RE: Consulting Question

["Simmons, James" <jsimmons () eds com>]

I wont mention about how what you said was wrong since others have
already commented. But for your disclosure I would suggest 3com's Zero
Day Initiative, if in fact what you found was a zero day.
http://www.zerodayinitiative.com/ 
If you found an existing exploit with their site, then I would be very
careful in how you approach this. It really depends on how you found it
(i.e.. some google hacking). Or were you illegally scanning this
companies systems? If it was a google hack, then an argument can be made
that it is public knowledge and thus you COULD be shielded from legal
action. (Of course this is theoretical, as the company can sue you just
because ... See MPAA and RIAA lawsuits for references.) 
Personally, I really wouldn't mention it to the company (unless you are
proof positive of your legal standing), and just solicit them for your
services like a professional.


Regards,

Simmons

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of sammons () cs utk edu
Sent: Tuesday, May 08, 2007 2:32 PM
To: security-basics () securityfocus com
Subject: Consulting Question

Hello All,

  I would like to get my feet wet doing some general security
consultation work (network audits, penetration testing, etc.). My
questions concerns a proper approach to potential clients. Consider this
situation, I have found a few vulnerabilities in the company's web
application product that could lead to potential identity theft and
system compromise. This being a relatively large company, how would one
go about informing the company about this vulnerability without them
leaving you 100% out of the equation?

  In the case that the company is not interested in further third-party
assistance I have a second question (concerning credit for finding such
vulnerability). What is the proper/ethical protocol for publishing a
software vulnerability? Are there any other methods that would insure
credit while protecting the company from mass exploitation? I thank you
in advanced for your input.

Best Regards,

Chris