoning. In their position, I'd pay him the $500 and remove the idea of scope. I'm just curious if there's some counter-argument I'm not thinking about.

eli 13y ago
Well of course there have to be rules. Does spear phishing employees email accounts and using their password to access control panels count as a bug? I bet I could hack a lot of companies that way. Does being susceptible to a massive DDoS count as a bug? Cutting power to the building? I can't speak for Prezi, but it seems like they want people to test the security of their app, but not of their employees or back office infrastructure. Maybe you disagree, but it's their bounty and I think those are fair rules.
- davorak 13y ago
  A simple rule of thumb seems to be is, does it cause a problem if all the bug bounty hunters take the same approach. Phishing employees, DDoSing definitely cause problems if a large number, or one, of bug bounty hunters take on the approach. It seems even if all the bug bounty hunters searched for and found http://intra.prezi.com:8081 http://intra.prezi.com:8081, preformed google searches and tested found logins by hand, no problem would result for prezi. So it seems like Phishing employees and DDoSing are inherently different then the approach in the post.
- tantalor 13y ago
  > Does spear phishing employees email accounts and using their password to access control panels count as a bug? Yes, because those control panels should require 2FA, so password-only access is a bug.
  - ars_technician 13y ago
    2FA is susceptible to spear phishing if all the attacker needs is a one time login. Remember that credentials and tokens can be relayed.
    - tantalor 13y ago
      Not necessarily. FIDO fixes this. http://www.fidoalliance.org/user-experience.html http://www.fidoalliance.org/user-experience.html
      - ars_technician 13y ago
        How? A phishing site can relay any of this information by acting as a client to the real site while prompting the end user for the requested credentials. The only way FIDO could prevent this would be to make the credentials dependent on the URL in the browser, but I don't see where it does this.
        tantalor 13y ago
        With FIDO, the user doesn't manually enter a 2FA token into a form field. Instead they press a button or something which directly transmits the token over SSL to the authentication server. MITM is still possible, but there are other ways to combat that, such as TLS Channel IDs [1] or Bearer Tokens [2]. [1] http://www.google.com/intl/en/chrome/browser/privacy/whitepaper.html#tls http://www.google.com/intl/en/chrome/browser/privacy/whitepa... [2] http://www.browserauth.net/ http://www.browserauth.net/
- fleitz 13y ago
  Yes, it does. Customers do not care how the intruder got in only that they got in. Spearfishing is an attack that makes the company look dumb. Leaving the credentials for your source code on the web makes you look even dumber. To qualify for the bug bounty he should have inserted code into their codebase and then exploited that. Fuck these guys.
  - dllthomas 13y ago
    Flooding communications channels (in particular, mental bandwidth of front-line employees) with attempts to spearfish is an attack that interferes with operations even when unsuccessful. It does not make sense to ask the world at large to persistently try such attacks. This case is not like that, though.
- nostrademons 13y ago
  Large tech companies routinely run pentest exercises against themselves that involve phishing their own employees. Good security has to include educating the human element as well: if you have great technical security but all you have to do to get in is ask an employee their password, you've lost. Large companies also invest significantly in protection against massive DDoS and power cuts to the building, along with drills for earthquakes and zombie apocalypses.
  - eli 13y ago
    I wasn't trying to say those things aren't really security problems... just that they perhaps aren't things you'd want random people on the internet attempting to exploit.
  - danielweber 13y ago
    They also control the rate at how their own employees get phished, especially if they want the employees to report any suspicious attempts. Constant barrages from outsiders will make the employees stop reporting.
RyanZAG 13y ago
Having these kinds of rules on bug bounty programs is excellent for hackers though. If I wanted to hack Prezi I now have a lot of very useful information. 1) Prezi is not interested in blocking access to people who already have the ID of the presentation. This is good news since it means I can enumerate the IDs and get access to private presentations - some of which could have useful private data. 2) Prezi is not interested in blocking attacks which enumerate user ids, etc. This is great news - I can get a list of likely email addresses to use later. 3) Prezi disallows any forms of attacks that utilize outside services. That means that while Prezi's core systems have now been nicely screened, other systems are going to be wide open because nobody has bothered to test them properly. This works well with the list of email addresses from above and possibly data obtained from the private presentations above. EDIT: Just want to add that this shows a very large misconception in the corporate security world. Security is not something you can get a "B - good effort" for. Security is all encompassing. You either get an A+ and the hacker does not get in, or you get an F and your data is gone. There is no middle ground. Putting parts of your security off-limit means you shouldn't have even bothered to begin with.
- dllthomas 13y ago
  'Just want to add that this shows a very large misconception in the corporate security world. Security is not something you can get a "B - good effort" for. Security is all encompassing. You either get an A+ and the hacker does not get in, or you get an F and your data is gone. There is no middle ground.' That's not true. There are substantially different levels of security required depending on the expected resources an attacker can devote to attacking you, and you can be better or worse at resiliency and recovery (where dollars and hours very much form a continuum).
  - RyanZAG 13y ago
    I disagree here - you've either lost the data or you haven't. You can make guesses as to the expected resources of the attacker, but if you're wrong and the attacker has more resources, then you might as well have not even bothered. As an example, you have some fairly non-sensitive private health records. Here are three approaches: (1) No security at all. You hope nobody is going to bother taking them and using them for anything malicious. (2) You put in decent security, but a contractor for a new feature left open a vulnerability you didn't know about. (3) You make sure everything is secure and have security audits over the code that closes the vulnerabilities that a contractor made. The data for (1) and (2) get hacked and used in a bigger hack on a different service that results in money being stolen. Now you could say that (1) gets an F, (2) gets a B because at least they tried, and (3) gets an A+ because the data wasn't stolen. This is rubbish - both (1) and (2) resulted in data being stolen and lost customers / lost money / insurance penalties / whatever. The security teams for both (1) and (2) failed utterly and get an F. If (2) had guessed correctly and nobody had actually devoted those resources then (2) gets a flying colors because the data is safe - but it's just pure gambling. Gambling with security will always be a losing bet in the long run. Rather just make it secure. Going off some strange 'expected resources' is just asking for the time when your data somehow becomes valuable and those resources get brought (or more likely, one of your employees annoys the wrong person with too much free time). Explaining to your customers that their email addresses weren't valuable enough to do proper security is a great way to lose me as a customer.
