Irresponsible Disclosure

No ratings

Presented at BSidesBristol 2019 by

Dylan Wheeler was a member of the Xbox Underground international hacking group in 2011, the events of which were featured in many articles including Wired USA. Since then he began a career as a white-hat security researcher. Recently, his team at Day After Exploit Ltd discovered a vulnerability in Atrient’s system. The discovery led to Wheeler being allegedly assaulted by their CFO. This demonstrates the issue in the industry when it comes to the treatment of security researchers whose work is vital for the community. To prevent threats, the disregarding of information and further possibility of assault, there needs to be more awareness of appropriate practices for researchers and vendors. How should security researchers communicate and how should vendors respond? There are many common problems to discuss such as what to do when there is no bug bounty program in place and how can researchers ask for rewards from vendors for their hours of work. The world of information disclosure can be treacherous but if handled correctly it can be beneficial to all parties involved.