5 ms·

I think they're regarding these things as weapons, because that's how they or others are using them. It doesn't matter how we regard CVEs as a community, this

I think they're regarding these things as weapons, because that's how they or others are using them. It doesn't matter how we regard CVEs as a community, this is the truth of the matter outside of it. We're handing them over a bomb, and they want to know why. It feels very Spy vs Spy to me, as silly as that sounds.

knodi123 9y ago
That was my experience when I stumbled across a text file with several thousand credit card numbers, which included tons of details about each card holder, including SSN. I tried reporting it to the credit card, and to the issuing bank, and to the FBI. The only thing I asked was that they cancel the credit card accounts and put a "potential fraud source" note on each customer's account. Each party I called was more concerned with threatening me, and trying to find out what kind of criminal angle I was playing, and what my ulterior motive was, etc etc. I honestly expected to hear "Oh dang, that sucks, we'll close the accounts and contact the victims", and was depressed at the hostility I encountered.
- platz 9y ago
  Suppose they granted your plan to "cancel the credit card accounts" and "potential fraud source" note on each account. That's pretty much trying to shut down business with their customers. You don't see how they'd interpret that as hostile? Future actors would know how to apply similar techniques if the outcome was in their favor (e.g. Anonymous suddenly produces a large file of cc#'s and threatens bank!) > The only thing I asked.. In fact, why were you making demands about how they handle their customer relationships, instead of simply presenting what you'd found?
  - joshuamorton 9y ago
    When you come across a single credit card number (say, by finding someone's card on the ground), the response by most financial institutions is to invalidate that card and mail them a new one. Why shouldn't the response be the same if you come across a stack of 100 credit cards?
    - josh2600 9y ago
      Because shutting down 100 credit cards has more reputation and monetary liability than shutting one down? You're basically saying "academics can derive your social security number using public information!" And wondering why they don't reissue all of the SSNs...
      - joshuamorton 9y ago
        So? When a website has its passwords stolen (even just the hashed, salted ones) the immediate step is to invalidate every password potentially compromised and force users to reset them. Doesn't matter how or why the passwords were lost, you start by mitigating the damage someone can do. Why isn't the response for when credit card information (which is very often more valuable) is stolen similar? >You're basically saying "academics can derive your social security number using public information!" No, I'm saying that if my name, social, DoB, mother's maiden name, and credit card number appear online in a csv file with 200 other people's personal information, I'd really appreciate it if my credit card company would take proactive steps to keep my accounts secure.
    - platz 9y ago
      The response to invalidate is a choice by the bank, not the person who finds the card. Also, that is a single number. It's suspicious/threatening for a non-trivial amount of cards when the presenter also makes demands.
      - joshuamorton 9y ago
        How is "someone has stolen your clients information and likely already sold it to nefarious actors, because otherwise it wouldn't be on the internet anywhere, so you should keep them safe by deactivating those accounts" threatening? I'd be annoyed if my bank didn't do something.
        platz 9y ago
        That is a different point. You are changing the party being considered by re-framing it under yourself, a customer, instead of considering it from the point of view of the bank.
  - knodi123 9y ago
    > That's pretty much trying to shut down business with their customers. That's not how credit cards work. You close that account, transfer the balance to a new card, and issue it to them in the mail. I've done it a half dozen times, and my CC company is only out for odds and ends like postage and stamping a new card. > In fact, why were you making demands I wrote "asked", and then you pasted that, and misquoted it as "demanded"? If you hadn't included my quote, I'd accuse you of dishonesty, but now it's just weird. I asked them to proactively protect their customers, because my grandfather had been through hell after his identity was stolen, and I wanted to do my best to protect other people from the same.
- problems 9y ago
  Sad part is that if you just posted that link somewhere very public anonymously, it'd have been fixed in minutes and everyone on fraud alert.
- cosinetau 9y ago
  I don't think you owe them that. Based on their history of behavior in this area, I don't believe the government, or other institutions with a similar story in this area can be trusted with that kind of kindness. Why should we be strictly ethical in the face of behavior that is unethical? We deserve protection, too.
- OliverJones 9y ago
  You could always send an anonymous, or not, tip to KrebsOnSecurity.com. Brian has the skill to handle this kind of disclosure and the street cred to avoid pitfalls.
  - alphapapa 9y ago
    Has he said that he's willing to be a liaison like that? If not, you'd be putting an unfair burden on him by doing that.
    - mintplant 9y ago
      Krebs writes articles based on tips [0] of this nature all the time. As a reporter I expect he would appreciate the opportunity to break the story. [0] https://krebsonsecurity.com/about-this-blog/ https://krebsonsecurity.com/about-this-blog/
    - nommm-nommm 9y ago
      Krebs has sources contact him all the time.

