6 ms·

Mastercard: "We have looked into the matter and there was not a risk to our systems" Also Mastercard: has expressed concerns about the public nature of this di

Mastercard: "We have looked into the matter and there was not a risk to our systems" Also Mastercard: has expressed concerns about the public nature of this disclosure. Good for him for making it all public. The only way to (sometimes) get big companies to fix their mistakes (besides the legal system) is to shame them into it.

zettabomb 2y ago
Yeah, isn't it pretty standard to first report privately, then report publicly if they don't take any action (and you believe it to still be an issue)? That seems consistent with mosr organization's responsible disclosure practices.
- JohnMakin 2y ago
  this is standard, but there are people out there that believe this is malicious/blackmailing behavior. I think it’s the most responsible thing you can do here. This guy could’ve made a bucket off this find, instead reports it responsibly and mitigates the risk (with his own money invested) and gets told to pound sand.
TZubiri 2y ago
Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not paid?
- ziddoap 2y ago
  The only people that I know do this are "Beg Bounty" "Security Researchers" that are, essentially, attempting to extort people. Even if it would be legally possible (I don't think you can force your 'services' on an unwilling entity and then force them to pay), it would be absolutely awful optics.
  - thatguy0900 2y ago
    The closest I can think is the old scam where a business would mail you a package then demand payment for the item mailed to you. That was solved by just making anything shipped to you yours with no legal obligation to send it back
    - kmoser 2y ago
      Unfortunately it doesn't work for instances of, say, a bank accidentally depositing extra money in your account, or their ATMs accidentally dispensing too much cash.
      - themaninthedark 2y ago
        Why would it? The situations are entirely different; in the mail package situation, the outside company is attempting to get you to pay for something that you did not request. In the Bank/ATM, the company made a mistake. For the bank situation to work, they would have to add an unrequested service to your account and then attempt to charge you for it. i.e. Bank adds overdraft protection to you checking account and then bills you for it. Say you have an internet plan with a 5GB download limit and after 5GB the connection would no longer send data, one month it lets you download 7GB and then they send you a bill for going over. You probably would not have to pay the bill since they changed their behavior and provided extra without prior notification.
  - TZubiri 2y ago
    Re:Optics, I agree, but I think they would be counterweighted by the dimension of the issue fixed. To put a hypothetical example, if I fix a life threatening electrical or structural issue in a children's hospital unsolicited, whatever hit to my reputation I take by charging for unsolicited work, is dwarved and possible restored and reversed by the gravity of the issue fixed and the consquences avoided. Of course this is contingent on whether the value was actually provided and whether it is provable.
- pizzafeelsright 2y ago
  I spent a minute reading this. My time is worth $300/hr and I bill in tenths of an hour. Where do I send the invoice?
  - TZubiri 2y ago
    "For example, to state a claim for unjust enrichment in New York, a plaintiff must allege that (1) defendant was enriched; (2) the enrichment was at plaintiff's expense; and (3) the circumstances were such that equity and good conscience require defendants to make restitution.[1]" Of course that (3) is the contentious point typically, but you haven't even gotten (1) right. How does you reading my comment provide value to me? It's also funny that, excluding the element of a relationship previously existing, This is the way most business on an hourly basis is made. Suppose you have a lawyer, you agree on 300$/hr, then you ask them to draft a contract and pay them 600$/hr. If someday you are imprisoned and your lawyer is contacted by law enforcement, and they have to bail you out of jail. They would typically send you an invoice even if you didn't solicit that specific service. While it's not insignificant that you had a previous hourly arrangement for a different type of work, it's certainly not a sufficient reason to claim that you owe them for their time and bond monies.
