Security Researcher Assaulted Following Vulnerability Disclosure

https://www.secjuice.com/security-researcher-assaulted-ice-atrient/

by wglb • 7 years ago

399 86 7 years ago

secjuice.com

YjSe2GMQ• 7 years ago

If you (like me) didn't know what a Shodan safari is, you're in for a fun ride:

https://techcrunch.com/2019/01/21/shodan-safari/

strictnein• 7 years ago

It is unbelievable what, to this day, is still directly connected to the Internet. Everything from pharmacy prescription systems, to large cargo ships in the middle of the pacific, to dam control systems.

Shodan is an awesome tool.

morpheuskafka• 7 years ago

Also they have a free plan for anyone with an edu email, great way to kill a few hours in between studying!

jstanley3• 7 years ago

Without Oath's abusive GDPR wall: https://outline.com/JF28AH

justaj• 7 years ago

It's quite ironic that I can view the techcrunch.com link without JS just fine, but the outline.com link requires me to allow JS on at least 2 domains before viewing the content.

Siemens• 7 years ago

How can outline legally host another website's content?

xxxanony• 7 years ago

best $50 I ever spent

saagarjha4• 7 years ago

With articles like this, I often to take out the horrible thing that the company is doing and post the quote to Hacker News, to give a sense of the scale of the issue; in this case me trying to do so would require including the majority of the article. It’s that bad. And yes, apparently the company thought it was ok for the COO to physically assault security researchers at a conference.

tacon• 7 years ago

One of the Glassdoor reviews mentions the COO getting wasted at tradeshows, so maybe the assault is just normal behavior for him.

clubm82• 7 years ago

Weird, I've gotten "wasted" at tradeshows but never assaulted anyone :)

AndrewKemendo• 7 years ago

Casinos have such a large attack surface that they should be thanking anyone and everyone who exposes any vuln.

penagwin2• 7 years ago

So is this still a vulnerability? Time to do some more digging boys!

saagarjha4• 7 years ago

In the off chance that you're serious, this sounds like a great way to land yourself in federal prison.

walrus01• 7 years ago

As if blackhats in Vladivostok are particularly afraid of the FBI. Once the vulnerability is public, if that stuff is still connected to the public Internet, game over.

WrtCdEvrydy2• 7 years ago

a great way to land yourself in federal prison.

For what? Checking shodan and seeing that people don't know how to write secure code.

kache_• 7 years ago

You and a lot of other people are doing some digging right now

a3n2• 7 years ago

Wouldn't the Nevada Gambling Commission be interested in this?

rhexs2• 7 years ago

I mean, maybe, but do you really think they have some sort of well-staffed cyber-division that would 1. understand this and 2. know what to do with it? My guess is they're still operating like it's the 1980s. Hopefully I'm wrong!

Curious that the FBI now does vulnerability coordination. Haven't ever heard that before.

lallysingh• 7 years ago

There could be blanket clauses like reasonable efforts to secure private information, access controls, etc. They don't have to specify on the regulation what has to be done, just let prosecutors argue that it's not sufficient.

a3n2• 7 years ago

My guess would be yes, since so much of gambling is electronic. "Wire fraud" is pretty old.

daeken• 7 years ago

I've not dealt with the NGC directly -- only other gaming commissions and some NGC partners -- but everyone I've dealt with in gambling has cared deeply about security. They often get it wrong, but they take this stuff very seriously.

reaperducer2• 7 years ago

do you really think they have some sort of well-staffed cyber-division that would 1. understand this and 2. know what to do with it?

1. Yes. 2. Also yes.

The Nevada Gaming Commission, all of the big casino companies in its state, and the companies that make the gambling machines, are quite remarkable, technologically speaking.

Sometimes I think the terrible web sites they have for hotel reservations are just a smokescreen.

cody82952• 7 years ago

I was once fired from a state job (USA) for bringing a vulnerability forward in the online ethics training. You can run "setScore(100, 0, 100)" in the developer console and pass the exam without actually taking it. (The state used a third party online exam provider who I contacted). I was fired by the end of the week

cody82952• 7 years ago

Edit: the vulnerability still exists on many online exam styled pages.

