Onderwerp: Question About Ethics and Full Disclosure

I have sat on 2 vulnerabilities for a shopping cart for over a year and
nothing has changed. Now I have found a 3rd with new services added to this
shopping cart.

I have emailed support several times but NEVER get a response.
As a security professional and not to be Unethical what would be a
recommended path to follow?

* Notify their customers (several 100)
* Notify the Payment Gateways they are Authorized to use
(VeriSign, PayPal, Authorize.NET)
* Be a total A** and just release it to all the mailing lists and at DEFCON

BTW...I have sent several emails to various parts of VeriSign and NOBODY has
responded as to the proper person to notify within the organization about
this. I chose VeriSign because this cart is at the Top of Their List!

IF anyone knows who to contact from VeriSign, authorize.net and PayPal about
this please email me directly.

Thanks,

Tom Ryan

> -----Original Message-----
> From: Tom [mailto:tommy@providesecurity.com]=20
> Sent: Thursday, May 20, 2004 12:43 PM
> To: frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com;=20
> security-basics@securityfocus.com;=20
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: Question About Ethics and Full Disclosure
>=20
>=20
> I have sat on 2 vulnerabilities for a shopping cart for over=20
> a year and
> nothing has changed. Now I have found a 3rd with new=20
> services added to this
> shopping cart.=20
>=20
> I have emailed support several times but NEVER get a response.
> As a security professional and not to be Unethical what would be a
> recommended path to follow?
> =09
> * Notify their customers (several 100)
> * Notify the Payment Gateways they are Authorized to use=20
> (VeriSign, PayPal, Authorize.NET)
> * Be a total A** and just release it to all the mailing lists=20
> and at DEFCON


Is it ethical to not let these customers know that you have an
open door into their systems?

Is it ethical to not let them know that someone else may have the
same open door into their systems?

You can land in hot water if you email the customers directly. Customer
lists are generally considered proprietary information.=20

You can let the customers know through posting to full disclosure
lists.

Post the time details and the contact details.

I don't see how you possibly could have sat on this for a year in
good conscience.


>=20
> BTW...I have sent several emails to various parts of VeriSign=20
> and NOBODY has
> responded as to the proper person to notify within the=20
> organization about
> this. I chose VeriSign because this cart is at the Top of Their List!
>=20
> IF anyone knows who to contact from VeriSign, authorize.net=20
> and PayPal about
> this please email me directly.

You seem to be going beyond what your role should be in this.=20

That can give you legal problems if you are not careful.


>=20
> Thanks,
>=20
> Tom Ryan
>=20
>=20
>=20

Try calling the sales department for the shopping cart vendor. Tell
them you hard about the 2 vulnerabilities, thll them that when they are
fixed, you might perhaps buy their product... Sales motivates
development... Or at the least might get you to a person at the vendor
who cares.

-----Original Message-----
From: Tom [mailto:tommy@providesecurity.com]=20
Sent: Thursday, May 20, 2004 3:43 PM
To: frogman@infosecwar.net
Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
vuln-dev@securityfocus.com; webappsec@securityfocus.com
Subject: Question About Ethics and Full Disclosure


I have sat on 2 vulnerabilities for a shopping cart for over a year and
nothing has changed. Now I have found a 3rd with new services added to
this shopping cart.=20

I have emailed support several times but NEVER get a response.
As a security professional and not to be Unethical what would be a
recommended path to follow?
=09
* Notify their customers (several 100)
* Notify the Payment Gateways they are Authorized to use (VeriSign,
PayPal, Authorize.NET)
* Be a total A** and just release it to all the mailing lists and at
DEFCON

BTW...I have sent several emails to various parts of VeriSign and NOBODY
has responded as to the proper person to notify within the organization
about this. I chose VeriSign because this cart is at the Top of Their
List!

IF anyone knows who to contact from VeriSign, authorize.net and PayPal
about this please email me directly.

Thanks,

Tom Ryan

Well...if it's bugging you that much that the software remains
unpatched, go ahead and post it everywhere. You'd be surprised how
quickly it will get patched.

