Skip to main content

Being the Bug in Bug Bounty :: Fail & Tell

Late in December 2015, I sent the email below to all of "Engineering" across Riot Games. I want to share this externally because it's core to the security culture that we want to build in Riot, i.e. one of accountability and responsibility, where we aren't afraid to talk about our screw-ups.

############################################################
Hey Folks,

So as most of you know, I'm a bit of a perfectionist with high standards :)

Well recently, I screwed up and didn't come close to meeting my own expectations.

What did I do?

Well, when testing (locally) Netflix's Security Monkey in 2014, I copied over some aws-related scripts I was using and found useful to a local directory on  my work laptop, where my Github repo was stored. I also mistakenly copied over a flask configuration file (config-deploy.py) from the local version of Security Monkey that I was testing at the time.

To compound this mistake, prior to committing files and pushing to my Github repo, I performed a "git add" on the sub-directory (aws), not the specific files I'd added. As a result, config_deploy.py was added to the changes to the repo and consequently, committed and pushed up to my personal Github.

What Happened Next?

Nothing for a year until I got a random late-night text from a colleague, nothing unusual there :)
  • Bug Bounty Ticket - xxxx
  • Internal Vulnerability Ticket - xxxx
However, this text was advised me to check our Bug Bounty system. The shear panic and "shit, shit, shit" went around in my head :-/ So unsurprisingly, I immediately logged on to  read the bug report.

What was the impact? 

Fortunately, close to nothing:
  • the file was a test file with no production credentials of any sort
  • we have publicly committed to the Security Monkey repo
  • we have publicly spoke about using Security Monkey
  • sheer embarrassment and annoyance on my behalf
What's the point of this email?
  • I'd like to apologise to you guys for screwing up.
  • To let you know that I've removed the personal repo and modified the controls on any public github repo that's been cloned to my system
  • This researcher was actually very cool (despite initially claiming it was an awesome vulnerability and significant information disclosure).
    • Validation is important on all (vulnerability/bug) reports coming in through our Bug Bounty or any other medium.
  • I feel like I got lucky
  • Run "git status" before "git push origin master"
  • .gitignore doesn't always save you :(
  • I got great support from the InfoSec team on this, which meant a lot and reminded me that we're a team at all times (success & failures).
  • Hopefully others will realise that it's not the end of the world to make mistakes and it's important that we don't try to hide them but share them and learn from them.
If you've any questions or feedback for me, please let me know.
############################################################

This episode was a huge learning experience for me and I believe I can only improve from it (whilst, yeah, I was lucky). It was ultimately a very humbling experience, a nice reminder that we in #InfoSec make mistakes, that we should not be advocating for security from the our perches up high, feeling perfect.

We have a "no asshole" rule and I believe this is one reason (of many) why I had a pretty awesome and very supportive response from many across Riot, a nice reminder that it's often better to talk about your failures than your successes.
Labels:

Comments

  1. Florian Courtial8 May 2016 at 01:20

    Totally true, every time I review code or search for a vulnerability, I am demanding, nonetheless when I found something, I always add "I could have done it, at least now it will be fixed.".

    ReplyDelete

Post a Comment

Popular posts from this blog

Being a Support Engineer @ 10gen - Part 1

There's a mis-conception around the role of a "Support Engineer".  As a clue, it's not what Urban Dictionary   says   - A person whose job is to answer calls from customers of a small- to large-sized company...... They are teathered to a their desk all day via phone headset........ phone jockeys usually hate their jobs.......they are are paid well enough..........until they completely burn out, and hate everyone.   and doesn't always involve this - Image Source: http://half-bakedbaker.blogspot.ie/2009/11/cannoli-and-broken-computer.html As you can see  here , there's lots of open roles in  10gen  and more specifically with 10gen, in  Dublin . I thought I'd write this quick blog to explain what Support Engineers actually do and why I joined 10gen as a "Support Engineer". I could be wrong but didn't Google come up with term " Site Reliability Engineer " to do away with the stigma associated with being a...
Post a Comment
Read more

WAF versus DPI Firewall

This is a question, I've frequently been asked in recent years and in the last month, o n one of the internal mailing lists, in my old company, the following question was posted – In simple terms, what tasks is a Web Application Firewall (WAF) able to do that a Deep Inspection Firewall can't and why ? by one of my colleagues. Many of you may be surprised (I know I was initially) but this question still comes up an awful lot. Having answered the email (as a warning, I went into a lot of detail and plugged the awesome Security Onion ), I was requested to write a technical blog on the subject, but as I left the company soon after, the blog was never published. Therefore, to save me answering the question again, I thought I’d publish it so I can just reference the link in future J
6 comments
Read more

Being a Support Engineer @ 10gen - Part 2

So back in July, I wrote a blog post talking about my experiences being a so-called "phone jockey", i.e. a support engineer, for 10gen. For those cynics out there, it wasn't written by HR, modified by marketing or requested by management or anyone in our recruiting team - I wrote it off my own back because I've a tendency to do things off my own back I wanted to explain what being a "support engineer" actually meant and more specifically, what it entailed in a small, innovative, fun company like 10gen I now have somewhere to point people too when they ask my what life as a "support engineer" in 10gen is like to get kudos within 10gen and please management When I wrote the blog post, I intended it to be a once-off (why would anyone agree to writing a multi-part blog series) but I was encouraged to at least write a second post by @francium and she's very cool so I let it slide and agreed!!! One of the ideas that I had was talking ...
8 comments
Read more