WrtCdEvrydy2• 7 years ago

Of course it does, half the fucking garbage software you use in a browser is using shitty client side validation.

mLuby• 7 years ago

Sorry you got fired from your old job. Sounds like your new job could be "pay a dollar to skip the exam."

saagarjha4• 7 years ago

In that case you fail the test for showing a lack of ethics ;)

excalibur• 7 years ago

I would say the state failed the ethics test for firing him.

judge2020• 7 years ago

We don't have the full details but presumably this was on a single test at the beginning of the class.

rhexs2• 7 years ago

Did you hire an attorney, or just move on with life?

SEJeff• 7 years ago

I had to do "online traffic school" and noticed there were 2 javascript variables that were on a timer. If you set the variables correctly in the right order, the timer expired and it would let you go to the next page.

I spent the time figuring this out because I read exceptionally fast. When I've read a page in a few minutes and the timer forces me to sit there for an additional 13 minutes, I'm going to figure those things out. It was silly.

dragonwriter• 7 years ago

I suspect you were fired for trying and using the vulnerability (which you no doubt did merely to confirm your suspicion of it) rather than for bringing it forward, which merely provided the evidence for the reason for firing.

Though you probably would have done better to report the problem through the state authorities overseeing the contractor (or the general government oversight agency, like th Bureau of State Audits in California) rather than the contractor, to whom your report was a threat of revealing their poor performance.

If nothing else, a report to responsible state authorities would be less likely to meet with someone with an incentive to sweep it under the rug (especially a general oversight body) and would be more likely protected by whistleblower protections, which most states have in some form.

heyjudy2• 7 years ago

Yeap. Kill the Messenger is the default setting. It's a miracle Snowden is still alive.

empath75• 7 years ago

Online cbts like that are mostly honor system and there’s a zillion ways to get around then.

jstanley3• 7 years ago

Because there is no SSL protection and because the API is wide open and vulnerable to abuse, it is possible to identify kiosks by their Mac address

Eh?

ScottBurson• 7 years ago

It should have said "MAC address" [0]. Nothing to do with Apple Macintoshes.

[0] https://en.wikipedia.org/wiki/MAC_address

jstanley3• 7 years ago

That still doesn't make any sense to me in the context of the rest of the sentence.

meritt• 7 years ago

Disclosing security vulnerabilities that aren't part of a bug bounty program takes a large amount of either courage or ignorance. Until there are protections in place for a given jurisdiction, far safer to leak it anonymously or just stay quiet. I was surprised that GDPR didn't contain any sort of protections for security researchers. The fines collected are hefty enough they could easily run a very successful bug bounty program.

3pt141593• 7 years ago

I agree with you, but it isn't a clear cut issue. Attacking a server right now comes with some legal risk, which is a deterrent to some. It's impossible to tell white hats from black. If it were paired with a law that made it a felony to resell vulns to third parties then it would be much more robust.

jplayer012• 7 years ago

The only way you're going to reduce the amount of vulnerabilities being sold on black markets is to provide sufficient financial and social incentive. There are enough people with dubious morals who don't care how illegal it is to find and exploit them, who will eagerly take the biggest payday. Combine no guarantee you'll get paid, poor treatment by authorities and employers and the (albeit low) risk of getting your shit kicked in, I'm not surprised people aren't lining up at the door to report vulnerabilities.

nodesocket• 7 years ago

While the behavior of Atrient and specifically Jessie Gill is absurd in terms of working with the researchers to address the issues and pay the bounty, I am always skeptical of these captured videos. We don't have any context of what was said before and what the communication between the researchers and Atrient was like other than their accounts. Maybe I am just being cynical, but I've personally had interactions with security researchers who are extremely arrogant and on a vendetta to show how smart they are, and drift from white hat to grey or in some cases black hat territory.

bigiain• 7 years ago

Does it matter what happened before?

Is there _any_ circumstance under which that's appropriate or even justifiable behaviour for a CxO, no matter what had happened in the preceding few moments? If your CxO isn't capable of maintaining professional behaviour in front of arrogant researchers or blackhats boasting in public, I'd suggest it's well past time to be polishing up your resume and moving on...

nereus182• 7 years ago

I personally (and unfortunately) know Jessie Gill of Atrient. I have to, for work purposes. The way his interactions and comments/quotes were described in that article were exactly things that he would say and do. He's a pretty violent guy actually. And the way he's acting in that video, only saying, "I don't know you" and sitting down, he knows he needs to watch what he says because there are a lot of things that that video could tie to later. Anyway, I wasn't there so I can't be 100% sure of anything, but I have known Jessie for years, hell I've been to his house several times, and the behavior is spot on.

me9187• 7 years ago

hello! thanks for this comment would you be able to contact me on twitter @me9187 (this account is mentioned in the secjuice article for verification) and tell us a little bit more about your experiences?