Tom wrote:

>I have sat on 2 vulnerabilities for a shopping cart for over a year and
>nothing has changed. Now I have found a 3rd with new services added to this
>shopping cart.
>
>I have emailed support several times but NEVER get a response.
>As a security professional and not to be Unethical what would be a
>recommended path to follow?
>
>* Notify their customers (several 100)
>* Notify the Payment Gateways they are Authorized to use
>(VeriSign, PayPal, Authorize.NET)
>* Be a total A** and just release it to all the mailing lists and at DEFCON
>
>BTW...I have sent several emails to various parts of VeriSign and NOBODY has
>responded as to the proper person to notify within the organization about
>this. I chose VeriSign because this cart is at the Top of Their List!
>
>IF anyone knows who to contact from VeriSign, authorize.net and PayPal about
>this please email me directly.
>
>Thanks,
>
>Tom Ryan
>
>
>
>

On Thu, 20 May 2004, Tom wrote:

> I have sat on 2 vulnerabilities for a shopping cart for over a year and
> nothing has changed. Now I have found a 3rd with new services added to
> this shopping cart. /.../

Security research and disclosure is hardly ever black or white. Just as
with any other kind of creative work, there are beneficial and malicious
uses or effects of every bit of information you discover, and endless
arguments can be fought over which of the aspects is predominant in what
disclosure scheme or business / research model. There is no truly
responsible disclosure or non-disclosure, it's just a question of lesser
evil, and there is and will be no consensus as to which is which.

As such, you cannot ask others to provide you a reasonable answer as to
the ethics - you have to seek it yourself and settle with an answer that
makes you feel comfortable. Be your own compass. We can only tell you what
the commonly accepted practice is, and whether the vendor can be
considered negligent for his handling (or lack thereof) of this issue. In
this particular case, the answer to the latter question is yes, assuming
you have made all reasonable attempts to contact them (phone, perhaps?).

Whenever dealing with a stubborn and nonresponsive commercial vendor with
no prior experience with security, you also need to take into account a
possible retaliatory action against you, even if you acted in the way you
considered most ethical. These attempts are generally unlikely to succeed
(don't bet on it, though), but may waste plenty of your time and wreck
your nerves.

> * Notify their customers (several 100)

You can easily upset the vendor, and have them sue you. Naturally, you may
have a point, but is it worth it? Besides, you'd be spamming, and this
venue is perhaps least professional, as it would appear you are pushing a
particular agenda to discredit the vendor.

> * Notify the Payment Gateways they are Authorized to use (VeriSign,
> PayPal, Authorize.NET)

Unlikely to cause any effect, really - they're happy as long as they're
making money.

> * Be a total A** and just release it to all the mailing lists and at
> DEFCON

Up to you, really. Exposing the fact they suck at security might be quite
beneficial for customers in the long run. On the other hand, you can
expect some fraud/abuse in the short term.

--
------------------------- bash$ ){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-05-21 00:06 --

http://lcamtuf.coredump.cx/photo/current/

This is a multi-part message in MIME format.

------=_NextPart_000_0040_01C44DF9.6B0D5D90
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit

Below is an outline for my disclosure process.


Vulnerability Found:

1. E-Mail & Call company about finding
- Document vulnerability
- Document date/time/who you talked to.
- Provide an 'ethical disclosure' reporting deadline
- one to nine months, depending on the vulnerability
- Inform them you will be reporting them to www.cert.org and
www.us-cert.gov

2. Report Vulnerability to:
A. www.cert.org :
http://www.cert.org/reporting/vulnerability_form.txt
B. www.us-cert.gov : cert@cert.org

----
Vulnerability is addressed - day upgrade/patch is released

1. Disclose to your favorite list/lists
- Disclose your process
- Disclose your due diligence
- communication to/from company
- posting to cert.org and us-cert.gov
- Disclose the vulnerability

----
Vulnerability not addressed - one to nine months

1. E-Mail & Call company
- Documentation of vulnerability
- Documentation of your due diligence
- reporting communication to/from company
- reporting to cert.org and us-cert.gov
- Provide date of disclosure

Day of Disclosure:

1. Disclose to your favorite list/lists
- Disclose your process
- Disclose your due diligence
- communication to/from company
- posting to cert.org and us-cert.gov
- Disclose the vulnerability


Opinions?



-----Original Message-----
From: Kevin E. Casey [mailto:kcasey@nanoweb.com]
Sent: Thursday, May 20, 2004 4:31 PM
To: tommy@providesecurity.com; frogman@infosecwar.net
Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
vuln-dev@securityfocus.com; webappsec@securityfocus.com
Subject: RE: Question About Ethics and Full Disclosure


Try calling the sales department for the shopping cart vendor. Tell
them you hard about the 2 vulnerabilities, thll them that when they are
fixed, you might perhaps buy their product... Sales motivates
development... Or at the least might get you to a person at the vendor
who cares.

