Hacking Magento eCommerce For Fun And 17.000 USD

[Egidio Romano <research () karmainsecurity com>]

Hello list,

Tonight I'd like to share with you my latest blog post. Seeing my personal experience with the
Magento bug bounty program (and even experiences from other security researchers), it looks like
they truly believe in a "security through obscurity" methodology. I'm quite disappointed by the
fact they tried to downplay the severity of my vulnerabilities, silently patching them after
several months, without letting me know their progresses. However, what really disappoints me
is that my vulnerabilities seem to be quite critical, specially considering they're the only two
classes of security bugs they're willing to pay up to 10,000$ under their bug bounty program.
I had to ping them several times in order to get my bounties, so I believe they tried to "obscure"
and unevaluated my findings not only because of their "security through obscurity" methodology,
but probably because they were also hoping I'd never noticed their advisories with my name and
the vulnerabilities I reported, and never claimed my bounties for such findings?

Link: http://karmainsecurity.com/hacking-magento-ecommerce-for-fun-and-17000-usd

Best regards,
EgiX

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/