6 ms·

Typing this up in real time ... I called American Express Australia to report the defect & I was transferred through to the American call centre. The CSR to w

Typing this up in real time ... I called American Express Australia to report the defect & I was transferred through to the American call centre. The CSR to whom I spoke transferred me through to a different department, after I explained that I didn't have an account. She did ask whether "I received an email" which I assume was some sort of inquiry as to whether I had been phished. I then spoke to an online services rep., who after asking for my card number, listened to my report. She then put me on hold. (The call had taken 10 minutes by this time). After a few more minutes on hold, the CSR came back on the line, asked me to repeat the information, and confirmed for the umpteenth time that I don't have an American Express card. I explained that it wasn't my find, but that it had been published online & so was by now _very_ public. (15 minutes by this time, most of that on hold listening to advertising for American Express, including some ironic praise for their website). CSR comes back on the line. She's spoken to her 'technical team' who assure me that there's nothing insecure going on because it's all over HTTPS. So I politely walked her through the process - visit the page, add ?debug to the URL, click the admin link & behold: lots of should-be-secure stuff. At this point she thanks me profusely, & asks that I hold while she speaks to her supervisor. Back to the American Express ads ... (20 minutes at this point). The CSR came back on the line, thanked me again, & said that her supervisor had taken a screenshot of the issue & escalated it. Job done. So, yeah, I can totally understand the frustration experienced by the guy who discovered the vulnerability. But it certainly wasn't impossible for me to report the issue, & I'm in Australia.

duncan_bayne 15y ago
(I didn't mention that there was a pregnant pause after she clicked the Admin Home link & saw the admin page in all its glory. I think the only sound was, as Scott Adams put it, the sound of eyeballs getting really big.)
rufibarbatus 15y ago
Funny thing is: he didn't even try that, because he didn't accept under any circumstances to communicate by phone, fax or snail mail. He made this big, boldface disclaimer with twitter screenshots and all trying to claim "best effort is good enough" and "they won't listen", but all I saw was them listening and him refusing to speak.
- dlikhten 15y ago
  Erm, no. Dude if I spend my time figuring out vulnerabilities to your system and don't exploit em, instead help you close them, and I am not even a cardholder... I will not jump through any hoops for any amount of my time. They owe me, I owe them shit. I am being kind and generous by not exploiting or giving the exploit to others, or using it to fuck up AMEX reputation. Especially true if I want my anonymity preserved. Jumping through hoops? Dude he got in contact with someone. Instead he got a "piss off" response.
  - duncan_bayne 15y ago
    Well, I didn't get a "piss off" response, I got a nice warm thank you. Perhaps he could have persevered just a bit? I had to do a bit of hand-holding to get the CSR to whom I spoke to understand the problem, but once she did, it was easy.
    - nowarninglabel 15y ago
      I have to agree with the others here, while you may have done what you believe is the "right" thing, you have absolutely no idea if that avenue of inquiry went anywhere, and based on my experience working in an enterprise, I would guess that even if it did go anywhere from there it would take weeks for meetings to get scheduled, and months for people to get assigned to actually do anything about it.
    - click170 15y ago
      When a non-customer does you the courtesy of pointing out serious flaws in your system, you do not ask them to detail it publicly via twitter. Nor is it a good idea to make them jump through hoops. You know what method of disclosure doesn't have hoops? Posting an email to the Full Disclosure mailing list. Look. I'm all for giving the company a chance but if you put up arbitrary hoops up for me to jump through... Why shouldn't I take the path of least resistance again?
    - flatline 15y ago
      At first glance you made some progress and that makes him seem unrealistic in his demands for electronic communication, but what makes you think that the issue was reported properly upstream? I think that you got lucky to find someone who understood that it was a real problem, and unless they have an internal escalation procedure in place, there's a decent chance it will die with her or her supervisor. There's really no way of knowing if your report had any effect or not. Other large corporations have measures in place to handle vulnerability reports, it seems like a problem for a large CC provider to not have a clear procedure in place for handling these issues.
T-hawk 15y ago
Do remember that for every real serious problem such as this, American Express and any other large company receives a hundred or a thousand calls for non-issues like phishing or minor issues like a compromised card number to cancel and reissue. The system is optimized for these common cases; the edge case of a real public vulnerability will require extra effort and it's not a failing of Amex that the system is so.
- leif 15y ago
  when the cost of a false negative is so damn high, you'd think they would know not to filter so aggressively
  - bnr 15y ago
    at some point, all the people dealing with the false positives will be costlier.
    - stygianguest 15y ago
      Seriously? I won't take American Express anytime soon, I can tell you that. If this gets picked up in mainstream media, it is devastating.
      - bdr 15y ago
        More likely: people will be assured the problem is fixed, and then not care.
    - leif 15y ago
      Let me rephrase: you'd hope they would know...
  - mst 15y ago
    If they didn't filter aggressively, that would mean that their more technical staff would be deluged with crap. And then quit. I was operations/development at an ISP once, had three layers of acceptably competent support techs between the customer and I and a serious reputation as a fire breathing dragon if a non-issue was escalated to me - but -still- regularly lost half my day dealing with escalated "urgent problems" that were neither.
brown9-2 15y ago
Ironically the page is available over both https and http.
deleted 15y ago
[deleted]
superic 15y ago
Someone signed up for their Wells Fargo account with my email address. For weeks, I tried to get in contact with Wells Fargo about the problem. I spent a lot of time on the phone with the 'security team' and nothing ever came of it. In the end, I kept receiving all of this person's banking information. It wasn't so much a security problem so much as it was annoying to get this person's banking info all the time. (I assume I would have needed more than access to email to get into his account.) In the end, after several phone calls and then tweeting at Wells Fargo, it was the Facebook reps that were able to get someone to call me and sort the problem out. The rep who called even verified that the first three of my social didn't match the account holder, so it wasn't identity theft. Completely annoying but in the end, it just took finding that one person that understood and cared to help.