columbo 13y ago
I can see why they would want to set up rules instead of allowing anything to happen. For example, if I was to set up a bounty I really wouldn't want people at random contacting current or former clients trying to phish for passwords; I completely understand this is a threat, but I would want to personally manage something like that. With that said, if something like this was found I'd pay the person. There's a point where you just recognize "Oh shit, that's a big hole, pay the man.".
- jarrett 13y ago
  Your point is good. I'd solve the problem like this: Instead of whitelisting certain kinds of attacks and parts of the company for bounty eligibility, I'd create a very limited blacklist. This blacklist would consist of actions which, despite being good-faith security research, would cause unacceptable damage to the company. For example, blacklisted actions might include: - Deleting the company's data. - Stealing from customers. - DDoSing the site. If you find a bug by taking any of the blacklisted actions, you get no bounty. This approach protects the company without unduly limiting the thoroughness of the review.
- jbverschoor 13y ago
  Well, this social engineering is what got kevin mitnick in jail
deleted 13y ago
[deleted]
- moocowduckquack 13y ago
  This is a no-brainer. Surely the risk of putting off skilled people from your bug bounty program due to the press from this could cost you a lot more than $500.
  - deleted 13y ago
    [deleted]
    - jessaustin 13y ago
      Someone at your company should probably be thinking about Prezi's reputation. That person should probably have a discussion with whomever is running the bounty program.
    - moocowduckquack 13y ago
      Bug bounties have a purpose and it is not to generate press or to be an equality outreach program. It is to find bugs. If the rules are getting in the way of what the organisation is actually trying to use those rules for, then to be a stickler for rules is nuts when the same organisation wrote the rules in the first place and can change them at will. edit - and if it is neccessary due to corporate legal waffle to always be a stickler for rules, then make a rule that details the protocol for exceptions.
- timje1 13y ago
  Someone that hacks your systems won't be limited to a single system or domain, I don't see why your reward system should be. Would you rather that vulnerabilities discovered in out-of-scope systems be sold on forums instead?
- tallanvor 13y ago
  It seems that he pointed out a security vulnerability in your infrastructure - something you do have control over. And if a vulnerability is found in an external service you use, do you feel that you don't have a responsibility to mitigate the risk posed by the service whether or not you have direct control over it?
dpeck 13y ago
> Why even have a limited scope on bounty programs? Theres a few reasons, most of them having to do with managing day to day operations and keeping the business operating, etc. It'd be great to have everything wide open and and getting hammered until anything resembling a vulnerability is found, but that is sadly not really practical in most businesses. Most bounty hunters aren't using precision. Without a doubt some are very meticulous, but a great many will throw every possible tool/option at their disposal at an application. This is great if it finds bugs, but it can also cause a lot of problems if their script generates a few hundred thousand help desk tickets that put your support/sales team way behind at a crucial times. Theres also a lot of politics thats come into play. A lot of times these bounty programs have a split fanbase within company management and anything that interrupts the business, causes "bad" PR, and such will be quickly pointed out as reasons why the program should be discontinued. Bug bounties != pen tests. Penetration testing takes a lot more for teams to work with and get something out of, and honestly a lot of organizations don't get anything out of a pentest. They either get a vuln assessment that a scanner jockey exported to pdf and showed up in a sports coat to present, or if they get an actual pen test by some of the people really doing it they get their ass handed to them so badly they have no idea what to do. Bounties are to help a company understand the problems they have and get them fixed. Pen testing is about seeing how well you respond when everything goes to hell around you. Smaller orgs being constantly beat down isn't going to let them get a lot done to do anything except put out fires. (beware, physical world analogy ahead) Learning to defend yourself involves working with an instructor, and constantly getting better, not paying someone to whip your ass daily until you can't stand. Some people can work through the latter and become very well adapted to mitigating the attacks, but most will just get beat down and quit. Maybe Prezi was trying to take a stand by not paying the guy for being out of scope, and thats fine they're certainly dealing with the consequences of that decision, but its completely understandable as to why they'd want some sort of scope to begin with.
mpeg 13y ago
I think it's ridiculous, I've reported similar "out of scope" bugs and got no bounty for them. Even worse are the companies that DON'T state any kind of bug bounty or instructions to report a security bug... I found a data leak issue in one of the web properties of an S&P 500 company last week and I'm not sure if I should report it, because I feel that if misunderstood it could have negative consequences for me; and not having a security contact means I can't be sure the person I'm talking to understands my motives.
- kitsune_ 13y ago
  Sorry, I have some problems with this attitude of expecting a reward for each and every action that benefits other human beings. Whatever happened to altruism?
  - mpeg 13y ago
    I don't think you understand, it's not about a reward; it's about having a clearly defined process to report security bugs that is inclusive of every kind of bug. If you don't have that, people don't know if they are breaking the law by sending you a bug report, and they might not report the issues. Most of the time, the bounty is not going to pay for my time anyway; I just do it for the fun of it, but it definitely says "security issues are welcome"
  - jablan 13y ago
    Since when the word "altruism" applies to corporations? I believe that word is intended to relate to people, not businesses.
azernik 13y ago
Often this is to keep from having to pay out for bugs you can't fix (the most common things to be out of scope are third party services). In this case the problem was actually on Prezi, but I imagine the rule was written to exclude bugs in their version control system from the bounty program.
tlrobinson 13y ago
The only reason I see is if you provide immunity in exchange for following the rules you don't want to allow actions that can degrade your service like DDoSing, online brute forcing, vulnerability scanners, etc. That doesn't really apply in this case though.

