| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <56D911B4.1000209@karmainsecurity.com> Date: Fri, 04 Mar 2016 04:40:20 +0000 From: Egidio Romano <research@...mainsecurity.com> To: fulldisclosure@...lists.org Subject: [FD] Hacking Magento eCommerce For Fun And 17.000 USD Hello list, Tonight I'd like to share with you my latest blog post. Seeing my personal experience with the Magento bug bounty program (and even experiences from other security researchers), it looks like they truly believe in a "security through obscurity" methodology. I'm quite disappointed by the fact they tried to downplay the severity of my vulnerabilities, silently patching them after several months, without letting me know their progresses. However, what really disappoints me is that my vulnerabilities seem to be quite critical, specially considering they're the only two classes of security bugs they're willing to pay up to 10,000$ under their bug bounty program. I had to ping them several times in order to get my bounties, so I believe they tried to "obscure" and unevaluated my findings not only because of their "security through obscurity" methodology, but probably because they were also hoping I'd never noticed their advisories with my name and the vulnerabilities I reported, and never claimed my bounties for such findings? Link: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd Best regards, EgiX _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists