I found a security issue on a competitor, got fired and served a summons(accidhacker.wordpress.com)
accidhacker.wordpress.com
I found a security issue on a competitor, got fired and served a summons
https://accidhacker.wordpress.com/2022/03/16/i-found-a-security-issue-on-a-competitor-got-fired-and-served-a-summons/
366 comments
TBH I definitely wouldn't want my employees going around and hacking competitors in their free time. Too much potential liability. I can see giving a star performer a chance if it's their first time doing it and if they'd already come clean about it to the other party, but otherwise I'd probably cut my losses.
It's one thing if it's a designated, well-vetted free for all, like Project Zero, with clear legal approval. It's another thing for a regular employee to be hacking competitors -- that begins to look like industrial espionage. And even GPZ doesn't hack banks.
It's one thing if it's a designated, well-vetted free for all, like Project Zero, with clear legal approval. It's another thing for a regular employee to be hacking competitors -- that begins to look like industrial espionage. And even GPZ doesn't hack banks.
Lots of people suggesting that either company was out of line here, but like, CFAA is still a thing (assuming OP is in the USA) and it's still got gnarly teeth. Let alone the possibility of industrial espionage allegations...
If you're going to go hack on a company, make sure you have some legal protection first. Check disclose.io or the company's website (look for a security.txt!) to make sure there's some sort of safe harbor provision, or a pre-existing vulnerability disclosure program or bug bounty program that allows you to do this kind of testing.
If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.
Meanwhile if you're an American please write your local representative and express your displeasure with the antiquated, overly-simplistic CFAA and ask them to support initiatives to have it replaced or removed.
If you're going to go hack on a company, make sure you have some legal protection first. Check disclose.io or the company's website (look for a security.txt!) to make sure there's some sort of safe harbor provision, or a pre-existing vulnerability disclosure program or bug bounty program that allows you to do this kind of testing.
If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.
Meanwhile if you're an American please write your local representative and express your displeasure with the antiquated, overly-simplistic CFAA and ask them to support initiatives to have it replaced or removed.
Many moons ago we were scanning ourselves to test changes to our infrastructure, and when testing externally scanned /24 instead of the /29 range we had. We found two wide open SQL servers, listening in public addresses with blank sa passwords (the default on install at the time, oh those innocent days...). Out of curiosity we had a quick look and found one if them contained credit card details. We backed out very quickly... Not wanting to leave such a hole open but also not wanting to risk accusations of hacking we worked out who the companies were by other clues and forged emails warning then about the issue (sending them via a wide open SMTP server, again innocent times!). We never checked to see if anything changed.
Shooting the messenger, seems to be a common practice when it comes to security issues. We only hear about those situations where someone has gotten nailed because they reported an issue but the fact that it happens at all is a problem.
I think part of the problem is that fixing a security issue is expensive and usually involves company management that has very little experience with code development so they think the person that reported the issue is a black hat hacker. It also makes life difficult for everyone involved.
A solution is to have a neutral in-between organization that can better understand how to deal with the problem without having to blame the person that reported it.
I think part of the problem is that fixing a security issue is expensive and usually involves company management that has very little experience with code development so they think the person that reported the issue is a black hat hacker. It also makes life difficult for everyone involved.
A solution is to have a neutral in-between organization that can better understand how to deal with the problem without having to blame the person that reported it.
I have no idea why you'd expect to have the right to probe around APIs like this and not be accused of malicious hacking.
You don't have authorization, you're working for a competitor, that business decided to throw you to the wolves because its easy for everyone involved to forget you ever said anything since you didn't leave any paper trail.
If I find you sneaking around in my backyard having managed to open a ground floor window I'm going to probably lose my shit and call the cops, and not thank you for discovering a security flaw.
You need to get permission for this kind of shit, and not go around jiggling other people's locks.
And the level of effort here seems fairly high and a lot more than just "view source".
The author probably deserves to lose the ability to be employed at a bank because this was some pretty bad judgment.
