#ResponsibleDisclosure

JayeLTeeOh, and there are over 1 billion info-stealer records exposed at the moment between a couple of IPs. This is so common, I'm surprised this was even on the news in the last few weeks for a rather small server.180 million is really on the low end of what usually shows up exposed. I've seen servers with over 3.5 billion logs running before being wiped by wiperware.<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/readyouremail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#readyouremail</a>

JayeLTeeSome wild things I found exposed recently that I am actively trying to close down:1) 🇺🇸 Criminal Defense firm with archived case files exposed (evidence, discovery, court docs, etc) includes crash reports with dead people - Contacted the Law firm last week and nothing done.2) 🇺🇸 Phone extracts for multiple cases that have been on the news, including a case of a cop suicide, sexual abuse cases - Looking at who to notify about this one, being extra careful as the file listing suggests illegal stuff gathered as evidence might be exposed on it.3) 🇳🇿 A database backup with a table that includes someone's diary, with a lot of entries about their sexual life. This backup also includes ~1,500 logins for a police association on other tables and credentials to multiple companies & websites - Contacted higher-ups in the police association for help identifying who is responsible, but so far, no reply.Just a few more servers to add to the list of dozens of pending cases. Will start escalating contacts until stuff gets fixed. <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/readyouremail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#readyouremail</a>

Ge0rGWhat's the new / current place for publishing vulnerability reports (as part of responsible disclosure; I already got a CVE ID)? Last time I published something, BugTraq still was a thing. :BoostOK:<a href="https://chaos.social/tags/FediHelp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediHelp</a> <a href="https://chaos.social/tags/AskFedi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AskFedi</a> <a href="https://chaos.social/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> <a href="https://chaos.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a>

kantorkelHappy Birthday (nachträglich) zu drei Jahren <a href="https://23.social/tags/Datenleck" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datenleck</a>, lieber Tuev Nord<a href="https://lims.tuv-nord.co.th/main_app/.env" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lims.tuv-nord.co.th/main_app/.env</a> https://185.39.106.141/main_app/google-credential.json https://185.39.106.141/.git/configinetnum: 185.39.106.0 - 185.39.106.255 netname: DE-TUEVNORD-H-106<a href="https://23.social/tags/responsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibleDisclosure</a> <a href="https://23.social/tags/disclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#disclosure</a>

JayeLTeeLooking for some help, boosts appreciated: Anyone with a security contact at Disney or ABC Network?I know Disney has a bug bounty program, but the issue is with a third-party software leaking data from multiple companies. Found no information as to who owns the software online and would like some help figuring out who to notify.<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/disney" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#disney</a> <a href="https://infosec.exchange/tags/abc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#abc</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/bugbounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bugbounty</a>

Dissent Doe :cupofcoffee:<a href="https://infosec.exchange/@JayeLTee" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JayeLTee</a> Just to add some context about my attempt to get Mango's Place to lock down their data back in 2022:I had been contacted by a researcher with info on the exposed data. Because that researcher was not in the U.S., I followed up on unsuccessful notifications with a phone call. I even made a note of who I spoke to in August 2022. But alerting entities to their leaks is not my job, and when they didn't get back to me, I eventually forgot about them. I had waited to report anything because -- unlike a site that all-too-often reports on leaks that are still exposed --- I didn't want to publish about a leak where the still-exposed data had their name in the storage location's URL. Whether Mango's Place will get sued by any irate parents remains to be seen. If they are, their failure to respond in 2022 may become part of any case. <a href="https://infosec.exchange/tags/databreach" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#databreach</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

H.Lunke & SockeImmer noch eins meiner liebsten T-Shirts <a href="https://darmstadt.social/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a>