nezza-_- 13y ago

Bad judgement call on the site of Prezi imho. He didn't abuse it and notified them immediately after verifying his finding as it seems.

Vivtek 13y ago
And they sat on the decision until he pestered them. Not good at all.

ddoolin 13y ago

"Out of scope". Wow. Even more worthwhile that such a huge out of scope bug was found. These companies seem to try anything to keep from paying bug bounties.

gnur 13y ago
To be fair, there was a scope set, and the author was fully aware of it: > I had spent a total of 2 hours sifting and crawling through their services which were in scope, but wanted to see if I could locate any other subdomains, with the assistance of google. While I agree that he most certainly found a "bug" (perhaps flaw would be a better word), it was out of scope. And using credentials from an employee to log in is nearly always out of scope.
- 3JPLW 13y ago
  That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.
  - eli 13y ago
    Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.
    - shawabawa3 13y ago
      > Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil". i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black
      - meowface 13y ago
        You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code. Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.

gnu8 13y ago

There should be a database of these bounty programs that can tell you if a company pays or not, sort of like a credit bureau.

alexkus 13y ago
https://bugcrowd.com/list-of-bug-bounty-programs https://bugcrowd.com/list-of-bug-bounty-programs

colinbartlett 13y ago

There should be some neutral third party non-profit that adjudicates bug bounties so that security researchers don't need to worry that their efforts will go to waste. Companies could sign on to using this third party and pay a fee and put up escrow for the service. This would motivate researchers to find bugs for those companies that utilize the service, knowing payment will be impartial.

wodow 13y ago
Do it!
terhechte 13y ago
That could be done with Bitcoin contracts, too.
- err4nt 13y ago
  Bitcoin is much easier (and faster) to acquire than to liquidate. I'd rather be paid in cash.
  - shiftpgdn 13y ago
    You can liquidate bitcoin in about 5 minutes using Coinbase.
    - Datsundere 13y ago
      took me a week to get my bitcoin.
      - shiftpgdn 13y ago
        Are we talking cash to bitcoin or bitcoin to cash? I haven't done cash to Bitcoin but the bitcoin to bank deposit was done instantly.
DavidChouinard 13y ago

hablahaha 13y ago

"We're pretty sure your actions were taken in good faith". Ouch, their email response contained barely an iota of gratitude and it was almost on the verge of passing judgement on his character.

dutchbrit 13y ago

Finder should receive the highest bounty possible IMO.

frankblizzard 13y ago
a unicorn tear

eli 13y ago

It was out of scope. The rules are pretty clear: http://prezi.com/bugbounty/ http://prezi.com/bugbounty/ and he broke at least two of them. And it seems like he knew it was out of scope when he submitted it too: "I had spent a total of 2 hours sifting and crawling through their services which were in scope, but wanted to see if I could locate any other subdomains..." Now I think Prezi should probably have paid him anyway because that's a pretty boneheaded error and I'd be very grateful if someone politely pointed it out to me... but they aren't obligated to. You can put your pitchforks down.

nowayman 13y ago
Sometimes people and companies have their heads stuck so far in procedures and policies that they can't see the forests from the trees. The Finder provided tremendous value by discovering this issues and reporting it responsibly. He certainly should be rewarded with something more substantial than swag. Would Prezi have preferred that the Finder just not report this issues?
- eli 13y ago
  It's not like they got him on some legalistic technicality. The bug bounty clearly doesn't cover the bug he reported. And I don't usually go looking for them, but if I come across a security problem (e.g. someone left login credentials unsecured in bitbucket) I would let them know because it's the right thing to do, not because I expect cash.
  - TillE 13y ago
    It's not a technicality, but you're just saying "well, that's the policy" without considering whether the policy is the best way to accomplish certain goals. That's the point.
duiker101 13y ago
So because it was out of scope it means that it could not have harmed the company so he should have just left it there?

randallsquared 13y ago

Wow, I hope you didn't send them your physical address after this. We often hear of companies sending the police after people trying to be helpful.

jwr 13y ago

I don't understand why companies start those bug bounties and later try to avoid paying out the rewards. If it were me, I'd book the reward amount as "spent" the minute I decided on a bug bounty hunt. I think this is (yet another) lesson that participating in these kinds of bounty hunts is very risky and should only be done if the company is reputable (which this one apparently is not).