You don't have authorization, you're working for a competitor, that business decided to throw you to the wolves because its easy for everyone involved to forget you ever said anything since you didn't leave any paper trail.
If I find you sneaking around in my backyard having managed to open a ground floor window I'm going to probably lose my shit and call the cops, and not thank you for discovering a security flaw.
You need to get permission for this kind of shit, and not go around jiggling other people's locks.
And the level of effort here seems fairly high and a lot more than just "view source".
The author probably deserves to lose the ability to be employed at a bank because this was some pretty bad judgment.
Why would you bring this to your manager instead of trying to find a way to report it directly to the competitor, anonymously or not? If a bug bounty seems like a conflict of interest, refuse it. From the perspective of the competitor, this was an unreported security vulnerability. Of course they were going to find out; if I logged in one morning and the DB table that's supposed to be nearly empty suddenly wasn't nearly empty anymore, that's alarming!
So much here is just an absolute wild failure of judgement.
So much here is just an absolute wild failure of judgement.
Seeing that we as a society haven't fixed this problem yet tells me that we deserve the countless security breaches we get. I will continue to let any vulnerability I discover go unreported until the government grants immunity to those who report them.
I want to help others, but not at the risk of destroying my life.
I want to help others, but not at the risk of destroying my life.
> … and have a lawyer working on all this drama.
> But I mostly kept this story to myself and felt it was time to share, even if anonymously.
I’m sure your lawyer would beg to differ that it is “time to share” if you still have a criminal and/or civil case pending.
I’m not sure why you’re publicizing what you have been accused of and providing the level of detail you have provided.
And is a Wordpress-hosted blog truly anonymous?
Anyway, I guess you are here for questions, so here is one: Do you feel like you made an ethical mistake attempting to find security holes in the competitor, or do you think your former employer overreacted and was wrong to fire you?
> But I mostly kept this story to myself and felt it was time to share, even if anonymously.
I’m sure your lawyer would beg to differ that it is “time to share” if you still have a criminal and/or civil case pending.
I’m not sure why you’re publicizing what you have been accused of and providing the level of detail you have provided.
And is a Wordpress-hosted blog truly anonymous?
Anyway, I guess you are here for questions, so here is one: Do you feel like you made an ethical mistake attempting to find security holes in the competitor, or do you think your former employer overreacted and was wrong to fire you?
Unsure why this is being shared with potential criminal and civil charges being involved.
Also, if true, you likely have enough evidence for a stellar lawsuit against the company once all is said and done. You may also have enough evidence for a second lawsuit against your employer depending on exact circumstances. Hopefully your lawyer is knowledgeable enough to navigate these issues.
In the future, don't involve your employer with security disclosures. Ensure you document everything and email or write the company in question to give them time to fix their issues. What they did is wrong, however you should have reported it to them in a reasonable amount of time. Not that you are required to, but rather, to cover your own butt and prevent this exact type of scenario.
Also, if true, you likely have enough evidence for a stellar lawsuit against the company once all is said and done. You may also have enough evidence for a second lawsuit against your employer depending on exact circumstances. Hopefully your lawyer is knowledgeable enough to navigate these issues.
In the future, don't involve your employer with security disclosures. Ensure you document everything and email or write the company in question to give them time to fix their issues. What they did is wrong, however you should have reported it to them in a reasonable amount of time. Not that you are required to, but rather, to cover your own butt and prevent this exact type of scenario.
I'm not able to load the page.
"AccidHacker" "Coming Soon"
Is this happening for anyone else? Perhaps it has been deleted?
"AccidHacker" "Coming Soon"
Is this happening for anyone else? Perhaps it has been deleted?
I think it's great that you shared your story with the world. We can learn something from this. I guess it is that security researchers can easily be accused of all sorts of things.
It is true that exposing a vulnerability in somebody's product can make them mad, since it can harm them. Especially with banks, they are not the most ethical entities out there. Good luck. I wonder if more people would like to offer their advise on what you should have done instead.