- rafram 2y ago
  Can those people who wash your windshield at red lights actually make you pay? If your neighbor leaves their door unlocked while they’re at work, can you go change the locks (for their safety!) and bill them for your time? No, of course not. Why would you be able to bill for a service that you weren’t asked to provide?
  - bmicraft 2y ago
    Well, in a case such as this: because they're putting other people's data/money at risk and should have payed somebody to discover flaws like this in the first place. It's not the law but maybe it should be.
    - rafram 2y ago
      And if you can’t see out of your dirty windshield, you could cause an accident. If your neighbor’s door is unlocked all day, someone could break in and steal their TV. I mean, why should I even need to apply for any job? McDonald’s always needs workers; do you think they’ll mind if I walk into the kitchen, start flipping burgers, and then name my hourly rate at the end of the day?
      - bmicraft 2y ago
        We were talking about "reasonable", which your reply seems to miss completely. Reasonable can mean a lot of things, including a predefined rate or a fixed way to calculate compensation owed.
    - giancarlostoro 2y ago
      Legal extortion you way?
      - the8472 2y ago
        Well, the users of the system should be able to recoup some of their costs for services (security) not rendered and then pay the researcher for that. In a more well-coordinated society none of this would happen because the company would have avoided the predictable outcome by hiring a security person in the first place.
- tptacek 2y ago
  Of course not.
- yapyap 2y ago
  They can not.
- snakeyjake 2y ago
  Yes, they can. Anyone can sue anyone else for any reason. It will be a colossal waste of everyone's time and money, though, because they will never prevail.
- dizhn 2y ago
  That sounds like a fine, not an invoice. If you can compel them to pay, sure. ;)
  - TZubiri 2y ago
    No. A fine is punitive, an invoice is compensatory.
- znpy 2y ago
  most door locks can be easily picked. can i go from house to house, pick locks and then demand payment? (spoiler: no)
  - TZubiri 2y ago
    I feel you are just applying a classic example from ethical hacking 101 that doesn't apply at all. The common example is that a house can have a door without lock, but it is still a crime to enter. Similarly, entering into a vulnerable system or a system without password even is not legal (although of course the existence of a password or lock mechanism makes undeniable the fact that the place is not for public entry) In this case there is no entering into any system. There is no lock picked, no server accessed.
    - znpy 2y ago
      irrelevant. can i just decide on my own to do some work, and then *demand* payment for such work? the answer is still no.
Retr0id 2y ago
Companies have little direct motivation to have good security practices, they're only motivated to manage their reputation. Any attention they pay to security is only a side-effect of caring about reputation management.
- diggan 2y ago
  And ultimately, the only reason they care about their reputation is because it affects their profits. For-profit companies optimize for profits, as always :)
  - sirlone 2y ago
    So the mom-and-pop donut shop on the corner always optimizes for profits? The local donut shop? Most companies do not actually optimize for profit. If they did they'd stop whatever it is they are currently doing and switch to whatever industry makes the most profit. They don't though, they keep making/doing whatever it is they start with generally. That means they aren't actually optimizing for profit.
    - neilwilson 2y ago