-----Original Message-----
From: Tom [mailto:tommy@providesecurity.com]
Sent: Thursday, May 20, 2004 3:43 PM
To: frogman@infosecwar.net
Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
vuln-dev@securityfocus.com; webappsec@securityfocus.com
Subject: Question About Ethics and Full Disclosure


I have sat on 2 vulnerabilities for a shopping cart for over a year and
nothing has changed. Now I have found a 3rd with new services added to
this shopping cart.

I have emailed support several times but NEVER get a response. As a
security professional and not to be Unethical what would be a
recommended path to follow?

* Notify their customers (several 100)
* Notify the Payment Gateways they are Authorized to use (VeriSign,
PayPal, Authorize.NET)
* Be a total A** and just release it to all the mailing lists and at
DEFCON

BTW...I have sent several emails to various parts of VeriSign and NOBODY
has responded as to the proper person to notify within the organization
about this. I chose VeriSign because this cart is at the Top of Their
List!

IF anyone knows who to contact from VeriSign, authorize.net and PayPal
about this please email me directly.

Thanks,

Tom Ryan

------=_NextPart_000_0040_01C44DF9.6B0D5D90
Content-Type: text/x-vcard;
name="Joseph S Klein (jsklein@mindspring.com) (jsklein@mindspring.com).vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="Joseph S Klein (jsklein@mindspring.com) (jsklein@mindspring.com).vcf"

BEGIN:VCARD
VERSION:2.1
N:Klein;Joseph;S
FN:Joseph S Klein (jsklein@mindspring.com) (jsklein@mindspring.com)
TITLE:Security Consultant
TEL;WORK;VOICE904) 384-1523
TEL;HOME;VOICE904) 384-1523
TEL;CELL;VOICE904) 610-5312
TEL;WORK;FAX904) 384-1502
TEL;HOME;FAX904) 384-1502
ADR;WORK:;;1087 Ingleside Av;Jacksonville;FL;32205;United States of =
America
LABEL;WORK;ENCODING=3DQUOTED-PRINTABLE:1087 Ingleside =
Av=3D0D=3D0AJacksonville, FL 32205=3D0D=3D0AUnited States of America
ADR;HOME:;;1087 Ingleside Av;Jacksonville;FL;32205;United States of =
America
LABEL;HOME;ENCODING=3DQUOTED-PRINTABLE:1087 Ingleside =
Av=3D0D=3D0AJacksonville, FL 32205=3D0D=3D0AUnited States of America
EMAIL;PREF;INTERNET:jsklein@mindspring.com
REV:20040412T131111Z
END:VCARD

------=_NextPart_000_0040_01C44DF9.6B0D5D90--

That's a good way of doing it. I think it would be better to shorten the
period of time from 1-9 months to 1-5. When you're reporting a
vulnerability, you should try and report the fix for it too. In my opinion,
exploit code should be posted a few weeks after the vulnerability has been
reported to ensure that the company works on a fix.
-OptiKal Mouse

