I Refused to Pay the Hacker Who Found Our Signup Hole

Protect signup flows from mass abuse before a stranger's extortion email forces you to.

“I refused to pay. It didn't seem valuable enough for a bounty.”

An anonymous email claimed the author had found a vulnerability on the company's website and was ready to use it.

The real hole was an endless signup flow that one person with an old laptop and a script could abuse.

The attacker scaled up to about 20,000 new users within a week, so the team banned his IP to stop it.

I got "hacked."

This was back when I was running engineering, before AI started breaking the internet at scale. Probably a textbook case.

An email arrived: "Dear Gleb, I have found a vulnerability on your website and I am ready to use it."

A few emails later it turned out there really was a hole, just not the one I expected. A guy from Pakistan had found a way to sign up on our site endlessly. No bot farm. An old laptop and some script.

I refused to pay. It didn't seem valuable enough for a bounty.

So he scaled up. Within a week we had about 20,000 new users, and our customer support specialist's phone was blowing up, because it pinged him for every new signup.

In the end we banned his IP, and that was it.

Would you have paid him?

#Security#Incident Response#Signup Abuse

ALSO ON LINKEDIN ↗