Looking for a security contact at Webull

Hacker Connect
1

Hello,

A friend of mine on Twitter: @0xBanana is having trouble getting in contact with anyone from Webull. He has identified a privacy issue that I have confirmed as a CVE on their products. Please let us know if you have a contact there.

The timeline:
2/5/2021 - Jason contacts Webull via direct message.

image
image1194×806 116 KB

2/5/2021 - John looks for a security contact with no luck.
2/12/2021 - John sends a public Tweet, urging Webull to contact him. No response.
2/15/2021 - John reaches out again with a public Tweet directed towards Webull.
2/15/2021 - Contact is made with WeBull, the details of vulnerability communication are being discussed.

2

I think the CEO is in the subreddit, here ya go!

https://www.reddit.com/r/Webull/comments/lkpig4/website_security_issue_staff_from_webull_please/

1 Like
3

I don’t see the CEO. I see someone talking about Wendy’s. Kindly point me to it?

2 Likes
4

  1. Try his LinkedIn: https://www.linkedin.com/in/anthonydenier/

  2. Webull Financial LLC is owned by Xiaomi (14%), try https://sec.xiaomi.com

  3. Maybe Contact Saxo's Investment Team | Saxo Group since they may have built some of the app(s)? Fumi Tech | Saxo Group

“Webull is a subsidiary of the multinational Chinese company Fumi Technology. It has more than 9 million worldwide users and estimated assets worth $4 billion across all its customer accounts. The company has a presence in New York and China.” :sweat_smile:

1 Like
5

We received a response through Twitter. We’ve been careful thus far to express the nature and issues involved with the vulnerability and focus on our desire to help other users. As it stands, they are hesitant to put us in contact with the appropriate team until we describe it more. Our next route of action will be described soon.

1 Like
6

For those reading along at home, not putting you through to the right team usually means that the team is 404 irl.

3 Likes
7

Looking for the super-like function on this thing.

2 Likes
8

Update, contacted them via email. They wanted us to get in-touch with the compliance team [lol] did it this morning but no response.

9

Fail, we want the security team not compliance. Take it to the next level and get a third party coordinator, or CERT, or the regulator involved.

1 Like
10

Yeah will likely go through CERT.

11

CERT has been contacted. We asked for permission to disclose to the public upon assignment of a CVE ID.

1 Like
12

Still waiting for CERT to respond.

13

Compliance responded on 2/22/2021 but haven’t responded since, they are taking there sweet time on this vulnerability, we’ve have to jump through hoops to get to this point – we are going to request a CVE ID and drop it to the public if we do not receive response. There’s no risk of doing so; It’s a business logic flaw that has been programmatically placed and does not require any exploitation.

14

The vulnerability is going to be dropped to the public today.

15

Jason has released it to the public. CVE ID still pending:

1 Like
16

CVE may or may not be assigned; CERT is hashing it out with us as MITRE told Jason to go to the SEC…which won’t exactly help the issue get fixed.

17

CVE was not assigned, but issue was highlighted to the public and disclosed responsibly per CERT’s guidance.