Will they shoot the messenger? Maybe. But if they do then do you really want to be in business with them?
More pragmatically, if they ever had a problem with their website that cost them a lot of money due to such an attack and if it ever came out that you knew about it and did nothing you'd potentially have some liability issues.
Not only is it the right thing to do (to tell them) but you have a professional responsibility to do so.
Bring it up. If it destroys the relationship, better now than when your companies have a closer relationship, so that when they get hacked into next Sunday it hurts you too.
Ethically, I would say you can't just let it be. Your choices should be to notify them personally, or notify them anonymously. I send off emails all the time for things from security holes right down to broken links or images.
I think contact them and explain what a SQL Injection attack is and how to overcome it. and let them deal with the company that developed their website. It will show them that you are looking out for their best interest and I can't see them taking offence, honestly.
This is really similar to the ethical question of "If someone gets hit by a car, do you stop and help and risk getting sued or stand there and watch?"
I'd tell them, but instead of saying "I found a serious security vulnerability in your code", I'd say something like:
"Hey - We got an error message on your web site and I think it may have had some sensitive information in it. Could we take a look at this?" and then walk them through it, gently and carefully.
You do need to tell them, but not in a guns'a'blazin' way.
Send them certified mail (trackable, indicates the issue is important and demands immediate attention, and the paper trail can be useful if they decide to bring problems via their lawyers):
Dear Sir,
Recently we became aware of a vulnerability in your website which may result in interruptions to our service, and possibly data loss or worse. As we depend on (insert product name here) for part of our services, we are interested in this issue being resolved quickly. As such, we recommend the following security services which we have successfully used on our own projects to verify immunity to the most common issues:
(list 2-3 good security auditing firms here)
We periodically request that all vendors submit to third party security testing as a normal course of business, however the urgency of this particular issue is such that we felt it important to alert you immediately.
We appreciate your prompt attention to this matter.
Sincerely, (IT manager, xyz corp)
Don't specify the vulnerability. This will give them a reason to do a full security audit, rather than just sending your concern to the dev guy, fix that one thing, and then claim a clean bill of health. If they ask,
I'm sorry, for our own and your legal protection we aren't allowed to divulge particular details of any security issue to anyone except under NDA and mutual liability waiver. It is of a sufficiently simple nature that a competent security firm will resolve it.
If the product you're using is of a financial nature, then you can simply demand that they submit to a "seal of approval" type program from a major auditing firm (verisign, for instance) and discontinue service without that security audit seal.
You could phrase it in such a way that your company requires all vendors and partners to provide proof that a security audit has been performed. The audit requirements could include a check for SQL injections and you could include an section in your "security requirements document" that links to several informative sites. If they don't respond or acknowledge then you've done your duty in making them aware of the possibility and that by ignoring the issue they've lost your business.
I have been in this situation...and I would say be careful and very tactful.
In my own experience, it was a public web site to which I had no affiliation, and they were wary to the point that they became suspicious of my intentions of letting them know their site was vulnerable (to the extent that credit card info could have been exposed).
Notify them immediately, preferably consulting your corporate lawyers first. A panicked reaction could be a litigious one.
If you do this in an informative, friendlyand helpful manner they may actually look to you to help them solve it, so be prepared to have a response to that too. (Could be good or bad depending if you want hte work, or don't want the messy burden).
I'd share the concern with whomever is the face of your organization with the client. They should decide how to approach and deal with the client that they have the best understanding of.
发布评论
评论（12）
你告诉他们。 时期。
他们会射杀信使吗？ 或许。 但如果他们这样做了，那么您真的想与他们做生意吗？
更务实的是，如果他们的网站出现问题，并因此类攻击而损失了很多钱，并且如果您知道此事但没有采取任何行动，那么您可能会遇到一些责任问题。
（告诉他们）这不仅是正确的事情，而且你有职业责任这样做。
You tell them. Period.
Will they shoot the messenger? Maybe. But if they do then do you really want to be in business with them?
More pragmatically, if they ever had a problem with their website that cost them a lot of money due to such an attack and if it ever came out that you knew about it and did nothing you'd potentially have some liability issues.
Not only is it the right thing to do (to tell them) but you have a professional responsibility to do so.
提出来。 如果它破坏了这种关系，那么现在比你们的公司建立更密切的关系要好，这样当他们下周日被黑客入侵时，你也会受到伤害。
Bring it up. If it destroys the relationship, better now than when your companies have a closer relationship, so that when they get hacked into next Sunday it hurts you too.
从道德上讲，我想说你不能就这样顺其自然。 您的选择应该是亲自通知他们，或匿名通知他们。 我总是发送电子邮件，询问各种问题，从安全漏洞到损坏的链接或图像。
Ethically, I would say you can't just let it be. Your choices should be to notify them personally, or notify them anonymously. I send off emails all the time for things from security holes right down to broken links or images.
