I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed.
The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?
Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???
Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.
Just formally ask the company, if they don't want you to they will tell you. Could be worth including a pitch of sorts ('Hey, Ive noticed a few problems using your site...') but MAKE SURE you don't incriminate yourself. Do NOT show evidence of you 'reverse engineering' anything.
Do not do anything without gaining permission, as there's a very good chance you're going to run into their legal team.
I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).
> HTTP with their own half-baked hardcoded AES key in app for sending credit card info.
You mean, no TLS, JavaScript crypto and credit card info?
Are there no authorities to report that kind of garbage? No certification they are supposed to pass? I would research that angle first before hacking. It doesn't take any reversing to realize everyone can pwn you on a public WiFi.
The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?