Re: Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-04 Thread Aaron de Bruyn via NANOG
I had a situation like that a few years ago. Someone accidentally included the .git directory in a docker image that was deployed to a customer's website. Unfortunately early checkins of the .git directory included a copy of the WordPress (yuck!) config file with hard-coded passwords. Those were

Re: Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-04 Thread Joe Greco
On Fri, Mar 04, 2022 at 11:33:47PM +0200, Denys Fedoryshchenko wrote: > This is typical "Beg bounty". > https://www.troyhunt.com/beg-bounties/ This probably isn't even that. I've seen a bunch of similar spam to various role accounts, some at domains that don't even have a website, in the last

Re: Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-04 Thread Denys Fedoryshchenko
This is typical "Beg bounty". https://www.troyhunt.com/beg-bounties/ On 2022-03-03 00:30, Brie wrote: I just got this in my e-mail... -- From: xxx Date: Thu, 3 Mar 2022 03:14:03 +0500 Message-ID: Subject: Found Security Vulnerability To: undisclosed-recipients:; Bcc:

Re: Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-02 Thread Valdis Klētnieks
On Wed, 02 Mar 2022 15:30:29 -0700, Brie said: > I just got this in my e-mail... > I am a web app security hunter. I spent some time on your website and found > some vulnerabilities. I see on your website you take security very > passionately. I've gotten similar spam a number of times over the

Re: Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-02 Thread Kieran Murphy
Better known as Beg Bounties. https://www.troyhunt.com/beg-bounties/ It's a thing. On Thu, 3 Mar 2022 at 09:32, Brie wrote: > > I just got this in my e-mail... > > -- > From: xxx > Date: Thu, 3 Mar 2022 03:14:03 +0500 > Message-ID: > Subject: Found Security Vulnerability > To:

Is soliciting money/rewards for 'responsible' security disclosures when none is stated a thing now?

2022-03-02 Thread Brie
I just got this in my e-mail... -- From: xxx Date: Thu, 3 Mar 2022 03:14:03 +0500 Message-ID: Subject: Found Security Vulnerability To: undisclosed-recipients:; Bcc: sxx...@ahbl.org Hi Team I am a web app security hunter. I spent some time on your website and found some