Password manager report gets researcher booted from Bugcrowd

"We are always happy to discuss feedback and suggestions with the researcher as well as to discuss reinstatement," Bugcrowd said.

The author of newly-published research that examines flaws in password managers has been kicked off Bugcrowd, a popular vulnerability-reporting platform, after one of the companies named in the research reported the author for violating Bugcrowd’s terms of service.

Bugcrowd shut down Adrian Bednarek’s account after he violated the company’s rules on “unauthorized disclosure” by telling a reporter about a vulnerability in LastPass, a password management service. The vulnerability is an old bug that another researcher had already reported, but hadn’t been fixed.

According to a disclosure timeline he shared with CyberScoop, Bednarek found himself banned from Bugcrowd on Feb 12., a day after he said he spoke with The Washington Post for a report that his consulting company, Independent Security Evaluators (ISE), ultimately published Tuesday. Bednarek had reported the vulnerability to Bugcrowd on Jan. 19. After being told it was a duplicate, he raised concerns that the bug still hadn’t been fixed.

Bednarek told CyberScoop he wants to be reinstated and help improve the platform’s terms of service.

“I’m going to reach out to [Bugcrowd] and clarify the situation and hopefully work with them” to help make the disclosure rules clearer, he said Tuesday.

Despite the behind-the-scenes kerfuffle, LastPass on Tuesday released a patch for the vulnerability, which the company said affected a legacy application that accounts for less than 0.2 percent of LastPass usage. If exploited, the Windows-based vulnerability could allow an attacker to recover a LastPass user’s master password from a computer’s memory.

Bednarek conceded that he had violated Bugcrowd’s terms of service, but complained that they were overly broad and could be used to unfairly ban researchers.

“If these issues got past this firewall of these third-party bug-platforms and they reached the companies, they might take some issues more seriously,” he said. “I think some information can get lost in the whole process of using a third-party platform.”

For Bednarek, the episode pointed to a broader industry issue: despite progress, the process by which researchers report software vulnerabilities to organizations is still generally “a gamble,” he said. “Sometimes it goes smoothly, sometimes there’s a lot of friction.”

A LastPass spokesperson said the company “is fully supportive of responsible disclosure of vulnerability reports” and has been “working with dozens of security researchers through Bugcrowd for many years.”

Since its founding in 2012, Bugcrowd has emerged as a widely-used clearinghouse for companies to learn about and fix their network vulnerabilities. The San Francisco-based company boasts big corporate clients like Hewlett Packard and Mastercard.

In response to Bednarek’s comments, Bugcrowd Chief Security Officer David Baker told CyberScoop: “We are always happy to discuss feedback and suggestions with the researcher as well as to discuss reinstatement.”

Tuesday’s research, which covered vulnerabilities in four other credential-storing services, doesn’t change the fact that security experts, including Bednarek recommend using password managers as a means of avoiding duplicate passwords that can fall prey to hackers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure