23 ms·
Due to fear of retaliation I decided initially not to share this story, but enough time has passed, and I feel the security community should know how one of the
by ic4l 6y ago
Due to fear of retaliation I decided initially not to share this story, but enough time has passed, and I feel the security community should know how one of the largest banks treats security researchers.
- irjustin 6y agoThanks for sharing and sorry such a shitty action was the result. More seriously, is it possible to get in writing that disclosure would not result in negative repercussions if there is no bounty program? Perhaps dealing with large banks in a security context requires a less forgiving mentality. Did you have to return the $5k? At least maybe you gained that?
- ic4l 6y agoI gave them a detailed report of everything, and the $5,000 USD, and the remaining 4,500,000 rewards points were returned. The only compensation I received with this whole situation was the termination of my accounts, and a family members account being terminated as well. It's very hard to know the reasoning behind the termination as they never gave me any information.
- nullc 6y agoAs I was reading your story and got the the part where they said they didn't have a bounty -- for some reason I anticipated that the next line would be them telling you that you could keep the $5,000. I was extremely disappointed. :( Thank you for sharing.
- ic4l 6y agoEven their newly developed responsible disclosure program doesn't have bounties. You would think out of all people a bank would have deep enough pockets to afford a proper bounty program, as well as treat researchers well.
- pnutjam 6y agoWhat? That's their bread and butter. You wouldn't expect a pizza place to give away pizza....
- whatl3y 6y agoUhh, I would expect them to do exactly that for someone who presented them valid proof and and an MVP for how someone could get away with stealing tens, hundreds, thousands? of pizzas undetected. Rewarding someone for helping them with their “bread and butter” is how I would expect to be compensated for helping.
- ic4l 6y agoOr maybe just be allowed to return to the pizza shop in the future, and keep ordering pizzas.
- wpietri 6y agoThe core skill of bankers is trading money and risk. They lend you money based on one risk calculation. They put aside more money against default if your loan gets riskier. They set budgets for whole departments of people based on how much they help mitigate risk. So yes, I absolutely expect them to be good at saying, "Well, if we pay $X this year for bugs, that's better than losing $Y directly and paying $Z in cleanup costs."
- pnutjam 6y agosarcasm seems to be unnoticed...
- bonestamp2 6y agoI suspect they know they have a lot of vulnerabilities and they don't want to encourage people to poke around. I mean, their passwords aren't even case sensitive. This is also probably why they fired you as a customer, to discourage anyone else from even trying.
- 6y ago
- etothepii 6y agoThis sounds like the closure was due to Anti Money Laundering. I suspect this sort of activity triggers the banks AML procedures and it's standard operating procedure (sometimes mandated by law) that you can't disclose if an account was closed due to AML breaches. Obviously agree that you weren't money laundering but that's what this closure sounds like.
- gpapilion 6y agoSame thought, and I don’t think they get a lot of choices of this is triggered.
- csharptwdec19 6y agoYou don't. My gut agrees with this statement. Technically, if a SAR was filed, even the engineer he spoke to would not have known. Every training I've ever taken in that field basically says you don't tell anyone but your company's team that you filed such a report. Not a coworker, not even a Manager.
- ic4l 6y agoThis could be possible as well, because they never gave me any information.
- nijave 6y agoI would think some regulators may be interested in this
- baggachipz 6y agoAre there even still any regulators? Sarcastic yet honest question.
- nijave 6y agoJPMorgan Chase is an international company with a massive portfolio of products so there are quite a lot regulators floating around. Even outside Chase Ultimate Rewards, I imagine someone, somewhere would be concerned with their vulnerability disclosure process/practices.
- a_imho 6y agoWhy did you report it in the first place? What did you expect to happen? Let's say they did not terminate your accounts but sent a thank you letter, would that be satisfactory? I'm interested in why do security researchers or bug hunters do this kind of work for free. It really devalues the proposition long term imo, but I don't have a horse in the race. My POV is megacorps with bottomless pockets and armies of highly paid engineers miss these critical security issues all the time, and the best reporters can hope is chump change (if not abuse). edit: Even more specifically I'm wondering why can't the security community work together, denounce the current practice of exchanging bugs potentially worth $$$ for ~nerd cred? Make some high profile disclosure if that is what it takes to take the work seriously. Wouldn't it work out better in the long run?
- tyingq 6y agoMight be an interesting add to a resume/cv for a security related job.
- ic4l 6y agoThis was the original reason why I wanted to report it, also the fact that I really liked chase at the time. They were one of the first companies to have solid mobile banking.