DougBTX 13y ago
How is this not reputable? They are pretty clear about when they will not sue people trying to hack their systems, a bounty is a bonus.

jcromartie 13y ago

Simply by logging in he could be thrown in jail. I hope some prosecutor doesn't get wind and decides to bring charges.

err4nt 13y ago
Why is that? Weren't the login credentials posted publicly?
- Heliosmaster 13y ago
  If you leave your door open and someone enters without your knowledge, would you call the police?
  - girvo 13y ago
    Christ I hate that analogy, considering the government applies it like that for us, but not when it comes to them slurping our data.
  - davorak 13y ago
    It is closer to find someones home key in a public place and deciding to see if it opens their door or not before giving it back. You did not enter the house you did not explore. You turned the key, the knob, and made sure the door would open a little. Not something I would recommend, especially since the key had the address and the owner name and address attached to it. But not as bad as someone entering the home and looking around.
    - foldr 13y ago
      The analogies are beside the point. Logging in to a system which you don't have permission to access just is illegal in many countries, whether you think that it ought to be or not.
      - davorak 13y ago
        > The analogies are beside the point. It helps decide weather or not the legal response if any is reasonable. > whether you think that it ought to be or not. I was not trying to comment on what I think ought to be.

daviddoran 13y ago

I think they acted pretty fairly by pointing out that it's the logging in that they have issue with. Although it's not as satisfying, I think Shubham could have submitted the link and credentials to Prezi without actually accessing the repo. In particular, the report email contains the snippet "... I explored the nexus console to confirm that ..." and I can understand Prezi not wanting to encourage pen testers to explore their systems, even if they find them open to the world.

shawabawa3 13y ago
> I think they acted pretty fairly They absolutely didn't. I don't get how there seems to be absolutely no human side to these cases. Guy discovers critical vulnerability and could have completely fucked the company over. Instead he responsibly reports it, and he gets back a big fuck you. How can you possibly think that's fair? The fact that it's out of scope only means they should give him an out of scope reward - much higher! Saying he could have not checked the credentials is a bit silly, because if the credentials were invalid (quite likely), it goes from CRITICAL to MINOR. And isn't the entire point in bug bounties to encourage pen testers to explore your system? Sure, you don't really want them poking around your source control, but better that than black hats. All of the above aside. They really couldn't spare $500 for someone who could have caused $millions of damage?
- daviddoran 13y ago
  > Guy discovers critical vulnerability and could have completely fucked the company over. We all frequently have the opportunity to cause damage, but we don't get rewarded for _not_ doing so. I think Prezi may have given the cash reward if the pentester hadn't logged in and browsed around. They probably don't want to set a precedent (take the data you find, get cash reward). > ... because if the credentials were invalid (quite likely), it goes from CRITICAL to MINOR. Agreed, but either way the pentester won't be able to fix it. All he can do is report his findings. > ... but better that than black hats. Agreed, but if you stray outside the terms of the bounty then you're no longer guaranteed the rewards. I think the pentester tried his best to report responsibly but I don't think Prezi are obligated to give the reward, based on the terms.

6cxs2hd6 13y ago

> "Anyways, they did try and get it right, by emailing me an apology as well as responding to my constructive criticism. This blog post, is by no means attempting to discourage people from participating from Prezi’s bug bounty, but rather just a blog post about how finding Prezi’s source code was not eligible for their bug bounty." Passive aggressive much? I think he should have got a bounty -- if not the official one, then a special, bigger one. However, this is an odd way to conclude the post. "Oh, I'm not at all trying to discourage others for participating, oh no no". Of course he's trying to discourage others. With justification. I don't get it.

RyanZAG 13y ago
Probably doesn't want anybody pointing legal fingers at him for harming Prezi or something.
- 6cxs2hd6 13y ago
  Oh I see. You mean like, "Here's my experience; I decided to stop participating. But I'm not advising you to. Offer not valid in all areas. Yada yada..."
ganeumann 13y ago
I think he's just being humble: he disagrees with their policy, but isn't claiming that everyone else should just because he does--make your own decision. Fair enough.

nikcub 13y ago

Exhibit A of why having a scope for bug bounties is a terrible idea. What is the point of testing your app for esoteric bugs when your entire source code and passwords can be Google dorked?

nowayman 13y ago
> Exhibit A of why having a scope for bug bounties is a terrible idea. Case closed.
mtrimpe 13y ago
Or for expanding the scope when you realize it's obviously too narrow.

girvo 13y ago

Ignoring the bounty thing for a second, their email response "we think it was in good faith" seems... Not right to me. Am i reading that weird or did they seem pissed about him finding something like that? He plugged a huge issue for them, and they screw him over due to "scope"... That's their choice, but it still seems bureaucratic to me.

rtkwe 13y ago
They're talking about viewing the source code and testing the login. The author could have just reported the leaked credentials and not logged on. Testing them especially since it wasn't part of the program falls under potentially extremely malicious.

jrochkind1 13y ago

What this guy describes doing (using accidentally exposed credentials to log in to somewhere) is quite a bit more than what other people have been successfully prosecuted for violations of the CFAA for. I'd be careful.

