3 ms·

Perhaps you could identify members of their technical team via LinkedIn or whoising their domain name, or others they own. You might find that the CAA record co

Perhaps you could identify members of their technical team via LinkedIn or whoising their domain name, or others they own. You might find that the CAA record contains the e-mail address of a security manager for example. You could perhaps try to figure out their e-mail address scheme and contact members of the IT team. You probably need to get past the executive outer shell and speak to real technical people who will understand the gravity of the situation. But aside from that, I can't think of a legal way to proceed. You could of course access customer data and then contact an important customer directly in an anonymous fashion. That'd light a fire under them but you would almost certainly be in violation of the law. The fact that you've already contacted them, presumably using your real-world identity would put you under suspicion swiftly. But as others have said, what's in it for you? I'd personally file this under "not my problem" at this point.

system2 8y ago
I am not going to try to contact them any further. I was trying to be a good Samaritan since this company also supports the government and many major American companies. Certainly, I don't want any legal issue randomly because of a loosely secured company while I try to help them for free. As the other commenter indicated, I wish there was a government department which could take care of this type of things.
jamieweb 8y ago
Looking at the CAA record for the IODEF contact email is a great idea, but unfortunately the sort of organisations who don't have published security contacts are also incredibly unlikely to use or even know what CAA is. Could try emailing security@, hostmaster@?
- system2 8y ago
  I contacted someone and that person responded already as I stated in the details above. That person is a C-level and didn't even bother asking me about anything. I move on, I tried to help.

system2 8y ago

I am not going to try to contact them any further. I was trying to be a good Samaritan since this company also supports the government and many major American companies. Certainly, I don't want any legal issue randomly because of a loosely secured company while I try to help them for free. As the other commenter indicated, I wish there was a government department which could take care of this type of things.

jamieweb 8y ago

Looking at the CAA record for the IODEF contact email is a great idea, but unfortunately the sort of organisations who don't have published security contacts are also incredibly unlikely to use or even know what CAA is. Could try emailing security@, hostmaster@?

system2 8y ago
I contacted someone and that person responded already as I stated in the details above. That person is a C-level and didn't even bother asking me about anything. I move on, I tried to help.