HexBrain

HackerOne · Report #97377

Hackerone impersonation

Validstatus
3upvotes
2 Dec 2015disclosed

Summary

We were not blacklisting some of the handles that we use for social media (specifically, 'hacker0x01'). As such, a user might be able to convince somebody that he/she was actually a member of HackerOne staff by registering that username. We have blacklisted the specific handle in question. We will not be attempting to claim every possible variant, however, as that would never end (and we won't consider any such reports eligible).

How it was found

You should restrict users to create user profile named "hacker0x01" because it represents 'hackerone' everywhere. Any user can create a profile named "hacker0x01" although he/she is a completely different user. This way user can potentially impersonate hackerone.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original