Re: Wachovia Bank website sends confidential information

[Bob Toxen <bob () verysecurelinux com>]

Wachovia Bank's Web Security people did phone me late yesterday to thank
me for raising the security issue.  They also stated that they were
investigating why my initial contacts with Wachovia did not result in
an appropriate response.

They said that they also were working with their legal people to determine
what notification to consumers, if any, was required due to the California
data breach law and similar laws elsewhere.

It was not made clear whether their phone call (and their correction
of the web page) was directly due to my posting on the Full-disclosure
list or because Steve Ragan saw my posting and contacted Wachovia.


For those who questioned whether I made sufficient attempts to contact
them, please note that I talked by phone both with customer support and
web support people and then FAXed the details to the web support person
who took my call.  Note that I bothered with this at all as a courtesy
to Wachovia.  Nobody paid me for my time.

For those who questioned whether I gave them sufficient time to react,
I stated in my FAX to them, in effect, that all they had to do within
7 days was to respond to the FAX and ask for more time to deal with
the problem.  I then waited 15 days, not 7, before posting on FD after
having received no response and seeing that the problem remained.

For those who questioned my motives and suggested that I deliberately
did not make sufficient effort to contact them, well, I detailed my
3 contacts above and then got no response for 15 days.  For those who
suggested I was motivated by fame, well, I already have that.  I won't
blow my horn here but anyone is welcome to do a Google search on me.

Wachovia has fixed the problem.  They are working to ensure that future
advisories are handled properly.  Thanks to all who responded.  Shall we
put this matter to bed?

Bob Toxen,
Horizon Network Security
http://www.verysecurelinux.com       [Network & Linux/Unix Security Consulting]
http://www.realworldlinuxsecurity.com [Our 5* book: "Real World Linux Security"]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/