Re: Contact BankOne.com ?

[Martin Mkrtchian <dotsecure () gmail com>]

Is this happen to be critical  a vulnerability that you would like to
inform Bank One about?

Posting any information prior contacting BankOne would cause a greater risk.  

Doing so, would be like giving a clue to a fellow hacker. Next thing
you know you have all the Blackhats going to BankOne website trying to
find the same vulnerability that you have found.

Knowing how bright some of them are I wouldnt be surprised if they
find it and exploit it.

This is a problem with many financial websites. Responsibility of
every Risk Assessment Group should be to have proper contact
information availabe to public, for cases like these. Many large
organization websites fail to have this process in place.  They should
have contact information along with their public key.

Martin Mkrtchian





On Tue, 7 Dec 2004 16:11:07 -0600, Owned You <0wnj00 () gmail com> wrote:
> Post your issues with BankOne on:
>
> http://finance.yahoo.com/q/mb?s=JPM
>
> That may get their attention. Or not; posting here will get the
> attention of the infosec journalists.
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html