Email received regarding Security flaw in website

Question

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc

My initial reaction was that this was a scam. (How/why did they find our site.)

However, they didn't seem to be looking for money (so far) and they also had emailed it from a gmail account (which seemed off to me, spam is usually sent from weird domains) - also google marked it as important.

The overall writing is clearly not well educated, but it isn't as bad as they usually are.

The email address also seemed like a gamer addresses (some weird name and a few digits)

This is the email:

Hello,

I have found a Web Application Vulnerability [XSS] in 'websitename.com' which can lead an attacker to perform unauthenticated tasks like account takeovers and other malicious stuffs like web defacement (your site), port scanning through your servers to other servers on internet or may use your website to spread Ransomware, and this bug is needed to be fixed as fast as possible.

Being a responsible security researcher, I m sending this mail directly to you without making the bug public, so if you are concerned about your website's security and want detailed information and Proof-of-Concept of this bug, please contact me on my mail - email@gmail.com

Would be happy to know - do you provide any rewards (bug bounty) / swag as token of appreciation for reporting bugs ?

Thank you,

-(Foreign sounding) Name

_{Italics have been changed for privacy}

Question:

Is this a typical things that scammers would do?

If so what are they trying to gain, what would be (if any) the risks of replying to the email requesting some more information.

On the other hand, if it is in fact a legit "responsible security researcher" what kind of questions should I ask to find out.

Answer 1

TL;DR: It's probably well-intentioned and not a scam, but just poorly written.

I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website owners for money based on knowledge of website vulnerabilities (and the implicit threat to exploit them), but that doesn't look like the case here.

It's not a very well-written disclosure email. I've certainly stumbled across vulnerabilities before (obviously, attempting to exploit them on a site that hasn't given permission would be illegal, but there are some that can be obvious without attempting exploitation), and sent emails with the same intent as the author above, but I try to provide all the detail in the first email. I want to help. I don't want to bounce back and forth in email land.

If it were me, I would ask them for details: what page (or pages) contain the vulnerabilities, which parameters are injectable, and whether they could share a proof of concept. If you're not familiar with XSS, I recommend reading the OWASP page on the vulnerability. It's both very common and can be critical, depending on the context. A typical proof of concept (PoC) for XSS won't be dangerous to you or your site, but will do something like pop up a javascript alert box containing the hostname of the site, your session cookes, or even just the number 1. Any of those show that a malicious attacker could be running Javascript on your site, which would have significant implications for your site security.

As some have pointed out, it's also possible the lack of information is them playing it "cagey" will looking for a reward/payment. Obviously, if your site does not have a published bug bounty, you're under no obligation to do so.

Answer 2

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from each?

I'd run Nessus (or some other scanner) myself to check, then contact the guy and ask for details. Truthfully answer his question about bug rewards. If you run a bug reward program and he found one, he should get his reward, that's what the program is for, right? If you don't, simply explain that you don't, but are anyway grateful for his heads-up.

Answer 3

This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action.

https://en.wikipedia.org/wiki/Fear_appeal

The email contains the 3 basic stages of fear appeal.

1. present a risk.
2. present a vulnerability to the risk.
3. suggest a protective action.

It is generally considered unethical.

I'm only pointing this aspact out, because the email is an unsolicited attempt to get a response using fear. It's the fact that the sender completely left out the details of what the issue is. You have to contact them to get a response, and they've already stated that they expect a token of appreciation.

When a scammer is fishing for victims they must first qualify a list of possible targets. His/her scam involves fear as a trigger to action, and if you respond you than qualify as a person who reacts to fear tactics.

It's likely they will escalate the seriousness of the problem until a trade can be made for details about the security flaw. He/she will most likely request payment by bitcoin for the information.

A true professional security consultant would have provided full contact details, mailing address and phone number of their consulting services. They also would have mentioned the benefits of their services. Where as, this email only mentions the risk of not responding.

The best approach to handling this email is to contact a creditable security consultant, and hire them to investigate the claims.

Answer 4

It doesn't have to be a scam, but I wouldn't trust the person who contacted you anyway:

• they declare having found a vulnerability but don't present a slightest proof
• they say it's bad enough for you to be at risk but choose to leave you exposed until you contact them
• they ask about a reward before delivering anything

Clearly, you don't want to entrust your online security to those people. If you let them help you with this vulnerability, they will know much more about your system than they do now. If you ever decide you don't need their services, how do you know the next vulnerability they find will not end up on exploits market?

If you website has commercial value, I would definitely ask for help from security experts at you company, perhaps your hosting provider, or even hire someone more credible to do a security audit.

Answer 5

A similar email was sent to one of my clients claiming they had an SSL vulnerability, with an offer to fix. This client does not use SSL, so in that case it was an obvious scam. There are several emails of this type floating around.

Answer 6

I think that the best approach would be to reply back asking if the person who wrote the email has any means of showing that he really does have the ability to gain excessive access to your Internet service.

You could give him permission to exploit your service for non destructive demonstration purposes only, since it's generally considered to be illegal unauthorized access for him to do this even if it doesn't harm anything. After his attack is successful you can talk business.

The law regarding unauthorized access to a computer service in the USA is very vague, does not consider harm done or intent to do harm, and can technically be applied to nearly anything. This may be stopping him from demonstrating his attack even though it would seem like reasonable thing to do.

Answer 7

run a scan on your site and find out for yourself. XSS problems are very common. You can get OSSIM, which is free, and includes OPENVAS, a vulnerability scanner. You can run OSSIM in Virtualbox, or another Virtualization system. Then scan your website's public IP and you'll get a full report.