Re: Who Do I Contact?

[Michael Holstein <michael.holstein () csuohio edu>]

> I am sorry I am not going to say who the school is.

Have you tried posting to EDUCAUSE or UNISOG (the second is a 
security-only group for .edus). A post there (with the same detail-level 
you already provided, requesting a security contact) -- will probably at 
least find you someone who knows the right person to call.

You can also email the folks at SANS/ISC (isc.sans.org) and they will 
help do the legwork. They keep everything confidential.

I assume you've already tried everything you can find in whois, and 
tried all the generic (security@, abuse@, postmaster@, etc) addresses. 
Also hit their website and find the phonebook (most all publish this 
someplace) and try to search by department and find a title that sounds 
close to what you need.

Most any decent size .edu will all have somebody that can recognize the 
risk and demand it be taken off-line until fixed. Nobody wants to get 
embarrased in the news.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/