Re: Informing Companies about security vulnerabilities...

[Jex <hewhohuntscats () gmail com>]

Rule #52.
The Editor Does Not Do Web Security.

Try, instead, contacting their webmaster, or IT Guy.

On 10/4/06, Andreas Putzo <putzoa () gmx de> wrote:
> On Oct 04, Joseph McCray wrote:
> > Usually when we do this we only find a few simple things (XXS for
> > example) - no big deal right. With this particular website we just kept
> > finding another, after another and on and on. Over 600 instances of XXS,
> > over 200 SQL Injection - this was bad. After a while it started to get
> > boring there was so many....
> >
> > So I drafted a letter to the editor as well as several other prominent
> > people at the newspaper. It detailed my finding and recommended some
> > possible mitigation strategies. After emailing this I didn't hear
> > anything for a few days, so I emailed it again and followed up with a
> > phone call. After getting no response to the second email and then
> > having been bounced around from department to department when I called I
> > just said forget it.
>
> You can try to set them an ultimatum pretending to disclose the holes
> to the public. Perhaps they are more willing to react if they are forced
> to do so.
> Depending on the information you can get through the website (customer
> data anywhere?) and the laws in your country (IANAL, btw.)
> you may go to the intrigued publicity, indeed. They gotta have to do something if
> someone defaced their website actually.
>
>
> --
> regards,
> Andreas Putzo
>
>
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------