It pays to be patient, Rediff awakes!


A surprising series of events:

*Couple of months back I reported XSS and SQL Injection to Rediff. It was painstaking effort as I had to search for the person concerned for security incidents. I connected to him, he happily requested and accepted my advisory.

* No Update from them..the vulnerability still existent.

*No Update from them..the vulnerability still existent.

*.................

*No Update from them..the vulnerability still existent.

* Meanwhile I left the hope of feedback and saw somewhere on the net that there have been already reported XSS about their site. It proved their laxity and negligence. I ignored the issue.

* This month somebody discovered XSS again on Rediff ( like I had, few months ago).

* He posted it on Owasp Delhi Mailing List. I responded to the post and told them about my reporting.

* Nitin Saxena (Owasp Delhi Chapter Lead), urged me to send him the all the communications by me to Rediff and advisory as well. He was willing to take is matter to Rediff's higher authorities. I sent the required things.

*I was still not very much hopeful of any lead until I got a personal mail from Rediff head screwing up his staff to whom I had reported , cc to me and Nitin:

To: Omkar[omkars@rediff.co.in]

CC:Nilesh Kumar (India); nitins@cybermedia.co.in


Hi Omkar,

This news of a vulnerability (weakness) on Rediff site, has been doing rounds in the security fraternity and I am sure you'd like to have this addressed. Nilesh had reported this to Salil a couple of months back as well but it hasn't been corrected as of this morning as well. (see attached)


--
Regards, Sriram


At least my voice got heard!! :)



Comments

Popular posts from this blog

SQL Injection in search field

Nipper Download