The DMZ

7:33 AM

microsoft.github.io/mu

new open source UEFI BIOS by Microsoft

looks interesting

"This is the same code used today on many of Microsoft's 1st party devices and it will be kept current because it must be to continue to enable shipping products. "

8:17 AM

Hi folks. I don't know if it's off-topic so I ask it here first, and will create a question on main website if it's good enough, but here it is : I discover in a small website an sql dump, accessible by anyone (there is no link from the main website to the sql dump file, but you don't need any administrator right to acces the sql dump file)

the website itself is not use anymore, but it still have data about hundreds of customers, including (non-hashed) passwords

I smell a legal question here ?

It's a small association of local farmers who sell their products directly to costumers, and I don't want to warn them

well, basically it's "What can I do"

Oh. -5pts for M'vy.

I already send them an email telling that I saw their sql file, and that Im ready to help them if they want

but if I don't have answer, what is the next step ?

What's the goal. Remove the dump or warn about password being compromised ?

8:21 AM

well, both

I'm probably the first to see the dump, and you reaaly need to want it to find it, but still, it's accessible

the best scenario would be to remove the dump as soon as possible, and then to hash all the passwords

ideally, they should also warn their customer that their passwords weren't protected

Well, this would probably fall into the 'responsible disclosure' category. Which is a grey area in many countries

well, as I have the email adres of all customers, I could send an email to everyone

8:39 AM

can you overwrite data in the dump @Kepotx?

no, it's just e text file

I don't try sql injection though

no, sql injection don't seem to work (at least simple one)

you can inform law enforcement anonymously

sure, but wouldn't that harm the association?

8:57 AM

what harms the association is a freely accesible sql dump with user data

there are other people here who have more experience with responsible disclosure

if you have tried to contact them several times and they did not react then it is time to use other means

because their users also have a right to be protected and right now, they are not

Benoit Esnard

9:26 AM

@Kepotx: ssi.gouv.fr/en-cas-dincident/…

The French government has an official page about responsive disclosure

thanks

Benoit Esnard

I never tried it, so I'm not sure if you'll ever get a reply

@TomK. I just send an email monday to a farmer, I don't even know if they handle the website themselves. I will wait a little more and try to warn other people before warning all the users

Benoit Esnard

Have you checked the WHOIS to know who handle the website?