- nfRfqX5n 6y agothink you would get popped for wire fraud if they caught on to it
- crusso 6y agoAlways involve an attorney and possibly law enforcement rather than trusting that these companies will do the right thing.
- riskable 6y agoDon't involve law enforcement unless you absolutely have to. The first thing they'll do is investigate TF out of you and your friends/family and they absolutely cannot be trusted to "do the right thing" or especially not to protect you in any way. They are not your friend.
- mtnGoat 6y ago100% this! Sorry but trusting local cops with anything technical is a fools errand.
- mxskelly 6y agoDon't talk to the cops about anything, ever. Especially not this. Lawyers are paid to keep your best interests in mind. Cops will investigate the shit out of you and will do nothing to help, at all.
- dls2016 6y agoCops protect capital.
- criddell 6y agoWhat difference would it have made in this case?
- cosmie 6y agoSuperficially speaking, he defrauded a US bank of $70k ($5k of which he transferred to his bank account). Yes, he disclosed exactly how he did it to the bank. Yes, he returned it all. Yes, he had no intent to keep it. And yes, he still defrauded them in the process. Yes, he had permission to do so. But permission doesn't always prevent situations from going awry, even if it can help clear things up after the fact. If you walk into a physical bank and notice a potential security issue, point out the potential security issue to the teller, come back to exploit that potential security issue just to see if you can, succeed and make off with $70k, then bring it all back in and walk the bank manager through how you robbed his bank, he's still going to call the cops on you. Or maybe you spoke to him before and got permission, but his communication to corporate after the fact gets misconstrued/misunderstood and someone else calls the cops. Closing all of the accounts like they did was a crap reaction, but he could have just as easily been hand delivered an arrest warrant by an FBI agent for bank robbery and fraud if someone internally decided to take the position that what he did was analogous to the above scenario. And it may have just as easily occurred due to some internal miscommunication/misunderstanding by a non-technical person or being flagged by some type of automation/reporting, rather than deliberately taking such a stance. That's where involving a lawyer would have been valuable. It may not have protected him from the consequences that did occur, since they could close his accounts for whatever reason they wanted. But a lawyer would have provided greater assurance against substantially worse outcomes, by ensuring more drastic outcomes were identified and addressed/mitigated upfront. And potentially saved his accounts from getting closed - the decrease in his cumulative credit limit plus closure of such long-lived credit cards translates into real economic harm due to the likely impact on his credit score. I could see a lawyer being able to use that fact somehow to persuade Chase that it was not in their best interests to take such an action. Law enforcement - I'd leave that up to the lawyer. As another user commented, your lawyer is explicitly employed to protect your interests. If involving law enforcement furthers that aim, they'll tell you. If involving law enforcement is detrimental to that aim, they'll tell you. So consult with several first, hire one second, and let them direct what happens after. If what they do/recommend ends up being incredibly stupid, you at least have their malpractice insurance to appropriately compensate you for their stupidity. But you have no such insurance to compensate you for your own.
- ptero 6y agoSince they effectively banned you from Chase service, what other retaliations were you worried about? Honest question. You might want to consider fighting it, though. It seems that it was a decision done at a pretty low level, or even automatically. Chase, like most US big banks, are under constant scrutiny and hate bad PR. Write to their top HR, say you are submitting a formal request to <pick a four-letter financial oversight agency> and send a copy to your congressman. What do you have to lose?
- abfan1127 6y agoserious question, why would you want to continue banking at a place that does this?
- popctrl1 6y agoRight? Sounds like they did him a favor. I had to jump through all kinds of loops to close my Chase account
- awakeasleep 6y agoIn the USA the three main banks are Chase, Wells, and Bank of America. Wells is notoriously crooked. Bank of America was a primary player in structuring withdrawls to maximize overdraft fines on their customers. Chase has its own problems, but it would add a lot of inconvenience to your life to eliminate it. Those three big players have purchased the majority of other banks in the country, leaving a scattered few credit unions and smaller banks around, which will be extra inconvenient when you travel and they absolutely will not offer the same range of credit cards with good rewards programs.
- seretogis 6y agoWe don't need to rely on profit-driven banks while credit unions exist. I'd really recommend that anyone and everyone switch to their local credit union to deprive these awful banks of their money. It is slightly less convenient, but much better for the country.
- rbarnes01 6y agoPlease, submit a complaint to the CFPB. I promise you that the bank will flip over backwards to resolve your issue.
- greyhair 6y agoThe CFPB has been declawed by the current administration.