Vivtek 13y ago
You mean that Prezi, a Hungarian company, would prosecute the author, an Australian, under an American law? The Internet isn't just something happening in the United States.
- kelvin0 13y ago
  Oh, someone should tell the NSA that.
- foldr 13y ago
  It's a fair point, but a lot of other countries have similarly strict laws.
  - Vivtek 13y ago
    Hungary doesn't. I live here.
    - foldr 13y ago
      Really? According to this monograph even logging into a non-password-protected wifi network which doesn't belong to you has been treated as a case of theft in Hungary: http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=UqvV5tuTyB&dq=cybercrime%20laws%20in%20hungary&pg=PA260#v=onepage&q&f=false http://books.google.ca/books?id=ZjBvpN0zZNkC&lpg=PA33&ots=Uq... Not exactly the same situation, but it suggests that the law is fairly strict.

shabble 13y ago

One wonders if he wouldn't have been better[1] off downloading their app source, and using that to find 'in-scope' vulns much easier than everyone else. They might catch on if you're too effective though. Maybe a spot of plausible parallel construction. [1] Except for the totally illegal aspect, obviously. And the not-telling-them-their-source-is-open-to-the-world bit.

thrillgore 13y ago

Dude needs to lawyer up right now. Doing the remote login has been seen as a violation of the CFAA.

jpatokal 13y ago
Prezi the company is in Hungary, not the US, and intra.prezi.com (70.38.38.86) seems to be in Montreal, Canada.
- Vivtek 13y ago
  And the dude in question is in Australia. None of this happened in the United States at all - it's amazing! Non-Americans also have businesses!
  - balls187 13y ago
    Not very good ones, apparently.

eranation 13y ago

So let me get it straight, someone, aware of their bounty program or not, found their closed SOURCE CODE, and is getting a T-Shirt? How much do you value your own source code? at least 10,000$ right? ;) (probably much, much more) who cares about the scope, if someone found my wallet on the street which had 10,000$ in it, I would give them a bit more than a T-Shirt, I would buy them a whole wardrobe. Think if someone found the source code for Windows / Office / Photoshop, without any bounty program, and responsibly disclosed it to the respective companies. If he didn't walk away with nice amount of money, he could easily just put it in the nearest torrent site* without even feeling guilty (*this is wrong, and illegal, don't do it)

girvo 13y ago
If you found Adobes source code, they'd probably sic the cops onto you.

mimog 13y ago

Nexus isn't a source code repository. What you found was their internal artifact server, i.e compiled jar files.

ollysb 13y ago
If you look inside those compiled jar files you'll find that the code is pretty easy to read. It's certainly enough to find vulnerabilities.
- mimog 13y ago
  But.. that can be said about any java (jar) programs class files. It is also not difficult to decipher the asm of a disassembled exe file, but to equate that with finding the source code of the program would be disingenuous.
  - tptacek 13y ago
    Decompilation of executable C files is much less accurate and usable than decompilation of Java class files, which usually produce verbatim Java source code. I don't know if source was or wasn't directly disclosed here, but if they leaked vanilla Java class files, that's basically equivalent to their source code.
  - phaed 13y ago
    You can drag drop that jar file into http://jd.benow.ca/ http://jd.benow.ca/ and in two clicks you have 100% of the source code, variable names and all. It's not the same as decompiling an C executable by any means.
    - mimog 13y ago
      Having tested http://jd.benow.ca/ http://jd.benow.ca/ I must admit it seems to do a near perfect job. Impressive and scary at the same time.
brown9-2 13y ago
Assuming they are building in Java, it's pretty common to publish source JARs to the repository along with the compiled classes.

if_by_whisky 13y ago

Why not offer him the bounty in exchange for signing an NDA? If they're actually worried about not setting a precedent..

tbastos 13y ago

It would have been easy for him to steal the source code and blackmail them for bitcoins... companies are encouraging others to turn to the dark side by not giving fair rewards. I'm pretty sure there are lots of smart people living in difficult economic conditions who will now think twice before reporting a serious vulnerability at the risk of an unfair reward. If Synack can solve this it would be a major win for everyone.

Yhippa 13y ago

Are bug bounties roughly the market value of security holes in software? I wonder if this guy or less scrupulous developers could make more for them on the black market?

girvo 13y ago
If the exploits are for the right targets, you bet they're worth more on the black market, but with great reward comes great risk: now you're doing something that can possibly get you jail time.

ansible 13y ago

So the question I haven't seen asked in this thread is: Why is anyone still using something other than SSH to connect to their version control system? Why is any software still using usernames and passwords stored in plain text anywhere? With SSH, you create SSH key pairs and set a passphrase on the private key... which shouldn't end up in any public place, ever.

brown9-2 13y ago
Well the credentials in the properties file shouldn't have ended up in a public place ever. So if you replace username/password with a key, a human can still accidentally publicize the key.

pccampbell 13y ago

Having stringent terms for a bug bounty program basically means you're trying to get the community to do your team's job. Agree with @nikcub - it should be wide open, because finding this out was huge, no matter how "simple" it may have been.