>From: "Joe Klein" <jsklein@mindspring.com>
>Reply-To: <jsklein@mindspring.com>
>To: "'Kevin E. Casey'" <kcasey@nanoweb.com>,<tommy@providesecurity.com> ,
><frogman@infosecwar.net>
>CC: <bugtraq@securityfocus.com>,
><security-basics@securityfocus.com>,<vuln-dev@securityfocus.com>,
><webappsec@securityfocus.com>
>Subject: RE: Question About Ethics and Full Disclosure
>Date: Wed, 9 Jun 2004 08:11:48 -0500
>MIME-Version: 1.0
>Received: from outgoing2.securityfocus.com ([205.206.231.26]) by
>mc6-f39.hotmail.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 9 Jun 2004
>17:14:24 -0700
>Received: from lists2.securityfocus.com (lists2.securityfocus.com
>[205.206.231.20])by outgoing2.securityfocus.com (Postfix) with QMQPid
>60A49143AF0; Wed, 9 Jun 2004 20:17:34 -0600 (MDT)
>Received: (qmail 25671 invoked from network); 9 Jun 2004 07:00:52 -0000
>X-Message-Info: JGTYoYF78jGL48EpGnia7jun7YIUh0SR
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Message-ID: <003f01c44e23$53e36590$6401a8c0@nsaifly>
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook, Build 10.0.2627
>In-Reply-To:
><96B5E0E83D6A07428B6CDB8775AB9FBA277007@domain01. nanonaples.com>
>X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
>Return-Path: bugtraq-return-14677-sysop5=hotmail.com@securityfocus.com
>X-OriginalArrivalTime: 10 Jun 2004 00:14:24.0217 (UTC)
>FILETIME=[E290CC90:01C44E7F]
>
>Below is an outline for my disclosure process.
>
>
>Vulnerability Found:
>
>1. E-Mail & Call company about finding
> - Document vulnerability
> - Document date/time/who you talked to.
> - Provide an 'ethical disclosure' reporting deadline
> - one to nine months, depending on the vulnerability
> - Inform them you will be reporting them to www.cert.org and
>www.us-cert.gov
>
>2. Report Vulnerability to:
> A. www.cert.org :
>http://www.cert.org/reporting/vulnerability_form.txt
> B. www.us-cert.gov : cert@cert.org
>
>----
>Vulnerability is addressed - day upgrade/patch is released
>
>1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>
>----
>Vulnerability not addressed - one to nine months
>
>1. E-Mail & Call company
> - Documentation of vulnerability
> - Documentation of your due diligence
> - reporting communication to/from company
> - reporting to cert.org and us-cert.gov
> - Provide date of disclosure
>
>Day of Disclosure:
>
>1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>
>
>Opinions?
>
>
>
>-----Original Message-----
>From: Kevin E. Casey [mailto:kcasey@nanoweb.com]
>Sent: Thursday, May 20, 2004 4:31 PM
>To: tommy@providesecurity.com; frogman@infosecwar.net
>Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
>vuln-dev@securityfocus.com; webappsec@securityfocus.com
>Subject: RE: Question About Ethics and Full Disclosure
>
>
>Try calling the sales department for the shopping cart vendor. Tell
>them you hard about the 2 vulnerabilities, thll them that when they are
>fixed, you might perhaps buy their product... Sales motivates
>development... Or at the least might get you to a person at the vendor
>who cares.
>
>-----Original Message-----
>From: Tom [mailto:tommy@providesecurity.com]
>Sent: Thursday, May 20, 2004 3:43 PM
>To: frogman@infosecwar.net
>Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
>vuln-dev@securityfocus.com; webappsec@securityfocus.com
>Subject: Question About Ethics and Full Disclosure
>
>
>I have sat on 2 vulnerabilities for a shopping cart for over a year and
>nothing has changed. Now I have found a 3rd with new services added to
>this shopping cart.
>
>I have emailed support several times but NEVER get a response. As a
>security professional and not to be Unethical what would be a
>recommended path to follow?
>
>* Notify their customers (several 100)
>* Notify the Payment Gateways they are Authorized to use (VeriSign,
>PayPal, Authorize.NET)
>* Be a total A** and just release it to all the mailing lists and at
>DEFCON
>
>BTW...I have sent several emails to various parts of VeriSign and NOBODY
>has responded as to the proper person to notify within the organization
>about this. I chose VeriSign because this cart is at the Top of Their
>List!
>
>IF anyone knows who to contact from VeriSign, authorize.net and PayPal
>about this please email me directly.
>
>Thanks,
>
>Tom Ryan
><< JosephSKlein(jsklein@mindspring.com)(jsklein@minds pring.com).vcf >>

__________________________________________________ _______________
Get fast, reliable Internet access with MSN 9 Dial-up – now 3 months FREE!
http://join.msn.click-url.com/go/onm...ave/direct/01/

=20

> -----Original Message-----
> From: Joe Klein [mailto:jsklein@mindspring.com]=20
> Sent: Wednesday, June 09, 2004 6:12 AM
> To: 'Kevin E. Casey'; tommy@providesecurity.com;=20
> frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com;=20
> security-basics@securityfocus.com;=20
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: RE: Question About Ethics and Full Disclosure
>=20
> Below is an outline for my disclosure process.
>=20
>=20
> Vulnerability Found:
>=20
> 1. E-Mail & Call company about finding=20
> - Document vulnerability
> - Document date/time/who you talked to.
> - Provide an 'ethical disclosure' reporting deadline=20
> - one to nine months, depending on the vulnerability
> - Inform them you will be reporting them to www.cert.org and
> www.us-cert.gov=20
>=20
> 2. Report Vulnerability to:
> A. www.cert.org :
> http://www.cert.org/reporting/vulnerability_form.txt
> B. www.us-cert.gov : cert@cert.org
>=20
> ----
> Vulnerability is addressed - day upgrade/patch is released
>=20
> 1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>=20
> ----
> Vulnerability not addressed - one to nine months
>=20
> 1. E-Mail & Call company
> - Documentation of vulnerability
> - Documentation of your due diligence
> - reporting communication to/from company
> - reporting to cert.org and us-cert.gov
> - Provide date of disclosure
>=20
> Day of Disclosure:
>=20
> 1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>=20
>=20
> Opinions?

