Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
HackerOne Drops Mobile Voting App Vendor Voatz
Newest First  |  Oldest First  |  Threaded View
emmawatson02020
50%
50%
emmawatson02020,
User Rank: Apprentice
4/2/2020 | 4:38:04 AM
Reply
Such a nice post.. I appreciate you...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/31/2020 | 8:00:27 PM
Re: Two problems
You hit the nail right on the head here my friend. Very comprehensive analysis. These vendors need to be held accountable. Otherwise, instances like this will run rampant and we will be sacrificing consumer security and in this case privacy in the process.
Ppooo
50%
50%
Ppooo,
User Rank: Apprentice
3/31/2020 | 10:14:12 AM
Two problems
There are two problems here.  One is that Voatz was acting in bad faith and attacking the researchers' motive.  Two is that HackerOne does not prevent abuse of scope/criticality classification by its members. 

In this example, Voatz classified the bug as out of scope, even though it was later reclassified.  By its initial classification, Voatz was exempted from any obligation to fix it, but the submitter was still bound to HackerOne's NDA.  That is a loophole that HackerOne needs to fix.

If a bug is truly not in scope, and the vendor does not plan to fix within a normal disclosure period, or at least show good faith progress on resolving, then the researcher should be free to disclose it on their normal timeline, and not be bound by an NDA.

There have been numerous examples of security researchers being burned by this.  They discover something they think is serious, they submit to HackerOne, the vendor disagrees with the seriousness, the researcher discloses over HackerOne's objections, the bug is only then reclassified and addressed by the vendor due to public pressure.  Meanwhile, because the researcher violated HackerOne's NDA, their reputation is harmed.

HackerOne must show allegiance to the researchers, not the vendors.  This loophole must be fixed.
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
3/30/2020 | 6:42:35 PM
Alarming
Voatz not painting itself in the best light here. Outside of convenience a close second in priority if not on the same tier with convenience is integrity (CIA). So if you fail to see the importance of security as a voting mobile platform you are really missing the mark.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20834
PUBLISHED: 2020-06-04
An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures.
CVE-2019-20835
PUBLISHED: 2020-06-04
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.
CVE-2019-20836
PUBLISHED: 2020-06-04
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive.
CVE-2019-20837
PUBLISHED: 2020-06-04
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures.
CVE-2019-20823
PUBLISHED: 2020-06-04
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.