Systemic33 13y ago

What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.- The only thing this causes is exceptionally bad PR, or even worse for the company; someone just got access and you don't know. Access to source code is like the gold mine of finding an exploit, because you will know exactly where a vulnerability is, and you won't even have to blindly test it.

raverbashing 13y ago
Exactly In the end, everything matters An out-of-band attack in the datacenter, VPS? Compromise of a developer machine to get inside the network? Social engineering? in the end, if it caused loss or extraction of service/data, it doesn't matter how it's done.
gabemart 13y ago
> What is the gain in setting up a "Can you hack us?" and then make some parts out of scope?! It's not like a black hat hacker would go "Oh well, this isn't their usual domain, so It's not fair" -.- This suggests that anything less than perfect security is worthless. Which is better, having pentesters look for vulnerabilities in 50% of your surface area, or having pentesters look for vulnerabilities in 0% of your surface area? Setting up a bug bounty program has a cost, both in terms of processing the data submitted and in potential disruption of the provision of services. This cost will differ from attack vector to attack vector. Having pentesters dress up as utility workers and attempt to sneak into your company offices to install keyloggers will have an extremely high cost in terms of disruption. This cost may be higher than the potential benefit of learning about the company's vulnerabilities in this area. There are also some attack vectors that may be problematic to allow pentesters to probe due to third-party contracts, data protection laws, compliance issues, etc. You may disagree with the particular areas a company chooses to define as out-of-scope, but to claim that having any areas off-limits renders the whole enterprise pointless is reductive and incorrect.
- deleted 13y ago
  [deleted]

swalkergibson 13y ago

I suspect that the biggest reason is that this amazingly gigantic, critical vulnerability was so ridiculously easy to find that they cannot stand the idea of paying someone a large amount of money to "fix" it, when the fix is to simply deny access to that service from outside a LAN or whatever. Prezi thought that they found all of the easy ones. Not quite.

scotty79 13y ago

I hope he downloaded their whole sourcode. That should make locating in-scope bugs much easier.

cordite 13y ago
I don't know about you, but I'm not about to proof read someone else's source code for a system I don't even know.
- Ensorceled 13y ago
  I'm willing to do it for $500 a bug :-)
  - simplemath 13y ago
    Easy money for an unscrupulous sort

j_s 13y ago

Break the rules, don't get the money. Surprise!!?? After reading the entire email thread, I think Prezi comes out better off than the OP: Actually we're continuously thinking on your case and struggling on the right move. On one hand, your finding was very useful for us, and we learnt a lesson from it. On the other hand, intra.prezi.com is out of scope, and by using the credentials to log in you violated the terms and conditions of our bounty program. ... In the past we turned down the bounty request of people finding issues in out-of-scope services. We had a lot internal discussions about your request: if we were about to pay, we couldn't justify our out-of-scope decisions for anyone else.

jessaustin 13y ago
...if we were about to pay, we couldn't justify our out-of-scope decisions for anyone else. What, are we in kindergarten? Does Prezi not have managers entrusted with taking decisions? They can run their bounty program however they want. That they choose to run it in this fashion sends several messages in addition to the obvious, "we are obnoxious miserly prats". While hackers in white hats might be hearing "concentrate your efforts elsewhere", those in black hear exactly the opposite message. Many people who might previously have admired Prezi for their innovation and paid them money for their services, have now heard a reason to find other means to create presentations. Potential acquirers and potential hires have heard that this company's management finds running a bounty program challenging. EDIT: Maybe I'm being too harsh. Apparently this is a largely Hungarian company; it's possible there are cultural misunderstandings in play. From a (perhaps cliched?) American perspective, however, following the rules is less important than accomplishing the goals of the program.

deleted 13y ago

[deleted]

deleted 13y ago
[deleted]

Raphmedia 13y ago

So, the message they are sending is "if you find an 'out of scope' bug, sell it on the blackmarket because even if it could wreck havoc, we won't pay you for it." Nice, nice.

edem 13y ago

My problem here is that the OP did not mask the names. Actually he did quite the opposite: he bolded them. This is no good. I can imagine the dev searching for his name in google and finding that post.

infosec_au 13y ago
Hi, I'm the author of the blog post. I've masked last names from the post and PDF, hopefully meaning that they wont be indexed with that post. Thanks for bringing that to my attention.
- edem 13y ago
  Thanks, it is much better now.
  - deleted 13y ago
    [deleted]

darkbot 13y ago

This is definitely out of the scope of their "bughunt", although I think the guy should be rewarded anyway. But I'm also quite upset with the fact that OP is outing the dev. Everybody makes mistakes, no need to out any individual developer because OP is pissed at the company management.

infosec_au 13y ago
I realised 2-3 hours after my blog post, and rushed to redact the last names from the post + pdf. I have now also redacted last names from the screenshots. Sorry about that! But thank you for letting me know. :)
- vertis 13y ago
  FYI, You can still see the url of the user on bitbucket and from there still get a name.

kyberias 13y ago

Why on earth would you ridicule the developer that made the mistake publicly? That is just utterly idiotic and irresponsible.

