full-disclosure - Contact BankOne.com ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <261333f10412071508267a804c@mail.gmail.com>
From: dotsecure at gmail.com (Martin Mkrtchian)
Subject: Contact BankOne.com ?

Is this happen to be critical  a vulnerability that you would like to
inform Bank One about?

Posting any information prior contacting BankOne would cause a greater risk.  

Doing so, would be like giving a clue to a fellow hacker. Next thing
you know you have all the Blackhats going to BankOne website trying to
find the same vulnerability that you have found.

Knowing how bright some of them are I wouldnt be surprised if they
find it and exploit it.

This is a problem with many financial websites. Responsibility of
every Risk Assessment Group should be to have proper contact
information availabe to public, for cases like these. Many large
organization websites fail to have this process in place.  They should
have contact information along with their public key.

Martin Mkrtchian

On Tue, 7 Dec 2004 16:11:07 -0600, Owned You <0wnj00@...il.com> wrote:
> Post your issues with BankOne on:
> 
> http://finance.yahoo.com/q/mb?s=JPM
> 
> That may get their attention. Or not; posting here will get the
> attention of the infosec journalists.
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>