If a White Hat researcher discovers a vulnerability in a software product, what should she do with the information?
A) Create a tutorial complete with screenshots and submit the finding to digg.com and slashdot.org
B) Call the vendor and offer to keep quiet if they pay you a finder's fee
C) Prove the exploit works, then sell a script on eBay
D) Report the vulnerability to a regional emergency response organization

Question

Quizplus · Accepted Answer

Reporting vulnerabilities can be tricky. There is a fear of retribution for doing the research in the first place, there is the desire to be given recognition and credit, there might be financial incentives for using the exploit, and there is always leverage; trying to force the vendor to respond under threat of full disclosure. The question specified "Whitehat" and CERTs often provide a way to report vulnerabilities in a way that reduces risks to all parties as much as possible.

If a White Hat Researcher Discovers a Vulnerability in a Software