Why Microsoft was wrong to silence Bing cashback whistleblower

Davey Winder
Wednesday, 11 November 2009 14:41

Your IT - Home IT

If someone spots a potentially costly security hole in your product would you say thanks and fix it, or send in the lawyers? Microsoft opted for the latter, and it was absolutely wrong on this occasion to do so.

Anyone remember the media fanfare that accompanied the launch of the Microsoft Bing search engine last year? Much of it concentrated on the silly Google Killer angle, but a fair chunk was about the user bribery angle.

Essentially, in order to get people to at least come and try the new search engine Microsoft introduced a cashback system which allowed searchers to earn money for every product they purchased when shopping online through Bing.

Unfortunately, and unbeknown to Microsoft, it would appear that there was something of a security hole in the cashback system which potentially left the company open to fraud on a major scale. Nobody likes lawyers, but is it really suprising that Microsoft resorted to using them so quickly in this case? I think so, and am happy to explain why if you will bear with me.

Bing users could, courtesy of a flaw in the software API, create fake transactions to Bing which would go totally undetected by Microsoft. It is not known at this time if anyone has been actively exploiting the vulnerability.

However, one user certainly spotted it and not only worked out how the cashback system could be exploited but went ahead and exploited it, publishing an account on his blog. Samir Meghani said that while he had never actually bought anything using Bing Cashback "the balance of my account is $2,080.06" and called it an "obvious flaw".

What Meghani did not do was show the method of the exploit, indeed he said in a now withdrawn posting "I'm not going to explain exactly how to generate the fake requests so that they actually post, but it's not complicated". Which does not sound like a hacking guide to me.

So why did Meghani withdraw his post and what did the Microsoft legal team actually say? More on page 2...

CONTINUES ON NEXT PAGE