      That is optimising for profit. One of the problems with any comparative advantage argument is that capital is destroyed during any pivot. That cost has to be factored into the return from pivoting.
    - eddd-ddde 2y ago
      Not all work is equal. Value is derived from having an edge over the competition. If you are a good baker then baking may be optimizing for profit. Also if everyone just switched to X it wouldn't be the best option anymore.
    - jbs789 2y ago
      Umm… continuing the donut example, the owners are likely maximising their return given their skill sets, knowledge, time, etc. But return is pretty nuanced too bc it probably is not just be profits, but family time etc. in any event, I think you’re right that businesses don’t just focus on profits. But the example doesn’t prove the point.
znpy 2y ago
> The only way to (sometimes) get big companies to fix their mistakes (besides the legal system) is to shame them into it. in the golden years of twitter the quickest way to get proper support from companies was to talk shit about their services on twitter. i was always amazed by how quick i could get in touch with an actual human being using that strategy. this remind me of some other borderline unethical techniques i read online... basically when dealing some kind of problems with non-IT infrastructure, if you cannot get "support" to acknowledge issues then you change your strategy and write to the lawyers from the company or public entity managing that piece of infrastructure and inform them of the legal liability deriving from the issue that you noticed. once that is done, if ANYTHING happens, they cannot deny knowledge of the issue. they will involve whoever is needed, internally, to get the issue fixed. so yeah... basically often times to get technical issues fixed you're better off resorting to a human (rather than technical) approach.
cedws 2y ago
Mastercard should be heavily fined for this. And I mean really heavily, like some percentage, or fraction of a percentage of global revenue. That's how you get them to take security seriously.
- josh_cutler 2y ago
  By who?
  - imtringued 2y ago
    According to German law, a competitor (possibly Visa) can sue a company for uncompetitive behaviour that has the potential to affect the consumer negatively. This means that at least in theory a security researcher could work as a contractor at a competing firm to then let their legal department send a cease and desist letter and demand recouperation of the legal fees including the money paid to the security researcher to find the vulnerability. Anyone who quotes me on this in their court case is an idiot.
hinkley 2y ago
Also Mastercard: You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two years. We aren’t calling you about the TV. We’re calling about the $8 car wash. (Actual incident)
- diffuse_l 2y ago
  Another story: I was abroad, and someone got my card details and made purchases for thousands of $ in a different part of the country that I don't usually visit and certainly doesn't purchase there stuff for that amount of money. Nobody even cared, but a payment I made for 2 euros wasn't accepted becuase reasons, and every online purchase needed some authorization. When I called them, they said they'll look into the purchases. Well, they cancelled the purchases quite fast, but the surrealism of it all...
  - vrosas 2y ago
    When I worked at another large credit card issuer, I was told the algorithm to detect fraud was essentially a black box. No one left at the company really knew how it worked or how to change it, so it was left intact and new rules were simply added on top.
    - baq 2y ago
      If they don’t know, at least the fraudsters won’t, either!
      - hinkley 2y ago
        I hate that this is true. There's always some third party thing I'm trying to figure out why it's telling me 'no' and not providing useful error messages and it's because they can't tell me without also telling the mischief-makers.
    - IYasha 2y ago
      This is truly the next level of "Security by Obscurity"! :'D
deleted 2y ago
[deleted]

