Vulnerabilities and employability

Question

I am a web developer.

If I find a vulnerability in a prospective employer's website and notify them of it at the same as I send my (unsolicited) application, am I more likely to get the job? Less likely? Why?

Answer 1

Employers are notoriously fickle about their reasons for hiring people. They could be very impressed and grateful, or suspicious that you were probing their website. It's a crapshoot.

Personally, I would tell them anyway. Good employers will recognize the initiative, honesty and resourcefulness for what it is.

Answer 2

Depending on what you sent them and how you communicated it I could see either being possible. To give a bit more of an elaboration on a couple of scenarios:

• If the notification is of the form, "You suck because I could do this!" where you aren't helpful in pointing out how you found the issue or offer any ideas on how to fix it but just leave a general vague negative statement at the company then I could see them being pretty ticked and you would be less likely to be employed.

• If the notification is more diplomatic and you end up helping them solve the problem in a way that demonstrates skill, a good work ethic and excellent communication skills then you may have a better chance because of that experience.

Thus I'd say it depends on how you handle it and how they see it. If they think you may have introduced the vulnerability then you could be in deep doo-doo.

---

Abusing the FTP and So You Hacked Our Site!? would be examples of articles where a business person didn't quite understand what kind of problems can exist if someone can do what they aren't supposed to do. Course some may just see this as paranoia. :)

Answer 3

Personally I wouldn't bring it up in the application, but I would work it into the interview.

Many questions could lead into something like "For example, I noticed your site allows for [insert security flaw here]", and you could follow up with how you would fix it or past experiences you have had fixing this sort of issue.

Answer 4

Don't bother doing it in the initial contact. The information will get ignored by the company's HR person/internal recruiter anyway because it is not relevant to their objective of sourcing candidates. At that stage you'd just be communicating to the wrong person.

Wait until you are talking to the hiring manager if you are going to do it at all.

Answer 5

If the employer is a good guy, he will talk to you, knowing that you know a lot of his application.

You did research, you used, you exploited his app. You showed a lot of interest in it and this kind of profile is good for employers.

On the other hand, they may claim you're an invasor, a "hacker", a guy who destroy things to get jobs. But you wouldn't like to work with this kind of guy, right? :-)

Go ahead and tell the guy you find a vulnerability on his app. You have nothing to lose ;-)

Answer 6

It might be worth a shot, although I agree with the thought that in a big company, the HR person isn't going to know what to make of it. Instead, mailing the bug, and your resume to the support staff for the site (if contact info is available) might get you noticed.

The next question is good or bad. Here's a few options:

• Submit the problem, a suggested solution, and your resume. Be absolutely sure that your writing is top notch and very clear.
• Be careful that no where in the submission you imply a threat. This is a fine line. Obviously you want to explain why the bug matters and what harm it could cause. But if it sounds like a threat, you are opening yourself up to defensiveness and hositility. For example "nice computer, it'd a shame if something should... happen to it." sounds like a threat when I read it in my mafia voice. Be careful since tone of voice can often be implied.
• Absolutely give the solution, too. Otherwise, you have opened yourself up to the range of extortion and threats - they shouldn't have to hire you to get the answer.