full-disclosure - SPAM, credit card numbers, what would you do?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1066152427.13435.89.camel@tantor.nuclearelephant.com>
From: jonathan at nuclearelephant.com (Jonathan A. Zdziarski)
Subject: SPAM, credit card numbers, what would you do?

This must be a piece of software, because I ran into the same exact
thing a few years back on "the guys" websites...e.g. radar-guys.com,
telephone-guys.com, radio-guys.com, cordless-guys.com, etc.  The file
'order.txt' which carried all the credit card numbers and order
information.  This file was dumped daily.

I decided to play good Samaritan and notify them to alert them of this
problem, but since they didn't bother responding I took it upon myself
to notify all the individuals on the list.  Many of them were grateful
and very pissed at the guys.com...many immediately canceled their credit
cards and their orders.  They finally changed it about a month
later...i'm sure they probably just renamed it to orders2.txt or
something lame, and dropped an index.html file in the directory.

Anyway, I don't go around looking for things like this, but if it were
me I would sure love to be notified if my credit card info got out
there.  You reap what you sow.