我想联系他们并解释什么是 SQL 注入攻击以及如何克服它。 并让他们与开发其网站的公司打交道。 这会让他们知道你正在为他们的最大利益着想，说实话，我不认为他们会生气。
祝你好运
I think contact them and explain what a SQL Injection attack is and how to overcome it. and let them deal with the company that developed their website. It will show them that you are looking out for their best interest and I can't see them taking offence, honestly.
Good luck
这确实类似于“如果有人被车撞了，你会冒着被起诉的风险停下来帮忙，还是站在那里观看？”
我会告诉他们，但我不会说“我在您的代码中发现了一个严重的安全漏洞”，而是说：
“嘿 - 我们在您的网站上收到了一条错误消息，我认为它可能包含一些敏感信息我们可以看一下里面的信息吗？” 然后轻轻地、小心地引导他们完成它。
你确实需要告诉他们，但不是以一种“激烈”的方式。
This is really similar to the ethical question of "If someone gets hit by a car, do you stop and help and risk getting sued or stand there and watch?"
I'd tell them, but instead of saying "I found a serious security vulnerability in your code", I'd say something like:
"Hey - We got an error message on your web site and I think it may have had some sensitive information in it. Could we take a look at this?" and then walk them through it, gently and carefully.
You do need to tell them, but not in a guns'a'blazin' way.
尽快告诉他们。 如果他们不喜欢，他们可能不应该成为你的伴侣。
Tell them ASAP. If they don't like it, they probably should not be your partner.
向他们发送挂号信（可追踪，表明问题很重要并需要立即关注，如果他们决定通过律师提出问题，书面记录可能会很有用）：
不要指定漏洞。 这将使他们有理由进行全面的安全审核，而不是仅仅将您的担忧发送给开发人员，解决这一问题，然后索取一份干净的健康证明。 如果他们问，
如果您使用的产品具有财务性质，那么您可以简单地要求他们提交大型审计公司（例如威瑞信）的“批准印章”类型计划，并在没有安全审计印章的情况下停止服务。
-亚当
Send them certified mail (trackable, indicates the issue is important and demands immediate attention, and the paper trail can be useful if they decide to bring problems via their lawyers):
Don't specify the vulnerability. This will give them a reason to do a full security audit, rather than just sending your concern to the dev guy, fix that one thing, and then claim a clean bill of health. If they ask,
If the product you're using is of a financial nature, then you can simply demand that they submit to a "seal of approval" type program from a major auditing firm (verisign, for instance) and discontinue service without that security audit seal.
-Adam
您可以这样表述：您的公司要求所有供应商和合作伙伴提供已执行安全审核的证据。 审计要求可能包括对 SQL 注入的检查，并且您可以在“安全要求文档”中包含一个链接到多个信息站点的部分。 如果他们没有回应或承认，那么你已经尽了你的责任，让他们意识到这种可能性，并且通过忽视这个问题，他们已经失去了你的业务。
You could phrase it in such a way that your company requires all vendors and partners to provide proof that a security audit has been performed. The audit requirements could include a check for SQL injections and you could include an section in your "security requirements document" that links to several informative sites. If they don't respond or acknowledge then you've done your duty in making them aware of the possibility and that by ignoring the issue they've lost your business.
合法地将您的名字更改为“Bobby”；Drop Table Users；”
然后在他们的网站上注册一个帐户。 这应该引起他们的注意。
警告：以上文字是一个笑话，请勿在家尝试此操作。
Legaly change your name to "Bobby'; Drop Table Users;"
Then sign up for an account on their site. This should get their attention.
WARNING: The above text is a joke, do not attempt this at home.
我曾经遇到过这种情况……我想说要小心并且非常机智。
根据我自己的经验，这是一个我没有隶属关系的公共网站，他们非常警惕，以至于怀疑我让他们知道他们的网站容易受到攻击的意图（在某种程度上，信用卡信息可能会被泄露）被曝光了）。
I have been in this situation...and I would say be careful and very tactful.
In my own experience, it was a public web site to which I had no affiliation, and they were wary to the point that they became suspicious of my intentions of letting them know their site was vulnerable (to the extent that credit card info could have been exposed).
立即通知他们，最好先咨询您的公司律师。 恐慌的反应可能会引起诉讼。
如果你以一种信息丰富、友好和乐于助人的方式做到这一点，他们实际上可能会指望你帮助他们解决问题，所以也要准备好对此做出回应。 （可能是好是坏，取决于您是否想要工作，或者不想要混乱的负担）。
Notify them immediately, preferably consulting your corporate lawyers first. A panicked reaction could be a litigious one.
If you do this in an informative, friendlyand helpful manner they may actually look to you to help them solve it, so be prepared to have a response to that too. (Could be good or bad depending if you want hte work, or don't want the messy burden).
我会向任何代表你的组织和客户的人表达我的担忧。 他们应该决定如何接近和处理他们最了解的客户。
I'd share the concern with whomever is the face of your organization with the client. They should decide how to approach and deal with the client that they have the best understanding of.