April 10, 2021

Vulnerability reporting advise

I work over the phone tech support. A few weeks ago I found an XSS vulnerability that would affect essentially private comments on a users home page in my company’s software, while investigating this and writing up a report for my supervisor (who is basically an hr person with no relevant tech experience) I also found a flaw in the login procedure that would allow anyone someone to bypass the password field when signing in.

With these issues together I immediately informed my supervisor and stressed that this could impact a large number of our customers and might make our software no longer compliant with government regulations it is required to follow.

It’s now been almost two months and the issue still exists, and I have yet to have a serious conversation with anyone in a position to start the process or resolving this issue.

The impact would by and large affect primarily individuals who are older and not tech-savvy. Additionally, this software is used for work and usually, individuals using it do not have a suitable alternative to my companies software.

If this were a company I did not work for I would already have gone public with enough information to allow people who have alternatives to use them. I’m wondering if there is a point I should go public, what can I do to get in communication with someone at my company that can implement changes. At this point, I’ve made enough of a stink that if this were to go public it would be traced to me.

Any help or advice would be appreciated.

Comments

tweedge

Get in touch with your company’s legal team. Bring proof of your claims – demonstrate them, and demonstrate how long the company has known about them. They’ll know more about the impact to specific regulations, so I wouldn’t lean too hard on your own knowledge there – but if you’re correct, this could get a lot of pressure behind you to push for a fix.

If you go public with the problem, you will almost certainly be fired. ~100% if in the USA and working for a private company, you are most likely an at-will employee and have signed confidentiality clauses. If the company is given any reason to think you might’ve leaked that information, say goodbye to your job, they have everything they need to throw you out.

I definitely empathize with your frustration though. If you *can’t* get traction, you are in a no-win scenario, where the only outcome that doesn’t result in a firestorm is to shut up and accept the issue. For what it’s worth, you’ve got a gold star in my heart. A lot of professionals – for reasons similar to this – have to sit on certain security issues because there’s no ethical way to go public with it, or the personal risk is very high.

I would recommend seeking new employment whether or not you can get traction, though. A company that isn’t willing to do right for their customers here undoubtedly has more issues under the hood.

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: By filling this form and submitting your commen, you acknowledge, agree and comply with our terms of service. In addition you acknowledge that you are willingly sharing your email address with AiOWikis and you might receive notification emails from AiOWikis for comment notifications. AiOWiksi guarantees that your email address WILL NOT be used for advertisement or email marketting purposes.

This site uses Akismet to reduce spam. Learn how your comment data is processed.