I just thought how people will consider it – finding vulnerabilities in popular local sites and disclose them here in my site. The practice of security vulnerabilities publicly is not common in our country but it’s a criticized good idea as because when it focuses in public attention they (owner of the site, software companies who developed that) focuses on improving the security.
There’s a debate, some people believe when a vulnerability is found, the discoverer should keep it secret so that bad people cannot know about it and thus cannot harm the innocents. How funny, do you think the hackers cannot discover vulnerabilities on their own? Yes, they can.
As a consumer, would you shop from a site where there is risk having your credit card stolen by other users? Assuming that, you know the process of stealing credit card information from that site is a very very complex work. Still will you go for shopping in that site using your credit card? No, you won’t.
Now think about the software company who developed that shopping site. Somehow (privately) they got to know about that security threat, they investigated it and realized that it will take significant amount of time and money to fix. What do you think, they will fix it immediately? You need to understand the software business. In many instances, many software companies do not take the liability after delivering the software (I have doubt in the culture of suing for major software faults/damages is yet to be grown up in our country). Well, many companies will ignore this considering the amount of time needed to fix and deliver it to its clients for free as a fix.
On the other hand, if someone announces this hole publicly the owner of the site as well as the software company who developed it will try to fix it immediately for a good number of reasons, you know. So if we, the user community, want software vendors to patch vulnerabilities we will have to come forward. Imagine the number of security patches delivered by Microsoft after releasing their browser versions. Not all the security vulnerabilities are discovered by Microsoft guys, a good number of contributions by security researchers and hackers.
Disclosing vulnerabilities publicly works maximum times but that doesn’t mean that silent reporting is too worthless. Basically the software companies do not like this (disclosing publicly), they want it privately so that they can keep their goodwill intact.
By the way, the title of the post is regarding a XSS hole in prothom-alo.com (The most popular newspaper’s online version in Bangladesh). It’s in the search box. Here are the steps to reproduce:
- Go to http://www.prothom-alo.com/
- Note there is is a search box in the right side which reads কি জানতে চান? Write this text
' onMouseOver='alert("XSS") in the search box and hit the search (অনুসন্ধান) button.
- Look at the search result page, nothing found (আপনার অনুসন্ধান বিষয়টি পাওয়া যায়নি). See at the middle of the page the search box is there which is empty.
- Take the mouse over the search box and see an alert reads ‘XSS’