duncan_bayne 15y ago

(I didn't mention that there was a pregnant pause after she clicked the Admin Home link & saw the admin page in all its glory. I think the only sound was, as Scott Adams put it, the sound of eyeballs getting really big.)

rufibarbatus 15y ago

Funny thing is: he didn't even try that, because he didn't accept under any circumstances to communicate by phone, fax or snail mail. He made this big, boldface disclaimer with twitter screenshots and all trying to claim "best effort is good enough" and "they won't listen", but all I saw was them listening and him refusing to speak.

dlikhten 15y ago
Erm, no. Dude if I spend my time figuring out vulnerabilities to your system and don't exploit em, instead help you close them, and I am not even a cardholder... I will not jump through any hoops for any amount of my time. They owe me, I owe them shit. I am being kind and generous by not exploiting or giving the exploit to others, or using it to fuck up AMEX reputation. Especially true if I want my anonymity preserved. Jumping through hoops? Dude he got in contact with someone. Instead he got a "piss off" response.
- duncan_bayne 15y ago
  Well, I didn't get a "piss off" response, I got a nice warm thank you. Perhaps he could have persevered just a bit? I had to do a bit of hand-holding to get the CSR to whom I spoke to understand the problem, but once she did, it was easy.
  - nowarninglabel 15y ago
    I have to agree with the others here, while you may have done what you believe is the "right" thing, you have absolutely no idea if that avenue of inquiry went anywhere, and based on my experience working in an enterprise, I would guess that even if it did go anywhere from there it would take weeks for meetings to get scheduled, and months for people to get assigned to actually do anything about it.
  - click170 15y ago
    When a non-customer does you the courtesy of pointing out serious flaws in your system, you do not ask them to detail it publicly via twitter. Nor is it a good idea to make them jump through hoops. You know what method of disclosure doesn't have hoops? Posting an email to the Full Disclosure mailing list. Look. I'm all for giving the company a chance but if you put up arbitrary hoops up for me to jump through... Why shouldn't I take the path of least resistance again?
  - flatline 15y ago
    At first glance you made some progress and that makes him seem unrealistic in his demands for electronic communication, but what makes you think that the issue was reported properly upstream? I think that you got lucky to find someone who understood that it was a real problem, and unless they have an internal escalation procedure in place, there's a decent chance it will die with her or her supervisor. There's really no way of knowing if your report had any effect or not. Other large corporations have measures in place to handle vulnerability reports, it seems like a problem for a large CC provider to not have a clear procedure in place for handling these issues.

T-hawk 15y ago

Do remember that for every real serious problem such as this, American Express and any other large company receives a hundred or a thousand calls for non-issues like phishing or minor issues like a compromised card number to cancel and reissue. The system is optimized for these common cases; the edge case of a real public vulnerability will require extra effort and it's not a failing of Amex that the system is so.

leif 15y ago
when the cost of a false negative is so damn high, you'd think they would know not to filter so aggressively
- bnr 15y ago
  at some point, all the people dealing with the false positives will be costlier.
  - stygianguest 15y ago
    Seriously? I won't take American Express anytime soon, I can tell you that. If this gets picked up in mainstream media, it is devastating.
    - bdr 15y ago
      More likely: people will be assured the problem is fixed, and then not care.
  - leif 15y ago
    Let me rephrase: you'd hope they would know...
- mst 15y ago
  If they didn't filter aggressively, that would mean that their more technical staff would be deluged with crap. And then quit. I was operations/development at an ISP once, had three layers of acceptably competent support techs between the customer and I and a serious reputation as a fire breathing dragon if a non-issue was escalated to me - but -still- regularly lost half my day dealing with escalated "urgent problems" that were neither.

brown9-2 15y ago

Ironically the page is available over both https and http.

deleted 15y ago

[deleted]

superic 15y ago

Someone signed up for their Wells Fargo account with my email address. For weeks, I tried to get in contact with Wells Fargo about the problem. I spent a lot of time on the phone with the 'security team' and nothing ever came of it. In the end, I kept receiving all of this person's banking information. It wasn't so much a security problem so much as it was annoying to get this person's banking info all the time. (I assume I would have needed more than access to email to get into his account.) In the end, after several phone calls and then tweeting at Wells Fargo, it was the Facebook reps that were able to get someone to call me and sort the problem out. The rep who called even verified that the first three of my social didn't match the account holder, so it wasn't identity theft. Completely annoying but in the end, it just took finding that one person that understood and cared to help.