4 ms·
This is like punching a guy who hands you the wallet you just dropped. This was entirely RESPONSIBLE DISCLOSURE. They need to send a basket of muffins to the
by deepnet 11y ago
This is like punching a guy who hands you the wallet you just dropped.
This was entirely RESPONSIBLE DISCLOSURE.
They need to send a basket of muffins to the guy.
Surely they should take INTENT into account.
The interesting question is : How much has Starbucks lost because of this vulnerability ( the white hat may not have been the 1st to discover it ) ?
- raverbashing 11y agoYeah, responding to a limited (experimental) exploitation of a vulnerability in a hostile way will usually make people think twice, and selling the vulnerability to 3rd parts will seem more interesting.
- IgorPartola 11y agoApparently one of the common scams in Eastern Europe is to drop a wallet by a tourist. When the tourist picks up the wallet and hands it back, the scammer starts loudly yelling that the tourist stole their wallet, threatening to call the police if the tourist doesn't give them some cash. So I guess sometimes it does pay to punch they guy handing you your own wallet.
- aikah 11y agoNot just in eastern Europe, there was a variation of this scam in Amsterdam(at least 10 years ago), where an alleged drug dealer would hold some white powder in his hands and bump into you on purpose, so that it makes him drop the powder, then the guy would say that you wasted his drugs and you should pay him money as reparation.
- lkrubner 11y agoI ran into this scam in New York City last year, I was walking down 8th Avenue, up at 115st, a guy bumped into me and dropped a bag on the ground, the bag started to leak, he said he had just bought some expensive whiskey, now it was wasted, I should pay him so he could replace the whiskey, etc, etc. An obvious scam.
- martin-adams 11y agoI'd love to watch too scammers bump into each other and see how that unfolds.
- Stenerson 11y agoProbably something like this https://www.youtube.com/watch?v=WnzlbyTZsQY https://www.youtube.com/watch?v=WnzlbyTZsQY
- chadscira 11y agoIt fascinates me that a $80B publicly traded company that is one of the leaders in gift cards doesn't take security more seriously... They seriously need to invest in security :/, im sure they have lost a good amount of money to this issue considering that its been around since 2012.
- deepnet 11y agoDid they fix it ? Perhaps they cannot fix it ? Maybe their IT is in denial ? Interested to see a follow-up report.
- chadscira 11y agoWhen i initially reported it, it felt like they quickly had me speaking directly with the person that was possibly at fault in order to fix the problem. But at the same time it did feel like they were internally sweeping it under the rug. I think its more likely that they hid the fact that this happened/was happening and that resulted in this issue resurfacing.
- pkaye 11y agoShould they not be maximizing value to the shareholders?
- GhotiFish 11y agoI wonder if there would be anything you could say at that point to get them to follow through (without implying any intent to exploit obviously). I couldn't imagine a better boost to a security professionals career than getting sued over finding a very serious vulnerability and disclosing it in entirely good faith, only to get sued for the deed. It's outrageous enough to make headway online, you'd never actually face any repercussions, and your name would be everywhere due to the story.