[FD] Hacking Magento eCommerce For Fun And 17.000 USD

[Egidio Romano <research@xxxxxxxxxxxxxxxxxxx>]

Hello list,

Tonight I'd like to share with you my latest blog post. Seeing my personal 
experience with the
Magento bug bounty program (and even experiences from other security 
researchers), it looks like
they truly believe in a "security through obscurity" methodology. I'm quite 
disappointed by the
fact they tried to downplay the severity of my vulnerabilities, silently 
patching them after
several months, without letting me know their progresses. However, what really 
disappoints me
is that my vulnerabilities seem to be quite critical, specially considering 
they're the only two
classes of security bugs they're willing to pay up to 10,000$ under their bug 
bounty program.
I had to ping them several times in order to get my bounties, so I believe they 
tried to "obscure"
and unevaluated my findings not only because of their "security through 
obscurity" methodology,
but probably because they were also hoping I'd never noticed their advisories 
with my name and
the vulnerabilities I reported, and never claimed my bounties for such findings?

Link: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd

Best regards,
EgiX

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/