full-disclosure - [FD] Hacking Magento eCommerce For Fun And 17.000 USD

Open Source and information security mailing list archives

Date: Fri, 04 Mar 2016 04:36:15 +0000
From: Egidio Romano <research@...mainsecurity.com>
To: fulldisclosure@...lists.org
Subject: [FD] Hacking Magento eCommerce For Fun And 17.000 USD

Hello list,

Tonight I'd like to share with you my latest blog post. Seeing my personal experience with the
Magento bug bounty program (and even experiences from other security researchers), it looks like
they truly believe in a "security through obscurity" methodology. I'm quite disappointed by the
fact they tried to downplay the severity of my vulnerabilities, silently patching them after
several months, without letting me know their progresses. However, what really disappoints me
is that my vulnerabilities seem to be quite critical, specially considering they’re the only
two classes of security bugs they’re willing to pay up to 10,000$ under their bug bounty program.
I had to ping them several times in order to get my bounties, so I believe they tried to "obscure"
and unevaluated my findings not only because of their "security through obscurity" methodology,
but probably because they were also hoping I'd never noticed their advisories with my name and
the vulnerabilities I reported, and never claimed my bounties for such findings?

Link: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd

Best regards,
/EgiX

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives