4 ms·
"To demonstrate the flaw to First State's IT staff, he wrote a script that cycled through each ID number and pulled down the relevant report to his computer. He
by Volpe 15y ago
"To demonstrate the flaw to First State's IT staff, he wrote a script that cycled through each ID number and pulled down the relevant report to his computer. He confirmed that the vulnerability affected the firm's full customer database."
Seriously? That sounds a little more than just "Checking the vulnerability exists", that sounds like exploiting it. Tweaking the url, is all he needed to do to workout that there was a problem... then he writes a script and downloads all the data?
I'm actually not that shocked by the reaction. Equivelant:
"I noticed your door was unlocked, so I stole all your stuff, and put it in that truck parked just there. Just thought you might like to know". <--- Would you take legal action in that case?
- leot 15y agoOr: "it seemed like you left your private diary out, so I photocopied every page to make sure before telling you." That said, I can see the temptation to want an answer to the question "did the really leave every account open?"
- sliverstorm 15y agoI don't know if personal information, including finances and info on your retirement fund, are like your diary. Perhaps more accurate would be "I found your checkbook with an exhaustive list of all your stocks, private information, bank balances, account numbers, etc. I recorded it all. You probably want it back?" They aren't some online shopping store. They are a trustee.
- darklajid 15y agoStealing physical goods was a crappy comparison in the GP and you didn't improve it a tiny wee bit. The company hasn't lost anything, while both examples talk about 'taking away' and 'you want it back?'. This is the standard copy != theft analogy failure. Note that I do understand that the company (and people affected as customers) wouldn't want him to keep a backup of whatever data he copied. Still, please don't compare it to theft, robbery or whatever.
- sliverstorm 15y agoMy point was nothing to do with physical goods. My point was the information in question is rather more sensitive than a diary.
- cubicle67 15y agomore like "I found your private diary in the hedge near your house, so I had a bit of a rummage around and also found your cheque book, credit card and driver's license. There's probably more stuff as well. Just thought I'd let you know before anyone else finds them"
- bionicbrian 15y agoOr, "I found that you, the bank, left all of your customers' money and social security cards and personal records (including mine) in an unlocked windowed room facing the street where anyone might walk by and steal all of it. You might want to lock it up." "Prove it." "Ok, I'll just show you how ridiculously easy it is to open this door . . ." "Thief!!"
- wpietri 15y agoEven the CEO says he only downloaded info from "hundreds of other customers accounts", which would be 0.1% of "all the data". Checking the extent of the vulnerability is a reasonable thing to do before reporting it. This is more "you have left all your doors unlocked" than "I stole all your stuff".
- Confusion 15y agoPeople don't take you seriously when you merely tell them about a problem. They start taking you seriously when you demonstrate the problem. It takes some knowledge and imagination to extrapolate from a reported security problem to the possible consequences. Many people, unfortunately including those in IT helpdesk positions, lack either the knowledge or the imagination. This guy has done the company a huge favor by actually demonstrating the problem.