knodi123 9y ago

That was my experience when I stumbled across a text file with several thousand credit card numbers, which included tons of details about each card holder, including SSN. I tried reporting it to the credit card, and to the issuing bank, and to the FBI. The only thing I asked was that they cancel the credit card accounts and put a "potential fraud source" note on each customer's account. Each party I called was more concerned with threatening me, and trying to find out what kind of criminal angle I was playing, and what my ulterior motive was, etc etc. I honestly expected to hear "Oh dang, that sucks, we'll close the accounts and contact the victims", and was depressed at the hostility I encountered.

platz 9y ago
Suppose they granted your plan to "cancel the credit card accounts" and "potential fraud source" note on each account. That's pretty much trying to shut down business with their customers. You don't see how they'd interpret that as hostile? Future actors would know how to apply similar techniques if the outcome was in their favor (e.g. Anonymous suddenly produces a large file of cc#'s and threatens bank!) > The only thing I asked.. In fact, why were you making demands about how they handle their customer relationships, instead of simply presenting what you'd found?
- joshuamorton 9y ago
  When you come across a single credit card number (say, by finding someone's card on the ground), the response by most financial institutions is to invalidate that card and mail them a new one. Why shouldn't the response be the same if you come across a stack of 100 credit cards?
  - josh2600 9y ago
    Because shutting down 100 credit cards has more reputation and monetary liability than shutting one down? You're basically saying "academics can derive your social security number using public information!" And wondering why they don't reissue all of the SSNs...
    - joshuamorton 9y ago
      So? When a website has its passwords stolen (even just the hashed, salted ones) the immediate step is to invalidate every password potentially compromised and force users to reset them. Doesn't matter how or why the passwords were lost, you start by mitigating the damage someone can do. Why isn't the response for when credit card information (which is very often more valuable) is stolen similar? >You're basically saying "academics can derive your social security number using public information!" No, I'm saying that if my name, social, DoB, mother's maiden name, and credit card number appear online in a csv file with 200 other people's personal information, I'd really appreciate it if my credit card company would take proactive steps to keep my accounts secure.
  - platz 9y ago
    The response to invalidate is a choice by the bank, not the person who finds the card. Also, that is a single number. It's suspicious/threatening for a non-trivial amount of cards when the presenter also makes demands.
    - joshuamorton 9y ago
      How is "someone has stolen your clients information and likely already sold it to nefarious actors, because otherwise it wouldn't be on the internet anywhere, so you should keep them safe by deactivating those accounts" threatening? I'd be annoyed if my bank didn't do something.
      - platz 9y ago
        That is a different point. You are changing the party being considered by re-framing it under yourself, a customer, instead of considering it from the point of view of the bank.
- knodi123 9y ago
  > That's pretty much trying to shut down business with their customers. That's not how credit cards work. You close that account, transfer the balance to a new card, and issue it to them in the mail. I've done it a half dozen times, and my CC company is only out for odds and ends like postage and stamping a new card. > In fact, why were you making demands I wrote "asked", and then you pasted that, and misquoted it as "demanded"? If you hadn't included my quote, I'd accuse you of dishonesty, but now it's just weird. I asked them to proactively protect their customers, because my grandfather had been through hell after his identity was stolen, and I wanted to do my best to protect other people from the same.
problems 9y ago
Sad part is that if you just posted that link somewhere very public anonymously, it'd have been fixed in minutes and everyone on fraud alert.
cosinetau 9y ago
I don't think you owe them that. Based on their history of behavior in this area, I don't believe the government, or other institutions with a similar story in this area can be trusted with that kind of kindness. Why should we be strictly ethical in the face of behavior that is unethical? We deserve protection, too.
OliverJones 9y ago
You could always send an anonymous, or not, tip to KrebsOnSecurity.com. Brian has the skill to handle this kind of disclosure and the street cred to avoid pitfalls.
- alphapapa 9y ago
  Has he said that he's willing to be a liaison like that? If not, you'd be putting an unfair burden on him by doing that.
  - mintplant 9y ago
    Krebs writes articles based on tips [0] of this nature all the time. As a reporter I expect he would appreciate the opportunity to break the story. [0] https://krebsonsecurity.com/about-this-blog/ https://krebsonsecurity.com/about-this-blog/
  - nommm-nommm 9y ago
    Krebs has sources contact him all the time.