deleted 13y ago
[deleted]

tantalor 13y ago

The rules seem to allow a reward for this kind of vulnerability, What’s up with other vulnerabilities? ... we will consider if they are eligible for a bounty or not What is the bounty? ... we will increase it at our discretion for distinctly creative or severe bugs Prezi explicitly designed the rules to be flexible, so they could give the award in this case, but decided not to because "intra.prezi.com is out of scope". The rules about scope appear to exclude vulnerabilities in 3rd-party services such as AWS, not backends, e.g., the backends for our iPad and desktop applications are in scope http://prezi.com/bugbounty/ http://prezi.com/bugbounty/

mankypro 13y ago

Silly PR move on their part. They should've given this guy some shush money to prevent this (now) PR nightmare. Shoddy security practices, shoddy marketing and PR. Tsk, tsk.

psychboo 13y ago

I'm noticing yet another instance of HN modifying post titles. I originally titled this post "Finding Prezi's Source Code" specifically because I did not write the article. Now the post title reads (at first glance) as if I'm taking credit for the author's hard work.

meowface 13y ago
So, you found Prezi's source code huh? How does it feel? (I kid.)
welder 13y ago
Both titles are misleading. The title should be: "I found Prezi's client-side source code"

lifeformed 13y ago

The redacted names are kind of pointless, because they're not redacted in the images of the emails.

infosec_au 13y ago
I redacted their names from the post and PDF only, to prevent Google from indexing and associating the blog post with them. By doing this, future employers hopefully will not see the blog post when searching their names.
- lifeformed 13y ago
  Oh I see, that makes sense.

sophacles 13y ago

My $.02 on this is that Prezi should have not awarded the researcher the cash under the bug bounty program, however they should have given him a reward anyway. Awarding the money as part of the bug bounty wouldn't be fair play under the rules of that program, but he potentially saved them a TON of money and problems. As such, he should be rewarded somehow. Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I think Prezi should have done something like this: * Acknowledge the problem and the seriousness of it * offer a reward, but not under the bounty, just a "thanks" * Have him sign an NDA about the source itself, and the specific details of the issue, and the amount of the award * Allowed him to write up the experience should he choose (good PR for prezi) * (maybe) offered a contract for the researcher to find more such issues, or announced a different program as a result of it. The reasoning behind doing it outside the program is that Prezi needs to walk a fine line between saying "just attack everything and we'll pay you!", "we are too process driven for our own good", or they end up getting bad press from people who tried to follow the rules not getting anything, but cheaters are getting paid.

AGuyNamedChris 13y ago
>Further, had he been less than honest, he may have been able to leverage the code itself to find more than one $500 bug. I'm not sure I agree with this particular argument, it essentially reduces the concept of a bug bounty to blackmail. This mindset is not a constructive one. The tester should get rewarded for their hard work and helpfulness, not the decision to follow the law.
- Ensorceled 13y ago
  I think he meant scan the source code for security issues and then report those bugs one by one ...
  - sophacles 13y ago
    That is what I meant, I should have been more clear.

oskarth 13y ago

Presumably the goal of the bounty was to make Prezi more secure. OP found a serious security hole, without using a "violent" approach (spear phishing, cutting the power, etc). OP reported this security hole. In a legal sense, they aren't obligated to pay. There are a lot of legal loop holes. By not paying for something that they obviously want to know, they are discouraging other security researchers to disclose "out of scope" holes. To what end? If you succeed, we will give you cash. That’s right; we’ll pay cold hard currency into your bank account. Think of it as a thank you. (Prezi bug bounty site) I guess the right way to read this is as a (legal, of course) fuck you.

jayferd 13y ago

"...and all I got was this stupid T-shirt"

JoeAltmaier 13y ago

A bounty program is to get 'white hat' hackers to find and report vulnerabilities. The bounty is small, nowhere near what an extortionist could charge to keep the source secret for instance. By paying nothing for what could have been sold back to them for a huge sum, they may disaffect hackers, who could do them real harm. You become a sucker to volunteer for their 'bounty', and decide to turn to the dark side instead. I think Prezi are very silly to be splitting hairs about this. They stuck the stick in the hornets' nest, now they are arguing with the hornets.

3223f 13y ago

This sends a worrying message to others - in future don't bother reporting vulnerabilities to Prezi, just obtain the source and sell exploits to the highest bidder. It's no wonder security researchers turn to black hat methods, when they're treated/compensated like shit for their effort. "Swag" in return for your source code? What a joke

eyepulp 13y ago
"It's no wonder security researchers turn to black hat methods" -- this seems such a binary and pointless reduction of the options available. Yes, Prezi could have turned this into a PR and security win, and failed to capitalize; but the assumption that now the only option for a security researcher is to turn to the dark side is... pretty ridiculous. Those who "turn to blackhat methods" do so because they want to make money and don't place a premium on the potential moral/legal/ethical issues at play in how they're doing it. They make a choice, irrespective of the shortsightedness on display by Prezi here. Don't conflate the two behaviors.

rohitv 13y ago

Here's the cached version of the commit: http://webcache.googleusercontent.com/search?q=cache:https://bitbucket.org/flash42/config/commits/1934298e907b95234dca40050a2d0f6f http://webcache.googleusercontent.com/search?q=cache:https:/... The Nexus Repositories URL (http://intra.prezi.com:8081/nexus/content/repositories http://intra.prezi.com:8081/nexus/content/repositories) is still not restricted

eyeareque 13y ago

Bug bounty program or not, I would be pretty afraid to try to log into a source code repository without authorization to do so. It seems like a lawyer could really go after you for doing something like this.

