3 ms·

> A few hours later, MasterCard acknowledged the mistake, but said there was never any real threat to the security of its operations. > “We have looked into th

> A few hours later, MasterCard acknowledged the mistake, but said there was never any real threat to the security of its operations. > “We have looked into the matter and there was not a risk to our systems,” a MasterCard spokesperson wrote. “This typo has now been corrected.” Always the same. These statements make my blood boil.

Hizonner 2y ago
Yeah. What they really mean is "we talked to a clueless drone in our IT department, who had a personal incentive not to find any exposure, and that person couldn't think of a way to exploit it in 15 seconds". If you actually know what you're talking about, you basically never feel safe enough to categorically say that something can't be exploited.
emmelaich 2y ago
Their thinking is .. one hand if we ack the problem we risk losing millions in share value. If we deny, a bunch of nerds will whine a bit more. Without a proof of compromise, sadly it's difficult to force. With a proof of compromise, you're going to jail.
- noisy_boy 2y ago
  Seems to me that there needs to be a third-party validation authority: 1. It grants a seal/hologram to its members that can be put on products to communicate to the customers that the company takes security validation seriously. Otherwise, they can tell during the marketing presentation that they are not a member and risk making an adverse impression about the security of their product upon their customers (this idea has a dependency on the network-effect which can be hard to get during initial days). 2. Member companies, research companies and individual researchers pay annual membership fees that go towards the operating costs of this authority. The amount is reasonably small for individual researchers or small companies so that it is not a burden. 3. This authority mainly acts as custodian of bug bounties i.e. all bug bounty programs of members are published on its website and it is designated the authorized validator of bounty claims. 4. There is a disclosure framework that this authority, member companies and researchers sign up to. 5. Member companies agree to allow this authority to do the necessary testing of the validation of bounties without threat of suing it. 6. When a researcher finds a vulnerability, it reports the specifics to the authority, instead of risking consequences of legal issues due to any actions by themselves. 7. Upon successful validation, a small percentage of the bounty (e.g. 5 to 10%) goes to the authority and the rest of it is released to the researcher. This acts as an incentive for the authority to vigorously validate the reports.

Hizonner 2y ago

Yeah. What they really mean is "we talked to a clueless drone in our IT department, who had a personal incentive not to find any exposure, and that person couldn't think of a way to exploit it in 15 seconds". If you actually know what you're talking about, you basically never feel safe enough to categorically say that something can't be exploited.

emmelaich 2y ago

Their thinking is .. one hand if we ack the problem we risk losing millions in share value. If we deny, a bunch of nerds will whine a bit more. Without a proof of compromise, sadly it's difficult to force. With a proof of compromise, you're going to jail.

noisy_boy 2y ago
Seems to me that there needs to be a third-party validation authority: 1. It grants a seal/hologram to its members that can be put on products to communicate to the customers that the company takes security validation seriously. Otherwise, they can tell during the marketing presentation that they are not a member and risk making an adverse impression about the security of their product upon their customers (this idea has a dependency on the network-effect which can be hard to get during initial days). 2. Member companies, research companies and individual researchers pay annual membership fees that go towards the operating costs of this authority. The amount is reasonably small for individual researchers or small companies so that it is not a burden. 3. This authority mainly acts as custodian of bug bounties i.e. all bug bounty programs of members are published on its website and it is designated the authorized validator of bounty claims. 4. There is a disclosure framework that this authority, member companies and researchers sign up to. 5. Member companies agree to allow this authority to do the necessary testing of the validation of bounties without threat of suing it. 6. When a researcher finds a vulnerability, it reports the specifics to the authority, instead of risking consequences of legal issues due to any actions by themselves. 7. Upon successful validation, a small percentage of the bounty (e.g. 5 to 10%) goes to the authority and the rest of it is released to the researcher. This acts as an incentive for the authority to vigorously validate the reports.