full-disclosure - SPAM, credit card numbers, what would you do?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031014171815.GI28735@darkuncle.net>
From: lists_full-disclosure at darkuncle.net (lists_full-disclosure@...kuncle.net)
Subject: SPAM, credit card numbers, what would you do?

On Tue, Oct 14, 2003 at 09:48:40AM -0700, tedklugman@...oo.com said:
[snip]
> Lo and behold, I look at the root of said website, and
> I get a directory listing:
> 
> submit.php
> orders.txt
> 
> And as you can probably guess, orders.txt contains --
> ORDERS. Names, addresses, phone numbers, and CREDIT
> CARD NUMBERS. Dozens of them.
> 
> So I got to thinking... what should I do here?
> 
> a) Nothing. It's not my problem.
> b) Notify the provider who hosts the submission page
> c) Send e-mails to all the morons who tried to buy
> this "product" (their e-mail addresses are readily
> available, next to their credit card numbers), letting
> them know that they are morons and this is why they
> shouldn't buy products advertised in SPAM.
> d) Something else
> 
> I chose option a.

I'd've done option c, coupled with an email to the security/fraud division of
Mastercard/Visa/Amex/Discover/etc. But then, I'm feeling altruistic today.
Must be the lack of user interaction so far.

(option b would probably be a complete waste of time. Also, if this had a
criminal/scam feel to it, I'd probably notify the FTC/FBI ... they have
reasonably responsive folks that deal with electronic fraud/scams. Too bad
they don't pay any attention to other kinds of network abuse ...)
-- 
Scott Francis || darkuncle (at) darkuncle (dot) net
      illum oportet crescere me autem minui
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031014/5c73663d/attachment.bin