Brian Greenberg :verified:🔒 How to Report Security Issues in Open Source—ResponsiblySecurity flaws happen—but how we handle disclosure matters.In this smart and timely guide, Jacob Kaplan-Moss outlines the three-step process for responsible vulnerability reporting in open source software (OSS):✔️ Report the issue privately to maintainers ⏳ Allow a reasonable time frame (up to 3 months) for a fix 📢 If needed, publicly disclose to protect usersKaplan-Moss also explains how to find contact info, the ethics of disclosure timelines, and tools available to OSS maintainers.This is must-read content for anyone in security, development, or open source governance.👉 <a href="https://jacobian.org/2025/mar/27/reporting-security-issues-in-oss/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://jacobian.org/2025/mar/27/reporting-security-issues-in-oss/</a><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DevSecOps</a> <a href="https://infosec.exchange/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a>

Dissent Doe :cupofcoffee:Great thanks to <a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@adamshostack</a> for getting people together to think about this issue and to make recommendations to <a href="https://infosec.exchange/tags/HHS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HHS</a> under the <a href="https://infosec.exchange/tags/HIPAA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HIPAA</a> Security Rule. <a href="https://shostack.org/blog/security-researcher-comment-on-hipaa-security-rules/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shostack.org/blog/security-researcher-comment-on-hipaa-security-rules/</a>Direct link to comments to HHS by <a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@adamshostack</a>, <a href="https://infosec.exchange/@dykstra" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dykstra</a>, Fred Jennings, Chloé Messdaghi, and me:<a href="https://downloads.regulations.gov/HHS-OCR-2024-0020-4673/attachment_1.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://downloads.regulations.gov/HHS-OCR-2024-0020-4673/attachment_1.pdf</a><a href="https://infosec.exchange/tags/GoodFaith" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoodFaith</a> <a href="https://infosec.exchange/tags/SecurityRule" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecurityRule</a> <a href="https://infosec.exchange/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> <a href="https://infosec.exchange/tags/VDP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VDP</a>

Jan Wildeboer 😷:krulorange:<a href="https://social.wildeboer.net/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> also means to share if you have been diagnosed with an infectious disease while at or after an event or conference, ideally posted in a way that as many possible visitors of said event will notice (e.g. post here with a hashtag of the event, like <a href="https://social.wildeboer.net/tags/FOSDEM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSDEM</a>). There is no embargo on sharing such a vulnerability ;)

Dissent Doe :cupofcoffee:If you haven't read this post by <a href="https://mastodon.green/@gcluley" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@gcluley</a> about a proposed Turkish law and you are a researcher or journalist reporting on breaches, read it:New Law Could Mean Prison for Reporting Data Leaks: <a href="https://www.tripwire.com/state-of-security/new-law-could-mean-prison-reporting-data-leaks" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.tripwire.com/state-of-security/new-law-could-mean-prison-reporting-data-leaks</a><a href="https://infosec.exchange/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> <a href="https://infosec.exchange/tags/research" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#research</a> <a href="https://infosec.exchange/tags/journalism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#journalism</a> <a href="https://infosec.exchange/tags/freepress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freepress</a> <a href="https://infosec.exchange/tags/censorship" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#censorship</a> <a href="https://infosec.exchange/tags/intimidation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#intimidation</a>

Jan Wildeboer 😷:krulorange:FTR. I still believe in <a href="https://social.wildeboer.net/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> with a 90 day limit after the first acknowledged receipt. If the company/government/organisation won't move 90 days after they've acknowledged receiving your info, you should be free to go public. But going 0day is a different story.

Dissent Doe :cupofcoffee:<a href="https://infosec.exchange/@JayeLTee" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JayeLTee</a> This is why sometimes it's not enough to just disclose responsibly to an entity. Did you let the data protection regulator know that although the entity is claiming 4-day exposure window, your research found it was almost a year? And did you tell the data protect regulator that the entity is reportedly telling some departments that their data was not exposed, when you found clear proof that it was? <a href="https://xn--baw-joa.social/@lfdi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@lfdi</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/transparency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#transparency</a> <a href="https://infosec.exchange/tags/accountability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#accountability</a> <a href="https://infosec.exchange/tags/dataprotection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dataprotection</a> <a href="https://infosec.exchange/tags/misconfiguration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#misconfiguration</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

chris@strafpla.net<a href="https://chaos.social/@cccpresser" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@cccpresser</a> Der in Deutschland politisch gewollte <a href="https://mstdn.strafpla.net/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> Prozess ist offensichtlich: 1) 4chan. 2) There’s no step 2. (Hat <a href="https://mstdn.strafpla.net/tags/ModernSolution" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ModernSolution</a> eigentlich Kunden und ab wann ist es fahrlässig, einer Firma mit dieser Expertise (Datenbank-Passwort für alle Kunden im Executable) PII anzuvertrauen?)

