I got access to all of BitTorrent Inc's source code and sensitive documents

http://forum.ragezone.com/f10/bittorrent-source-dns-reward-948810/

by simplyinfinity • 13 years ago

72 52 13 years ago

forum.ragezone.com

GBiT• 13 years ago

You have to be proud of yourself for not abusing it no mater how they responded. You did right thing here. Hope Bitorrent Inc will fix this misunderstanding.

citricsquid• 13 years ago

Looks like he acquired login information, he didn't exploit some sort of major vulnerability that needed to be fixed which is generally what bug bounties seem to be for. He's insulted he didn't get paid for not being an asshole, what a strange world we live in. Facebook (or any other company) wouldn't pay out if one of their support staff accidentally made a random user an admin, why should this be any different.

patrickgokey• 13 years ago

Like he says on the forum thread, he did not acquire any login information. Just the opposite, in fact. They neglected to set a username/password to their admin panel. That's a gaping security hole if I've ever seen one.

Andrenid• 13 years ago

He didn't get credentials, they never secured their admin panels:

A friend was looking for a hosting provider and wanted it all secure, I checked a network range and found the Jenkins panel of BitTorrent. This was all 100% accidental, truth! At the end of the day If I wanted to 'hack' BitTorrent I wouldn't even know where to begin. I mean, there is no real skill or talent involved in what I did to find the information on BitTorrent. They forgot to set a user/pass to the admin panel, that had access to github from a master account. Github accounts had user/passes that was linked to everything.
No hacking, just random find. Mad huh?

Dylan168075• 13 years ago

He stumbled across a major vulnerability that needed to be fixed, not login credentials.

He's insulted he didn't get paid for not being an asshole, what a strange world we live in.

That's how bug bounties work, yet people don't complain there.

hack_edu2• 13 years ago

Stay classy!

cupcake-unicorn• 13 years ago

Indeed...This seems rather petty to me. They did offer him some money, which he's not even automatically entitled to in the first place...companies can chose whether they do bug bounties, or how much they pay.

ascendantlogic• 13 years ago

You don't seem to understand that access to something that widely used would be worth tens of thousands of dollars on the black market for those sorts of things. For every "good" person that reports the information for free, there are people out there actively looking for this sort of thing that are not good people. If this company sets a precedent that they won't make it worth your while to "turn in the evidence", that sort of thing will just go to the highest bidder out there on the Internet and undoubtedly used for something extremely malicious.

tl;dr: small payouts and jerking this guy around sets a bad precedent that will encourage future people to sell on the black market.

fibbery• 13 years ago

Just because someone leaves their car door unlocked and you tell them about it, doesn't mean they are obligated to give you any of its contents.

kaybe• 13 years ago

On the other hand, if you find a wallet, you are entitled to 10% of the cash.(1) (Bad fit as an example, I know, but the question is what is a good comparison..)

(1) at least in Germany.

letney• 13 years ago

Is this German law? I wish that were the case in the US, as I've found a number of wallets over the years and would have made at least a few hundred USD by now.

fnordfnordfnord2• 13 years ago

What! I found a lady's Rolex once (Wilhelma Zoo, Stuttgart) and only got a goofy look when I turned it in.

netrus• 13 years ago

Source: http://translate.google.com/translate?hl=en&sl=de&tl=en&u=ht...

(It's 5% below 500EUR, 3% above)

MentaLTorrent2• 13 years ago

A model is nothing, blueprint and trade secrets would be a better way to look at it.

fnordfnordfnord2• 13 years ago

If someone also left the family jewels lying on the seat, someone might want to make sure that people are encouraged or rewarded for doing the right thing.

otterley• 13 years ago

I find the author's righteous indignation that he did not receive the ransom he thought he deserved amusing at best.

MentaLTorrent2• 13 years ago

I contacted BitTorrent and told them EXACTLY what I did , what information I had access to and what user/passes needed updating, including SSH keys and more. Whilst I gave a small generalization of what was at hand on the thread, there was a considerable amount of data available to me.

- MentaL (RZ Thread Starter).

hack_edu2• 13 years ago

Now you just sound entitled AND righteously indignant...

biot• 13 years ago

Scenario 1: You find a boy who is lost and take him to the police station. The family gives you $500 in reward.

