4 ms·
The initial email exchange is indeed a sight to see, so I transcribed the text in the image: --------- Hello Mike et al Thank you for making yourself availab
by ufo 7y ago
The initial email exchange is indeed a sight to see, so I transcribed the text in the image:
---------
Hello Mike et al
Thank you for making yourself available. There is a security vulnerability on the delivery.panerabread.com website that exposes sensitive information belonging to every customer who has signed for an account to order Panera Bread once. This shows the customer's full name, email address, phone number and the last four digits of their saved credit card number. Moreover, the users are easily enumerable which means an attacker can crawl through the records.
I can provide the specific details of the vulnerability over email once you respond, but if you prefer (for more security), I can also encrypt the information with a PGP key you provide me. Alternatively we can hop on a phone call.
Best Regards,
Dylan Houlihan
--------------
Dylan
My team received your emails however it was very suspicious and appeared scam in nature therefore was ignored. If this is a sales tactic I would highly recommend a better approach as demanding a PGP key would not be a good way to start off. As a security professional you should be aware that any organization that has a security practice would never respond to a request like the one you sent. I am willing to discuss whatever vulnerabilities you believe you have found but I will not be duped, demanded for restitution/bounty or listen to a sales pitch.
Regards, Mike
- _Microft 7y agoI was almost expecting something like this to follow: I am certainly not authorized to give away the public key but I have a private one that I would share if necessary.
- draw_down 7y agoThat is shameful incompetence. Disgraceful. In a followup this person makes some excuse about how many emails they get because they're a big company. Why even have the email address then, if you're just going to disregard everything right off the bat? The initial email was rather specific with regard to the issue, but even if it wasn't, send them the fucking PGP key and see what they send! If it's nothing worthwhile, oh well, no big deal.
- siffland 7y agoreminds me of the time Oklahoma City was threatening CentoOS with calling the FBI because there website was down and they thought CentOS hacked it: https://www.theregister.co.uk/2006/03/24/tuttle_centos/ https://www.theregister.co.uk/2006/03/24/tuttle_centos/ If you are in a position where you don't understand the e-mail then ASK someone who does. Or a quick google search with "PGP e-mail", wow was that so hard. The guy was probably late for a golf game or something (ok now i am being mean). Idiots.
- Rafuino 7y agoNot Oklahoma City, an Oklahoma city (lower case 'c'!). Actually, it's more of a tiny town... Tuttle has ~6000 people and OKC has >100x that.
- lone_haxx0r 7y ago"How did they not die as babies? considering they were likely too stupid to find a tit to suck on" Linus Torvalds on idiots (more specifically: people who read things one byte at a time, with system calls for each byte.)
- plausibilities 7y agoIt's shocking how far up you can make it in enterprise environments on pure bluster alone. Perhaps a contributing factor to the Peter Principle?
- westmeal 7y ago> appeared scam in nature therefore was ignored. > demanding a PGP key would not be a good way to start off. Oh dear god...
- astura 7y ago!!! That's a very nasty response to an incredibly polite email.
- perfmode 7y agowho does Mike report to?
- acchow 7y agoSomeone needs to hop on Panera's next earnings call and ask why they aren't taking security seriously.
- pnutjam 7y agoIn my last job I was responsible for onboarding b2b clients to send us hr data through sftp with key authentication. We also recommended they encrypt with our public pgp key and sign with their private key. Trying to explain the difference between ssh keys and pgp/gpg keys took up a good 20% of my time some weeks. Often, I was talking to tech companies, or companies with a reputation for technology... I don't think the majority of Windows admins understand public/private keys.