search

disclose / research-threats

Collection of legal threats against good faith Security Researchers; vulnerability disclosure gone wrong. A continuation of work started by @attritionorg
https://threats.disclose.io/
Creative Commons Zero v1.0 Universal
292 stars 19 forks source link

MIT threatened to sue after I reported a security vulnerability #27

Closed D4stiny closed 3 years ago

D4stiny commented 3 years ago

Thought I'd open a new issue regarding my experiences with the Massachusetts Institute of Technology four years ago. I had found an exposed WordPress debug log that had been recording for about a year when I found it (4GB+ of data). All PII has been removed except my own, which is already publicly available.

The legal threat: image image

My email to the head of MIT's IT department: image

MIT's IT Head response: image

Follow-up from original staff member encouraging that I stay away from security: image image

sickcodes commented 3 years ago

Wow! That's an interesting chain of email. What department at MIT?

Interestingly condescending individual that you spoke to 😂 have you told that individual you are now working at Zoom?

D4stiny commented 3 years ago

@sickcodes It was MIT's Information Systems & Technology (IT) department. I have not told them of my success, but I have considered it.

sickcodes commented 3 years ago

You should, would be a cool follow up. Do they have a GitHub? It would be nice to tag them so they have a chance to PR too

D4stiny commented 3 years ago

The specific staff member that sent the threat/final reply does have a GitHub account, but it's not linked to an MIT IT team I can tag. Even if they were in the wrong, I am not interested in doxing them.

sickcodes commented 3 years ago

Neither am I, and that's not what we're about either, but if you wanted to privately ping them, or I could if you're too busy, just thought they maybe would be interested in a response given it's been a hot minute.

sickcodes commented 3 years ago

Do you mind if I compile these into a PDF?

sickcodes commented 3 years ago

Fixed in https://github.com/disclose/research-threats/pull/30

https://github.com/disclose/research-threats/blob/MIT-D4stiny/goodies/MIT_threatened_to_sue_after_I_reported_a_security_vulnerability_%2327.pdf