It is true that exposing a vulnerability in somebody's product can make them mad, since it can harm them. Especially with banks, they are not the most ethical entities out there. Good luck. I wonder if more people would like to offer their advise on what you should have done instead.
Op should really delete this blog post. It has a lot of details that could be used against them in court.
On one hand we have this poor guy, and on the other hand we have Aubrey Cottle, the guy who leaked personal details of about 100,000 individuals and openly bragged about it on TikTok. [1]
Anarcho-tyranny is truly the mot juste.
[1]: https://thegrayzone.com/2022/02/18/hacking-canadian-trucker-...
Anarcho-tyranny is truly the mot juste.
[1]: https://thegrayzone.com/2022/02/18/hacking-canadian-trucker-...
Banks, credit card issuers, and many brokerages suck from a tech stack perspective.
During the y2k times I did a lot of contract work porting old COBOL code to be y2k compliant. The number of seriously spooky security things was mind boggling.
Having mocked API's like you found is not a surprise. The fact they even bothered to use API's was a step in the positive direction versus telnet and ssh tunnels to pipe data around with hard-coded ip's and accounts.
During the y2k times I did a lot of contract work porting old COBOL code to be y2k compliant. The number of seriously spooky security things was mind boggling.
Having mocked API's like you found is not a surprise. The fact they even bothered to use API's was a step in the positive direction versus telnet and ssh tunnels to pipe data around with hard-coded ip's and accounts.
It sucks but I can totally see the employers and competitors viewpoints. OP not only cracked open the app but made requests to their server. OP is not involved with the infosec at their employer and has no business cracking open their competitors app. The blowback from this could have been huge for the employer.
OP - the people involved only want to cover their arses, and they're all using you to do it. This is unjust, but unfortunately it's also normal. Time to stop talking and focus 100% on avoiding conviction by working carefully with your lawyer.
FinTech really embraces the “move fast and break shit” mantra.
I’ve seen so many blatant violations in my short stint it would make your head spin.
Happy to never go back…
I’ve seen so many blatant violations in my short stint it would make your head spin.
Happy to never go back…
Wow, the author is very naive. Did you really think anything good would come out of you telling this to your employer? Your do not owe them anything you do in your spare time, unless there's some contractual obligation. Companies are just looking after themselves, and will quickly throw you under the bus. I am very paranoid with that.
I used to explore APIs and do this sort of digging for fun, even though I was employed. My approach was the following. If the company had a decent bug bounty program, I'd be happy to report it there, it's the safest way for anyone to do that. If there was not, I'd try to sell it to an "alternate buyer", which is less preferred. I never many things worthwhile reporting though.
I used to explore APIs and do this sort of digging for fun, even though I was employed. My approach was the following. If the company had a decent bug bounty program, I'd be happy to report it there, it's the safest way for anyone to do that. If there was not, I'd try to sell it to an "alternate buyer", which is less preferred. I never many things worthwhile reporting though.
If you are not making money from security you shouldn’t mess around with it at all. Too much downside and too little upside. Let the criminals ransomware the hospitals until society grows up and learns that they need security research.
I can't speak for whether the OP is in violation of any laws or not. I am, however, very curious about the identity of this competitor bank. Yeah, I get why they might be suspicious of OP given his initial access, but my god that company sounds like it's being run by a bunch of incompetent hotheads. They have seem to have absolutely no idea how to investigate a security breach let alone run a finance company.
Note to OP: if things don't go your way with the lawsuit, do the society a favor and let the world know who these guys are so we can all steer clear.
Note to OP: if things don't go your way with the lawsuit, do the society a favor and let the world know who these guys are so we can all steer clear.
Shooting the messenger is cheaper and maintains the appearance of security which is apparently much more important. The emperor's clothes are particularly fine today, are they not?
Directly informing the effected bank and then informing your then employer would've been a better solution? I think it has the highest chance for least negative repercussions. I assume it would still go a bit wild, but have the least negative impact. Obviously I could be wrong.
You need to keep in mind that security disclosures and everything around (legal, why disclose? etc) it is a black box for most folks.