Kevin Karhan :verified:<a href="https://social.bund.de/@bfdi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bfdi</a> <a href="https://gruene.social/@weddige" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@weddige</a> <a href="https://infosec.exchange/@JayeLTee" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JayeLTee</a> <a href="https://social.bund.de/@BayLfD" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@BayLfD</a> Q: Any estimates on how long that can take?Cuz if it was me <a href="https://infosec.space/@kkarhan/113345431225819955" rel="nofollow noopener noreferrer" target="_blank">I'd escalate this</a> and make it the problem of the participants to sort out who's responsible...Cuz <a href="https://infosec.space/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> is done with that...

Wladimir MuftyDon’t be a <a href="https://social.edu.nl/tags/zendesk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#zendesk</a>👎 <a href="https://social.edu.nl/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> 👎 <a href="https://social.edu.nl/tags/bounty" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bounty</a> 👎 <a href="https://social.edu.nl/tags/bug" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bug</a> 😂 <a href="https://social.edu.nl/tags/outofscope" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#outofscope</a><a href="https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b9d2cf2e52</a>

Dissent Doe :cupofcoffee:It's particularly frustrating when the big tech firms don't respond appropriately to alerts. <a href="https://infosec.exchange/@JayeLTee" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JayeLTee</a> tells me he reported a server with 2.1B infostealer records hosted on Microsoft servers to <a href="https://cert.microsoft[.]com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://cert.microsoft[.]com</a> -- which is the URL listed in the WHOIS to report illegal content. His case came back within an hour as closed but they didn't do anything! He's trying abuse@microsoft[.]com now. Anyone at <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> reading this: c'mon folks, respond appropriately to notifications like this. <a href="https://infosec.exchange/tags/infostealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infostealer</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a>

Dissent Doe :cupofcoffee:"Italy, exposed database puts dental clinic patients’ data at risk: " <a href="https://www.suspectfile.com/italy-exposed-database-puts-dental-clinic-patients-data-at-risk/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.suspectfile.com/italy-exposed-database-puts-dental-clinic-patients-data-at-risk/</a><a href="https://infosec.exchange/@amvinfe" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@amvinfe</a> followed up on some findings by <a href="https://infosec.exchange/@chum1ng0" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@chum1ng0</a> and they tried to get two entities to lock down exposed data that includes personal information. Despite repeated notifications, the data are still not locked down, it seems. <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/incidentmanagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentmanagement</a> <a href="https://infosec.exchange/tags/GDPR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GDPR</a>

Dissent Doe :cupofcoffee:<a href="https://infosec.exchange/@JayeLTee" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JayeLTee</a> Nice work on your part. It's a shame that too many entities don't even say a simple "thank you" to those who try to alert them to a leak or situation. And, of course, how many of those who don't even acknowledge will ever disclose a leak or breach on their own? <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/transparency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#transparency</a> <a href="https://infosec.exchange/tags/gratitude" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gratitude</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/responsibledisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#responsibledisclosure</a> <a href="https://infosec.exchange/tags/govsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#govsec</a>

Kevin Karhan :verified:<a href="https://veganism.social/@MichalBryxi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@MichalBryxi</a> Just communicating with them as a Sysadmin that prevented said scammers from attacking one's systems will get them moving...But based off <a href="https://chaos.social/@Lilith" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Lilith</a> 's own experiences doing <a href="https://infosec.space/tags/ResponsibleDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ResponsibleDisclosure</a> LEAs and <a href="https://infosec.space/tags/TechIlliterate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliterate</a> <a href="https://infosec.space/tags/judges" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#judges</a> can be insultingly stupid...

Recent searches

Search options

Administered by:

Server stats: