Bank of America contact

[Lance James]

Hi bugtraq,

Does anyone know anyone that I would contact to address certain
security issues at Bank of America. I see that Wells Fargo and
Citibank has direct contacts, but not BofA. Please let me know.
Thanks.

--
Best regards,
Lance James mailto:lance@securescience.net
Secure Science Corporation
www.securescience.net

[Jon W]

In-Reply-To: <99322464468.20040223103135@securescience.net>

I work at Bank of America. I asked our incident-response team, and they would like the BUGTRAQ community to know that abuse@bankofamerica.com is monitored for reports by real security admins.

So that would be the main point of contact for reports.

---Thanks
---Jon W.

[Lance James]

Hello bugtraq,

Hi bugtraq,

I'd like to thank everyone for their replies, suggestions, and contact
information. No two people provided the same information. This suggests
to us that Bank of America does not have a central contact for security
risks.

We received about a half-dozen Bank of America contacts and we will be
following up with 2-3 of them shortly.

I'd also like to thank the 0-day social engineers for their variety of
approaches used to attempt to gain access to this exploit. We received
responses ranging from fraudulent "Bank of America" employees to phone
calls from people claiming to be from Bank of America's IT Security. (One
caller claimed to be from Bank of America's IT Security but didn't know
what PGP is and then said he couldn't give his PGP key due to security
restrictions. And when we asked him to provide information so we could
verify the contact, he said he would call back but never did. To this
caller: Yes, your social engineering failed and your caller-id spoofing was
almost perfect. Emphasis on "almost".)


To summarize, we seem to have identified 3 risks.
The first is a minor issue that we are attempting to report to Bank of
America.
The second is a lack of official central contact for reporting security
risks to Bank of America.
The third is the plethora of 0-day social engineers that appear to jump on
security risks and represent themselves as the affected company in order to
gain access to the privileged information. A warning to people reporting
security risks: beware of who you talk to.

--
Best regards,
Lance James
www.securescience.net mailto:lancej@securescience.net
Secure Science Corporation

[Eloy A. Paris]

Jon,

This is a message directed more to your company's incident response team
that to you, but I don't know how to reach them. I hope they follow
Bugtraq, or that you forward the message.

Jon W <jonw@ripco.com> writes:

> I work at Bank of America. I asked our incident-response team, and
> they would like the BUGTRAQ community to know that
> abuse@bankofamerica.com is monitored for reports by real security
> admins.
>
> So that would be the main point of contact for reports.

Let's say that you didn't happen to be monitoring Bugtraq. How does
someone not associated with your company find the right point of contact
information for reporting security problems to your company?

I quickly searched BoA's web site and couldn't find anything that
pointed to the e-mail address you mention. I found information on how to
report a lost or stolen ATM, check, and credit cards, how to handle
identity theft, but nothing on how to report, for example, a
vulnerability in a BoA web application. Please correct me if I missed
the obvious.

In other words, it seems fairly easy for a customer to find information
on how to report fraud, but it is not easy for a security researcher (or
even a regular customer) to find information on how to report
vulnerabilities in the company's infrastructure.

This type of information should be provided in a very prominent place at
the company's website.

Cheers,

Eloy.-