Also OP said after reporting it, "months later" OP was fired. This means anyone in those months anyone could've found what the OP found and abused it. And the effected bank might've not been involved until later? And all those crimes are now on your shoulders. Your then bank employee would get delayed through the politics in your company (even with good intentions). It will happen even for their own security disclosure handling. Let alone for competitors cos so much legal stuff are involved now.
From the effected bank's POV, you are just a bank employee who did some fraud. Mainly cos you didn't inform the effected bank and it's been months. Insider hacks from the same industry is not unheard of.
Like I said, this would've been a different scenario if you informed them ASAP. And I am sure when issues hit the roof your employer would wash their hands off. It is the easiest thing to do. Unless you are very well connected in the office. Otherwise even your employee are not sure about you. They will be asking questions like, why is this person doing this anyways? He is not in security so why was the OP poking around it? etc etc.
Hope this gets sorted out. Interesting case indeed.
You need to keep in mind that security disclosures and everything around (legal, why disclose? etc) it is a black box for most folks.
Also OP said after reporting it, "months later" OP was fired. This means anyone in those months anyone could've found what the OP found and abused it. And the effected bank might've not been involved until later? And all those crimes are now on your shoulders. Your then bank employee would get delayed through the politics in your company (even with good intentions). It will happen even for their own security disclosure handling. Let alone for competitors cos so much legal stuff are involved now.
From the effected bank's POV, you are just a bank employee who did some fraud. Mainly cos you didn't inform the effected bank and it's been months. Insider hacks from the same industry is not unheard of.
Like I said, this would've been a different scenario if you informed them ASAP. And I am sure when issues hit the roof your employer would wash their hands off. It is the easiest thing to do. Unless you are very well connected in the office. Otherwise even your employee are not sure about you. They will be asking questions like, why is this person doing this anyways? He is not in security so why was the OP poking around it? etc etc.
Hope this gets sorted out. Interesting case indeed.
No good deed goes unpunished.
I learnt this lesson in high school when I disclosed serious security vulnerabilities in the schools IT systems and statewide VPN and firewall/censorship solution. I was effectively expelled (in technicality "asked to leave").
Unless someone is paying you just don't bother. Even if they are paying you stick to the systems in the brief.
I learnt this lesson in high school when I disclosed serious security vulnerabilities in the schools IT systems and statewide VPN and firewall/censorship solution. I was effectively expelled (in technicality "asked to leave").
Unless someone is paying you just don't bother. Even if they are paying you stick to the systems in the brief.
The moral of the story is that you should use Tor / a proxy and remain anonymous if you are planning on hacking someone else.
Useful reminder for the armchair lawyering: the only person's who's opinion of the law carries any weight is a judge. Lawyers make arguments to sway that opinion.
The opinion as fact stating here is incredible. The law is the law because that's what the law says it is. This was a stupid thing to do. There's just no arguing that.
The opinion as fact stating here is incredible. The law is the law because that's what the law says it is. This was a stupid thing to do. There's just no arguing that.
I really hope for this person's sake that they kept a log of communication with their manager and higher-ups when initially disclosing the vulnerability. After losing access to company systems (after getting fired) I doubt HR is going to be very helpful in fighting their case.
Surprised to see so much “that’s what happens when you poke around” in this thread after we just had the jvns guide to dumping undocumented APIs on the front page this week without any “breach of CFAA” comments.
404'd. That was quick. Seems like he took advice of some in this thread.
If there is now a pending card fraud case that you are now involved in, how did you manage to get another job? Like you said, this kind of thing is a carrier killer. Does your current employer know about it?
Someone else later discovered the same issue with OtherCo and stole a bunch more card numbers, and used them to commit fraud.
OtherCo looked through their logs, saw the initial exploration coming from this guy at CorpCo, assumed he was also responsible for the subsequent fraud, and contacted CorpCo which ultimately fired him. The fraud was substantial enough for OtherCo to convince authorities to pursue criminal charges.
It's a sad story - but it's not unreasonable behavior from all involved.