zettabomb 2y ago

Yeah, isn't it pretty standard to first report privately, then report publicly if they don't take any action (and you believe it to still be an issue)? That seems consistent with mosr organization's responsible disclosure practices.

JohnMakin 2y ago
this is standard, but there are people out there that believe this is malicious/blackmailing behavior. I think it’s the most responsible thing you can do here. This guy could’ve made a bucket off this find, instead reports it responsibly and mitigates the risk (with his own money invested) and gets told to pound sand.

TZubiri 2y ago

Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not paid?

ziddoap 2y ago
The only people that I know do this are "Beg Bounty" "Security Researchers" that are, essentially, attempting to extort people. Even if it would be legally possible (I don't think you can force your 'services' on an unwilling entity and then force them to pay), it would be absolutely awful optics.
- thatguy0900 2y ago
  The closest I can think is the old scam where a business would mail you a package then demand payment for the item mailed to you. That was solved by just making anything shipped to you yours with no legal obligation to send it back
  - kmoser 2y ago
    Unfortunately it doesn't work for instances of, say, a bank accidentally depositing extra money in your account, or their ATMs accidentally dispensing too much cash.
    - themaninthedark 2y ago
      Why would it? The situations are entirely different; in the mail package situation, the outside company is attempting to get you to pay for something that you did not request. In the Bank/ATM, the company made a mistake. For the bank situation to work, they would have to add an unrequested service to your account and then attempt to charge you for it. i.e. Bank adds overdraft protection to you checking account and then bills you for it. Say you have an internet plan with a 5GB download limit and after 5GB the connection would no longer send data, one month it lets you download 7GB and then they send you a bill for going over. You probably would not have to pay the bill since they changed their behavior and provided extra without prior notification.
- TZubiri 2y ago
  Re:Optics, I agree, but I think they would be counterweighted by the dimension of the issue fixed. To put a hypothetical example, if I fix a life threatening electrical or structural issue in a children's hospital unsolicited, whatever hit to my reputation I take by charging for unsolicited work, is dwarved and possible restored and reversed by the gravity of the issue fixed and the consquences avoided. Of course this is contingent on whether the value was actually provided and whether it is provable.
pizzafeelsright 2y ago
I spent a minute reading this. My time is worth $300/hr and I bill in tenths of an hour. Where do I send the invoice?
- TZubiri 2y ago
  "For example, to state a claim for unjust enrichment in New York, a plaintiff must allege that (1) defendant was enriched; (2) the enrichment was at plaintiff's expense; and (3) the circumstances were such that equity and good conscience require defendants to make restitution.[1]" Of course that (3) is the contentious point typically, but you haven't even gotten (1) right. How does you reading my comment provide value to me? It's also funny that, excluding the element of a relationship previously existing, This is the way most business on an hourly basis is made. Suppose you have a lawyer, you agree on 300$/hr, then you ask them to draft a contract and pay them 600$/hr. If someday you are imprisoned and your lawyer is contacted by law enforcement, and they have to bail you out of jail. They would typically send you an invoice even if you didn't solicit that specific service. While it's not insignificant that you had a previous hourly arrangement for a different type of work, it's certainly not a sufficient reason to claim that you owe them for their time and bond monies.
rafram 2y ago
Can those people who wash your windshield at red lights actually make you pay? If your neighbor leaves their door unlocked while they’re at work, can you go change the locks (for their safety!) and bill them for your time? No, of course not. Why would you be able to bill for a service that you weren’t asked to provide?
- bmicraft 2y ago
  Well, in a case such as this: because they're putting other people's data/money at risk and should have payed somebody to discover flaws like this in the first place. It's not the law but maybe it should be.
  - rafram 2y ago
    And if you can’t see out of your dirty windshield, you could cause an accident. If your neighbor’s door is unlocked all day, someone could break in and steal their TV. I mean, why should I even need to apply for any job? McDonald’s always needs workers; do you think they’ll mind if I walk into the kitchen, start flipping burgers, and then name my hourly rate at the end of the day?
    - bmicraft 2y ago
      We were talking about "reasonable", which your reply seems to miss completely. Reasonable can mean a lot of things, including a predefined rate or a fixed way to calculate compensation owed.
  - giancarlostoro 2y ago
    Legal extortion you way?
    - the8472 2y ago
      Well, the users of the system should be able to recoup some of their costs for services (security) not rendered and then pay the researcher for that. In a more well-coordinated society none of this would happen because the company would have avoided the predictable outcome by hiring a security person in the first place.
tptacek 2y ago
Of course not.
yapyap 2y ago
They can not.
snakeyjake 2y ago
Yes, they can. Anyone can sue anyone else for any reason. It will be a colossal waste of everyone's time and money, though, because they will never prevail.
dizhn 2y ago
That sounds like a fine, not an invoice. If you can compel them to pay, sure. ;)
- TZubiri 2y ago
  No. A fine is punitive, an invoice is compensatory.
znpy 2y ago
most door locks can be easily picked. can i go from house to house, pick locks and then demand payment? (spoiler: no)
- TZubiri 2y ago
  I feel you are just applying a classic example from ethical hacking 101 that doesn't apply at all. The common example is that a house can have a door without lock, but it is still a crime to enter. Similarly, entering into a vulnerable system or a system without password even is not legal (although of course the existence of a password or lock mechanism makes undeniable the fact that the place is not for public entry) In this case there is no entering into any system. There is no lock picked, no server accessed.
  - znpy 2y ago
    irrelevant. can i just decide on my own to do some work, and then *demand* payment for such work? the answer is still no.