Scenario 2: You find twin boys who are lost and take them to the police station. The family gives you $500 in reward.

Would the fact that you get the same reward regardless of the number of people lead you to act differently in the future? So if next week you found lost twins again, would you let them stay lost or try to sell them on the black market because you know you'll only get $500 when you think it should be $1000?

Or is doing the right thing its own reward regardless of whatever amount you get in recognition for acting honorably?

perryh2• 13 years ago

They offered $500 as a nice and thankful gesture. If you wanted money, take it and don't cry about not getting more. You're not entitled to more money nor do you deserve more.

knodi• 13 years ago

You should have just released it all. j/k... not really.

film42• 13 years ago

If you were able to break into Valve because they failed to secure some login, and as a result got access to their Source Engine. Would $500 be enough to silence you?

eli2• 13 years ago

Yes. Of course.

You would insist on more than $500? To stop you from hurting a company by releasing things you obtained unlawfully? Isn't that unethical? Illegal?

I would -- in fact I have! -- reported serious security vulnerabilities with no expectation of financial reward.

rangibaby• 13 years ago

How about a "job offer"?

http://www.eurogamer.net/articles/2011-02-21-the-boy-who-sto...

zem3• 13 years ago

what ransom? he did not threaten them with anything; he's just annoyed now because he feels they didn't reward him sufficiently. not the same thing as trying to extort money out of them to reveal the vulnerability.

nemothekid• 13 years ago

If I left my front door open one day, and you happened to find it, should I reward you for not stealing anything?

X43• 13 years ago

no, he didn't get anything, but promises!

lukeman2• 13 years ago

You got my hopes up that we'd finally be able to audit Bittorent Sync.

nivla• 13 years ago

lol I was hoping for that too. A great piece of software but a waste since it can't be trusted for anything secure. To make it worse, this news just adds more fuel to the fire. How can you trust them with security if they can't even remember to add a basic authentication to their Admin Panel?

bigiain2• 13 years ago

I've got it syncing EncFS encrypted directories - which in the broad view doesn't help - I've got un-audited code running with my user privs, which _claims_ to "not do anything evil" without being (easily) verified.

At least it does mean I've got some extra encrypted-on-the-wire and encrypted-at-rest data floating around - I strongly suspect BTSync's SHA256 encrypted wire protocol moving AES encrypted EncFS files means that data is secure against the NSA's ubiquitous surveillance programs - the cleartext of those files won't be showing up in XKeyscore in response to bored or curious NSA (or Boos-Hamilton) staff. (While acknowledging that if the NSA becomes interested in _me_ specifically (or probably interested enough in any of my social network) - my privacy will be easily and wantonly violated. And I'm actually _mostly_ OK with that.)

sneak• 13 years ago

This was my very first thought, as well.

Perhaps there should be a kickstarter for an open source bittorrent sync clone?

lukeman2• 13 years ago

The hope is more that the protocol will be published once it's stable and then FLOSS implementations can spring up. The protocol is clearly still in flux, as some versions of the client have had backwards-incompatible changes.

0x0• 13 years ago

If one guy could accidentally stumble upon this, what are the chances others have too? Would it be possible or even likely that the source code or binaries or web servers or private keys have already been compromised or trojanized?

mrlinx• 13 years ago

By submitting this information to BT, he indeed closed a access point to all this data, thus reducing the likelyhood of it being badly used. Isn't this exactly why bounties were created? Because its better to give a few bucks and increase the system's security than to have it compromised for worse costs.

EasyCo• 13 years ago

Some thoughts: From the perspective of the company, what kind of financial impact would they have suffered should that information have fallen in different (malicious) hands? Providing an adequate award not only shows appreciation but it sets a precedent should something similar happen again. The 'finder' who might otherwise usually go the malicious route will be more likely to do as MentalL has.

jongraehl• 13 years ago

It's not the amount of money so much as the "so invoice us" attitude.

jheriko• 13 years ago

whilst i agree they are ungrateful and inept i can't help but notice that you want a reward for doing the right thing?

get over it... life isn't this nice, you are entitled to nearly nothing. deal.

I got access to all of BitTorrent Inc's source code and sensitive documents

Related Stories