RE: Bank Exploit

Unless you opt to keep completely quiet, my next step would be to hire
a knowledgeable attorney.

Doug

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Chris Halverson
Sent: Wednesday, July 25, 2007 5:34 PM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: Bank Exploit

Sign up an email account as one of your not so close "friends" and send
the email on their behalf. :)

You could do so through a 3rd party, reputable security vendor such as
sophos or similar. They might help with the information disclosure.

CH


On 7/25/07, Jax Lion <jv4l1n4@xxxxxxxxx> wrote:
So Jason - what happened to your collegue?

IMHO - I don't think option 2 is a good idea. Questions will come up
such as - how did you discover the vulnerability in the first place.
What were you doing... and it all goes downhill from there.

I don't agree with keeping quiet either...

Is there a medium where we can report the "accidental discoveries"
without risk of prosecution? Like a hot tip line with the FBI or
something.


On 7/25/07, Jason Thompson <securitux@xxxxxxxxx> wrote:
Risky... is this person a security professional?

This has happened to one of my colleagues before as well. There are
two solutions that are possible:

1) Do not reveal this or tell anyone about it. Leave it be. As there

is this heightened sense of urgency among banks to thwart potential
attackers the person could be in trouble with the bank for simply
discovering the issue. It really all depends on the person he or she

deals with there. Not saying it would hold up in court, it likely
wouldn't, but anyone who has the ability to find exploits is
generally regarded in a dim light by those who are uneducated on the
subject.

2) Notify the bank's incident response team / security staff, OFFER
a non-disclosure agreement to them saying that you will not disclose

this to anyone regardless of what actions the bank decides to take
on their vulnerability, and state that this was discovered by
accident and that he or she simply wants to notify them about the
issue and IS NOT seeking ANY SORT of compensation. If they are
notified and it follows with the statement 'I would be willing to
help consult you on the solution for a small compensation' it
instantly becomes extortion and this person will likely be thrown in
jail.

I am not a lawyer by any means, I am simply speaking from past
experiences and what I have seen happen to those who did things the
right way and the wrong way.

Solution 2 is a lot easier if your friend's client works in
information security and holds federal clearances and security
designations. Real ones, not Cisco or something :)

-J

On 25 Jul 2007 13:34:29 -0000, securityz@xxxxxxxxxxxxx
<securityz@xxxxxxxxxxxxx> wrote:
Friend of mine (not me, really) is working with a client of his
who claims to have inadvertently discovered a few web exploits of
several financial institutions. Does anyone have any insights as to how
this guy could bring these to the attention of the organizations
involved without being seen as a hacker? His minimal goal is to help
the institutions, optimally he would like to consult to help them
rectify the issues.


thx

Steve




Relevant Pages

  • RE: Bank Exploit
    ... How about sending them some printed proof or letter of sorts without ... Subject: Bank Exploit ... such as - how did you discover the vulnerability in the first place. ... information security and holds federal clearances and security ...
    (Security-Basics)
  • Re: Bank Exploit
    ... If the bank has an incident response plan most IR teams have the ... such as - how did you discover the vulnerability in the first place. ... is this person a security professional? ...
    (Security-Basics)
  • Re: Bank Exploit
    ... IMHO the only solution is to tell a security community such as a mailing list or SANS or whatever what the problem is a do it anonymously to avoid further troubles. ... As a matter of fact it is the financial institutions responsibility to care about there own security so either they have implemented something so that you could push the information to them either they don't for business/marketing purpose and they should retrieve the information from a public area. ... Subject: Bank Exploit ... such as - how did you discover the vulnerability in the first place. ...
    (Security-Basics)
  • Re: Bank Exploit
    ... Someone who breaks the law has already thought ... > Subject: Re: Bank Exploit ... > You could do so through a 3rd party, reputable security vendor such as ... >> such as - how did you discover the vulnerability in the first place. ...
    (Security-Basics)
  • RE: Security and the Under 30 User
    ... ages, sexes, colors, creeds, succumb -- even the holiest of holy network ... I've been into IT security since I was 12. ... I have friends about my age that have had their bank information ... crowd's attitude towards IT security. ...
    (Security-Basics)