Atrient• 7 years ago

I also know jessie gill personally and he don't deserve to be COO of the copy. I don't have any clue why Atrient CEO Sam don't take of this things well. Moreover he knows what jessie behavior is but he still won't bother to take action against him. And just to add it Jessie is pervert he has sexual harassment case going in case.

bredren• 7 years ago

To assault a programmer on the floor of a conference and expect to get away with says a lot about what this person has likely gotten away in their past.

Keverw2• 7 years ago

Yeah, especially a tech conference. Everyone has phones with cameras, vloggers and journalists covering things.

I know there are stories of casinos in Vegas breaking people's legs for cheating, but I guess that doesn't happen anymore since big corporations run them now with too much to lose. Plus if that ever happened and went viral, it would hurt their business.

Animats• 7 years ago

Now that this is out in the open, I wonder how much longer Atrient will stay in business. These people sell these systems to casinos. Their customers are not going to like this at all.

Atrient mostly handles affinity cards and such. So they have lots of info about customers, including drivers license scans[1], but not much of a connection into the casino's main systems. A basic break-in might get you a suite upgrade or free booze. A more ambitious attacker would obtain the casino's customer list, with enough info to identify big losers and big winners.

[1] http://www.atrient.com/products/card-printing-enrollment/

caf• 7 years ago

Well there was also this:

"...and that you could enter casino cash prize draws with as many entries as you wanted in order to win them, ..."

technion• 7 years ago

Regarding a "casino's main systems"..

Going back a few years I was involved with a gaming organisation. We were advised that certain activities legally had to be air gapped (we are not in the US), and I raised an issue of how it is that servers could be accessed by VNC (single dictionary word password) over the Internet if that were the case.

I was advised that the server was installed in a rack with 1RU of space between it and the router connecting it to the internet, and that lawyers had reviewed it and considered that to meet the legal definition.

I strongly suspect you'll find core activities just as vulnerable.

helios893• 7 years ago

So open season on Atrient?

whyisthewhat• 7 years ago

This is not the first time Atrient has been sloppy with the details of their NDAs, nor the first time Jessie Gill has gotten in trouble for being a touch too eager to get physical.

https://www.leagle.com/decision/infdco20180828d81

corebit• 7 years ago

Hahahaha, how terrible is Atrient's lawyer, Mark E. Ferrario, for filing a complaint that didn't even allege a cause of action?!

He just asked the court to do some random stuff without arguing a case. The whole opinion is just, "Plaintiff didn't allege anything, so dismissed".

techntoke• 7 years ago

Geez, what a creep and psychopath. This is what happens when someone thinks that they are too rich to follow the rules of society.

Abimelex• 7 years ago

People are complaining a lot about GDPR here but such a case would definitely lead to a fine of 4% or 8% of atrients revenue.

topkai22• 7 years ago

Konami is at huge risk, too, as it sounds like they were the global distributors.

ID1452319• 7 years ago

I think I'll submit a Subject Access Request, as I am sure I'm a member of the Caesars loyalty programme.

gene_vache• 7 years ago

Does anyone figure this guy is connected and the third party contractors hired to program the kiosks were some student working from home in his off time?

heyjudy2• 7 years ago

Play stupid games with mafioso, win stupid prizes. (Pun intended.)

michaelmrose• 7 years ago

Such behavior needs to lead to jail time and not just a trivially payable fine so that the rich like the poor understand that wrongdoing has consequences.

LaserToy• 7 years ago

This one does deserve to be called vulnerability. It is a plain stupidity.

techslave• 7 years ago

g’bye atrient. we hardly knew ye.

craftoman• 7 years ago

We should not forget the 18 year's old Hungarian "hacker" that was arrested for opening Dev Tools and modified HTML values. https://techcrunch.com/2017/07/25/hungarian-hacker-arrested-...

jeddhor• 7 years ago

Wonderful man, this Jessie Gill.

https://www.leagle.com/decision/infdco20180828d81

Security Researcher Assaulted Following Vulnerability Disclosure

Related Stories