Full Disclosure mailing list archives
Re: Wachovia Bank website sends confidential information
From: Bob Toxen <bob () verysecurelinux com>
Date: Thu, 12 Jul 2007 05:55:30 -0400
Wachovia Bank's Web Security people did phone me late yesterday to thank me for raising the security issue. They also stated that they were investigating why my initial contacts with Wachovia did not result in an appropriate response. They said that they also were working with their legal people to determine what notification to consumers, if any, was required due to the California data breach law and similar laws elsewhere. It was not made clear whether their phone call (and their correction of the web page) was directly due to my posting on the Full-disclosure list or because Steve Ragan saw my posting and contacted Wachovia. For those who questioned whether I made sufficient attempts to contact them, please note that I talked by phone both with customer support and web support people and then FAXed the details to the web support person who took my call. Note that I bothered with this at all as a courtesy to Wachovia. Nobody paid me for my time. For those who questioned whether I gave them sufficient time to react, I stated in my FAX to them, in effect, that all they had to do within 7 days was to respond to the FAX and ask for more time to deal with the problem. I then waited 15 days, not 7, before posting on FD after having received no response and seeing that the problem remained. For those who questioned my motives and suggested that I deliberately did not make sufficient effort to contact them, well, I detailed my 3 contacts above and then got no response for 15 days. For those who suggested I was motivated by fame, well, I already have that. I won't blow my horn here but anyone is welcome to do a Google search on me. Wachovia has fixed the problem. They are working to ensure that future advisories are handled properly. Thanks to all who responded. Shall we put this matter to bed? Bob Toxen, Horizon Network Security http://www.verysecurelinux.com [Network & Linux/Unix Security Consulting] http://www.realworldlinuxsecurity.com [Our 5* book: "Real World Linux Security"] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Wachovia Bank website sends confidential information, (continued)
- Re: Wachovia Bank website sends confidential information Bob Bruen (Jul 11)
- Re: Wachovia Bank website sends confidential information J. Oquendo (Jul 11)
- Re: Wachovia Bank website sends confidential information Jim Popovitch (Jul 11)
- Re: Wachovia Bank website sends confidential information Bob Bruen (Jul 11)
- Re: Wachovia Bank website sends confidential information Security Guy (Jul 11)
- Re: Wachovia Bank website sends confidential information Alexander Sotirov (Jul 10)
- Re: Wachovia Bank website sends confidential information Bob Toxen (Jul 11)
- Re: Wachovia Bank website sends confidential information Bob Toxen (Jul 11)
- Re: Wachovia Bank website sends confidential information Peter Dawson (Jul 11)