jbverschoor 13y ago

I say release the code in the wild! Where it already was

IanDrake 13y ago

Anyone else notice that "Adam <Redacted>"'s full name and contact info are not redacted in the screen print of the email?

infosec_au 13y ago
I removed the last names from the blog posts and from the PDF, as they could be indexed by Google. I have now also removed them from the screenshots. Thanks. My intention was not to negatively affect these developers careers.
- _puk 13y ago
  Commendable, though you probably need to redact the bitbucket link in the screenshot too as that has Adam <redacted>'s full name as owner of the repo. Where does it end?!

icambron 13y ago

This would be unethical and I would never do it, but the interesting scenario would have been if he'd secretly pulled the source code and used his access to it to find a bunch more bugs. He would look like a genius and pocket a bunch more money.

supercanuck 13y ago

Seems like acting nefarious is more profitable than doing the right thing.

deleted 13y ago

[deleted]

SeanDav 13y ago

The guy found and brought to their attention a simple exploit that could have seen valuable source code released into the wild and the guys at Prezi are debating about paying him a bounty? Does this mean that Prezi do not value their code and don't believe there would have been any significant loss if that code became public? Are they saying that the next person that discovers serious flaws in their security should just keep quiet - or sell it on to some hacker, where at least they can make some money from it? Just what message are the Prezi people trying to send by nit-picking over $500?

joering2 13y ago

What an asshole approach [1]. Please, next time someone find a critical bug in the system, don't bother emailing them; just post it on Twitter. [1] http://i.imgur.com/v3W9FD6.png http://i.imgur.com/v3W9FD6.png

SideburnsOfDoom 13y ago
The picture says "intra.prezzi.com is out of scope". Because yeah, real attackers would definitely not go looking for a back door instead.

phaed 13y ago

We should start an independent bounty in btc for whoever can find and release their sourcecode into the public. I can donate 1 btc to the cause.

pepe_kriek 13y ago

Seems like Prezi has changed its mind about not paying. Prezi being a Hungarian startup made a buzz in the local media with this story and one of the leader news site reached out to them and got this reply: "Prezi: Hibáztunk és fizetni fogunk" witch means: "We made a mistake, we will pay" They also said that they will release a blog post and they will change the bounty program, so mistakes like this will not happen again (hopefully)

chatman 13y ago

Prezi deserves to be boycotted for cheating Shubham out of his bounty based on stupid "out of scope" excuse. If cracking an internal service is possible, a bug exploiting it should be within scope of any bounty program.

d0m 13y ago

One trick to avoid stupidities like this is to tell them what you found, but not how. How much is worth the vulnerability of having access to all your source code. Just ping me if you're interested.

veszig 13y ago

Here's the response from Prezi http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/ http://engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bu...

prawn 13y ago

Don't worry about the bounty, here, have swag that freely advertises our company. Weak. Why should anyone put up with that? Pay him something outside the bug bounty program. Easy and cheap solution that could've avoided all this mess.

halacsy 13y ago

I'm hp co-founder and CTO of prezi. We learn from our mistakes, we have changed the program: To improve the program from now on we will reward bug hunters who find bugs outside of the scope provided that they do not violate our users’ information and that their report triggers us to improve our code base. We will also retroactively check to see if other reports found issues that fall into this category. More info at engineering.prezi.com/blog/2013/12/03/a-bug-in-the-bugbounty/

agrias 13y ago
This should be up-voted some more so people can see the resolution. I'm glad you guys decided to reward the bug hunter for his time as well as provide a response.

buremba 13y ago

The main point is the thing that OP found is really important for Prezi. I don't really understand why they have to figure out whether the vulnerability is in "the scope", or not.

infosec_au 13y ago

Hi, I just thought I would update everyone on my experience and the last 12 hours. At the time in which I found the bug and was not awarded for it, I was quite upset, evident from my tone in the email in which I decided that I did not want to receive any of their "swag", but rather give them some constructive criticism. I wasn't expecting the blog post to get as noticed as it did, but as it has, I was able to observe great points on both sides of the argument of whether or not I should be received the bug bounty. These discussions were definitely required as they brought out some important issues with bug bounties today and how security issues should really be dealt with. Prezi, has now both apologised to me and also have offered to pay me for my findings. I have updated my blog post to show this, as well as the emails exchanged between us. I'm glad that it ended this way - all within the last 12 hours. Initially, I did not redact the developers names, and after the blog post became I had to rush to make sure that I had removed them from all places which were indexed by Google. My intention was not to negatively affect the careers of the Prezi developers affected from my findings. I thank everyone here, and generally on the internet, for looking closer into my findings. Thank you, Shubham

deleted 13y ago

[deleted]

thekevan 13y ago

Didn't he not find a bug, but found company resources that had not been secured properly?

jasonlmk 13y ago

In case anyone missed it: Prezi finally decided to pay him the bounty. Still a bad move to have denied him the bounty in the first place, but good to see that they're listening to the outrage.

Fuxy 13y ago

This policy of limiting security assessments/bug bounties to only certain things is really stupid. Do you really think that any extremely motivated hacker would just stick to the arbitrary terms you set. He will do whatever it takes to get in and by limiting security research you're making yourself vulnerable in other areas not defined in that assessment request.

toryt 13y ago

good article