Date: Wed, 11 Jul 2007 17:03:33 +0200
From: kazaam <kazaam@...co.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Wachovia Bank website
	sends	confidential	information

I got you right? The one doing just for fun researches is in duty to 
find the correct person and not the company, making big buisness, in 
providing easy access to this person?

Yes you are obviously right ^^


J. Oquendo wrote:
> Valdis.Kletnieks@...edu wrote:
>> On Tue, 10 Jul 2007 21:39:33 EDT, Jim Popovitch said:
>>
>>  
>>> 7 days?   "industry practice"?   Come on Bob I know you know that large
>>> corporations can't feed a cat in 7 days let alone make unscheduled
>>> website changes that fast.  Change control approvals alone would 
>>> include
>>> 14 or more days in most enterprises.   Why the rush to "say so"?
>>>     
>>
>> On the other hand, I think that they *could* manage at least a "Wow 
>> d00dz, we
>> really *do* have a hole there" reply and at least give a handwaving 
>> about
>> when they'd fix it.  Of course, actually *fixing* a design flaw that big
>> is going to take them *months*.
>>   
>
> Driver walks into a dealer and speaks to customer service:
>
> "These brake pads are extremely vulnerable to slipping during X
> conditions on a 90 degree slalom" says the driver. Puzzled and
> not knowing squat about slaloms, or the breaking system, the
> customer service rep send the driver to a mechanic.
>
> "These brake pads are extremely vulnerable to slipping during X
> conditions on a 90 degree slalom. Someone will die!" says the
> driver to the mechanic... Not being able to change the auto's
> design nor engineering, the mechanic is puzzled and offers to
> take the information although he is even more puzzled on who
> this should be directed to.
>
> Two days later driver rambles on news stations nationwide:
> "Their arrogance will get people killed. I warned them repeatedly"
> People moan and grumble, etc., recalls, fixes...
>
> This Wachovia thread is pointless. I see no mention or posting
> to perhaps any security list (and I'm on many both public and
> private) saying: "Hey is there anyone who can put me in touch
> with someone in the know at Wachovia" on any list. All I see
> is... "I called customer service". So what, if you're a security
> professional you will know damn well you're getting nowhere
> with them. "I spoke to their w3bm4ster". And? Either the poster
> is looking for attention or a complete and utter idiot. If his
> or her true intention was to provide a report of a security
> woe concerning said business or product, he or she could have
> easily jumped on any security mailing list and found the right
> connection instead of rambling on "the sky is falling..."
>
> Let me see:
> wachovia security cissp "incident" +network via Google
>
> This looks interesting:
> http://www.bryceporter.com/
>
> I would have contacted someone on this level to put me in
> touch with the right person. But hey, guess its more hip
> to add stupid little tags next to your resume or webpage:
> I broke $INSERT_VENDOR_HERE
>
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


-- 
greets

                    one must still have chaos in oneself to be able to give birth to a dancing star

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists