full-disclosure - Who Do I Contact?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Apr 24 14:20:52 2006
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: Who Do I Contact?

> I am sorry I am not going to say who the school is.

Have you tried posting to EDUCAUSE or UNISOG (the second is a 
security-only group for .edus). A post there (with the same detail-level 
you already provided, requesting a security contact) -- will probably at 
least find you someone who knows the right person to call.

You can also email the folks at SANS/ISC (isc.sans.org) and they will 
help do the legwork. They keep everything confidential.

I assume you've already tried everything you can find in whois, and 
tried all the generic (security@, abuse@, postmaster@, etc) addresses. 
Also hit their website and find the phonebook (most all publish this 
someplace) and try to search by department and find a title that sounds 
close to what you need.

Most any decent size .edu will all have somebody that can recognize the 
risk and demand it be taken off-line until fixed. Nobody wants to get 
embarrased in the news.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University