by Serguey Shinder
In January 2024 a security researcher we had never heard of published a short post about a flaw in our trade ordering site. I will not describe it beyond saying that it was real, it was ours, and once we knew, the fix took two days. She had been careful. She named no customers, published no working steps, and closed with a paragraph saying she had reported it to us in August and heard nothing in five months.
She had. We found her message within an hour. She had used the contact form on our website, because it was the only way in she could find, and the contact form went to a shared sales inbox. Somebody there had read it, reasonably concluded it was not a sales enquiry, and left it where it was. She followed up twice. The second follow up asked, politely, whether there was anybody technical she could speak to. There was nobody that inbox knew to forward it to.
For those five months the flaw was known to at least one person outside the company and to nobody inside it. We have no evidence it was used. We also have no way of proving it was not, which is the sentence I had to say to three of our largest customers that week.
What I found hard to accept is that nothing had failed. Every person in that chain did something sensible. What was missing was a door. We had spent years on reviews, scanning and a penetration test every spring, and all of it assumed that we would be the ones who found our problems. There was no route by which somebody outside, who had found one for us and for free, could hand it over and know that it had arrived.
The door, once we built it, was small. A published security contact on the website, where researchers look for one, going to an address read by two named engineers rather than a team. An automatic reply promising a human response within three working days, and a rota that keeps the promise. A short page saying what we will and will not do to people who report in good faith, written with our lawyer, because a researcher's first worry is being threatened, and in 2024 we could not have told her she would not be.
In the eighteen months since, it has received forty one reports. Most are noise. Four were real, and one was more serious than hers.
A penetration test tells you what one firm found in two weeks of looking. The number of people looking at a public system at any moment is far larger, some of them would tell you if you let them, and whether you hear from them is decided long before anybody finds anything. For five months ours was decided by a sales inbox.
– Serguey Asael Shinder
Leave a Reply