Official Policy: When Security Vulnerabilities in Hacks are Found

[Erwin]

Originally Posted by Paul M

Oh well, it just seems that you are commiting yourselves to removing a hack, and someone spending time on fixing someone elses bug(s), when the author would be quite willing, but was simply away for a few days. Two weeks just seems a more reasonable time.

In 7 days, if there is no response, we will remove the files to the hack - in 7 days a LOT of people may have installed a hack with a security hole. The author can fix it after that and we can always put the files back.

[Reeve of shinra]

I think this is a double edged sword. I kind of agree with everything here but at the same time I think the nature of the vulnerability should be made known to the people that have installed it at least. Perhaps some of them can patch it.

The better question is what if its not a serious vulnerability or if its an issue that would only affect a specific yet minor group? Like say people running the hack on ISS would be vulnerable but on apache it wouldn't or something.

? Like say for instance it only affects a

[Revan]

Originally Posted by Reeve of shinra

I think this is a double edged sword. I kind of agree with everything here but at the same time I think the nature of the vulnerability should be made known to the people that have installed it at least.

It is possible to say "This hack has been removed due to a SQL Injection Vulnerability" instead of saying "This hack has been removed due to a SQL Injection Vulnerability in clancp.php?do=join, where a malformed input (such as [example]) would allow an user to show/modify anything from the database"

I applaud this, and just hope I have managed to fix all holes so this never happens to me XD

[Marco van Herwaarden]

The kind of information on the risk that we give, will be based on the kind of vulnerability.

[Erwin]

Originally Posted by Reeve of shinra

I think this is a double edged sword. I kind of agree with everything here but at the same time I think the nature of the vulnerability should be made known to the people that have installed it at least. Perhaps some of them can patch it.

The better question is what if its not a serious vulnerability or if its an issue that would only affect a specific yet minor group? Like say people running the hack on ISS would be vulnerable but on apache it wouldn't or something.

? Like say for instance it only affects a

We will decide what to tell the users who installed it. You can appreciate the fact that some people may click install but have not installed it just to keep updates of when a vulnerability is found, and then if they know what it is, to take advantage of it.

Members who we trust who contact us may be given full information though. It's a case by case thing - we can't make rules for every case but we can make general protocols.

[Azhrialilu]

Speaking as someone who did have a hack installed on a forum which did have a vulnerability which gave people access to the admincp (obviously keeping this vague because I don't want to upset the person who wrote the hack) I applaud this idea!

[Reeve of shinra]

We then proceed to inform all members who have installed the hack.

If it comes to this step, can this be announced by the staff using the update announcer?

I didnt even notice the journal issue until I was reading through the thread just now.

[Erwin]

Originally Posted by Reeve of shinra

If it comes to this step, can this be announced by the staff using the update announcer?

I didnt even notice the journal issue until I was reading through the thread just now.

Yes, that is how we will do it. Which makes the "Installed" button even more important.

[ManagerJosh]

What about exceptions Erwin, like another party other than the original author(s) step in and provides a decent patch or fix to the problem?

[Erwin]

Originally Posted by ManagerJosh

What about exceptions Erwin, like another party other than the original author(s) step in and provides a decent patch or fix to the problem?

That is allowed and even encouraged.