Retr0id 2y ago

Companies have little direct motivation to have good security practices, they're only motivated to manage their reputation. Any attention they pay to security is only a side-effect of caring about reputation management.

diggan 2y ago
And ultimately, the only reason they care about their reputation is because it affects their profits. For-profit companies optimize for profits, as always :)
- sirlone 2y ago
  So the mom-and-pop donut shop on the corner always optimizes for profits? The local donut shop? Most companies do not actually optimize for profit. If they did they'd stop whatever it is they are currently doing and switch to whatever industry makes the most profit. They don't though, they keep making/doing whatever it is they start with generally. That means they aren't actually optimizing for profit.
  - neilwilson 2y ago
    That is optimising for profit. One of the problems with any comparative advantage argument is that capital is destroyed during any pivot. That cost has to be factored into the return from pivoting.
  - eddd-ddde 2y ago
    Not all work is equal. Value is derived from having an edge over the competition. If you are a good baker then baking may be optimizing for profit. Also if everyone just switched to X it wouldn't be the best option anymore.
  - jbs789 2y ago
    Umm… continuing the donut example, the owners are likely maximising their return given their skill sets, knowledge, time, etc. But return is pretty nuanced too bc it probably is not just be profits, but family time etc. in any event, I think you’re right that businesses don’t just focus on profits. But the example doesn’t prove the point.

znpy 2y ago

> The only way to (sometimes) get big companies to fix their mistakes (besides the legal system) is to shame them into it. in the golden years of twitter the quickest way to get proper support from companies was to talk shit about their services on twitter. i was always amazed by how quick i could get in touch with an actual human being using that strategy. this remind me of some other borderline unethical techniques i read online... basically when dealing some kind of problems with non-IT infrastructure, if you cannot get "support" to acknowledge issues then you change your strategy and write to the lawyers from the company or public entity managing that piece of infrastructure and inform them of the legal liability deriving from the issue that you noticed. once that is done, if ANYTHING happens, they cannot deny knowledge of the issue. they will involve whoever is needed, internally, to get the issue fixed. so yeah... basically often times to get technical issues fixed you're better off resorting to a human (rather than technical) approach.

cedws 2y ago

Mastercard should be heavily fined for this. And I mean really heavily, like some percentage, or fraction of a percentage of global revenue. That's how you get them to take security seriously.

josh_cutler 2y ago
By who?
- imtringued 2y ago
  According to German law, a competitor (possibly Visa) can sue a company for uncompetitive behaviour that has the potential to affect the consumer negatively. This means that at least in theory a security researcher could work as a contractor at a competing firm to then let their legal department send a cease and desist letter and demand recouperation of the legal fees including the money paid to the security researcher to find the vulnerability. Anyone who quotes me on this in their court case is an idiot.

hinkley 2y ago

Also Mastercard: You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two years. We aren’t calling you about the TV. We’re calling about the $8 car wash. (Actual incident)

diffuse_l 2y ago
Another story: I was abroad, and someone got my card details and made purchases for thousands of $ in a different part of the country that I don't usually visit and certainly doesn't purchase there stuff for that amount of money. Nobody even cared, but a payment I made for 2 euros wasn't accepted becuase reasons, and every online purchase needed some authorization. When I called them, they said they'll look into the purchases. Well, they cancelled the purchases quite fast, but the surrealism of it all...
- vrosas 2y ago
  When I worked at another large credit card issuer, I was told the algorithm to detect fraud was essentially a black box. No one left at the company really knew how it worked or how to change it, so it was left intact and new rules were simply added on top.
  - baq 2y ago
    If they don’t know, at least the fraudsters won’t, either!
    - hinkley 2y ago
      I hate that this is true. There's always some third party thing I'm trying to figure out why it's telling me 'no' and not providing useful error messages and it's because they can't tell me without also telling the mischief-makers.
  - IYasha 2y ago
    This is truly the next level of "Security by Obscurity"! :'D

deleted 2y ago

[deleted]