We reported a vulnerability to CERT and it got leaked (the XDR
vulnerability). They have had other leaks as well. Love some of their
papers, though. =20

We have never had problems reporting just to the vendor... well, except
the obvious ones... But, workable problems.



>=20
>=20
>=20
> -----Original Message-----
> From: Kevin E. Casey [mailto:kcasey@nanoweb.com]=20
> Sent: Thursday, May 20, 2004 4:31 PM
> To: tommy@providesecurity.com; frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: RE: Question About Ethics and Full Disclosure
>=20
>=20
> Try calling the sales department for the shopping cart vendor. Tell
> them you hard about the 2 vulnerabilities, thll them that=20
> when they are
> fixed, you might perhaps buy their product... Sales motivates
> development... Or at the least might get you to a person at the vendor
> who cares.
>=20
> -----Original Message-----
> From: Tom [mailto:tommy@providesecurity.com]=20
> Sent: Thursday, May 20, 2004 3:43 PM
> To: frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: Question About Ethics and Full Disclosure
>=20
>=20
> I have sat on 2 vulnerabilities for a shopping cart for over=20
> a year and
> nothing has changed. Now I have found a 3rd with new=20
> services added to
> this shopping cart.=20
>=20
> I have emailed support several times but NEVER get a response. As a
> security professional and not to be Unethical what would be a
> recommended path to follow?
> =09
> * Notify their customers (several 100)
> * Notify the Payment Gateways they are Authorized to use (VeriSign,
> PayPal, Authorize.NET)
> * Be a total A** and just release it to all the mailing lists and at
> DEFCON
>=20
> BTW...I have sent several emails to various parts of VeriSign=20
> and NOBODY
> has responded as to the proper person to notify within the=20
> organization
> about this. I chose VeriSign because this cart is at the Top of Their
> List!
>=20
> IF anyone knows who to contact from VeriSign, authorize.net and PayPal
> about this please email me directly.
>=20
> Thanks,
>=20
> Tom Ryan
>=20

Just my 2 cents - why reporting it to US-CERT as an exceptional "US"-case? I
really don't see why US should exclusively be informed about all disclosures of
vulnerabilities; not to mention the fact that I trust CERT to be reporting the
disclosures to them if they find that action appropriate.

Greetings,

Stefan de Bruijn.


Joe Klein wrote:

> Below is an outline for my disclosure process.
>
>
> Vulnerability Found:
>
> 1. E-Mail & Call company about finding
> - Document vulnerability
> - Document date/time/who you talked to.
> - Provide an 'ethical disclosure' reporting deadline
> - one to nine months, depending on the vulnerability
> - Inform them you will be reporting them to www.cert.org and
> www.us-cert.gov
>
> 2. Report Vulnerability to:
> A. www.cert.org :
> http://www.cert.org/reporting/vulnerability_form.txt
> B. www.us-cert.gov : cert@cert.org
>
> ----
> Vulnerability is addressed - day upgrade/patch is released
>
> 1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>
> ----
> Vulnerability not addressed - one to nine months
>
> 1. E-Mail & Call company
> - Documentation of vulnerability
> - Documentation of your due diligence
> - reporting communication to/from company
> - reporting to cert.org and us-cert.gov
> - Provide date of disclosure
>
> Day of Disclosure:
>
> 1. Disclose to your favorite list/lists
> - Disclose your process
> - Disclose your due diligence
> - communication to/from company
> - posting to cert.org and us-cert.gov
> - Disclose the vulnerability
>
>
> Opinions?
>
>
>
> -----Original Message-----
> From: Kevin E. Casey [mailto:kcasey@nanoweb.com]
> Sent: Thursday, May 20, 2004 4:31 PM
> To: tommy@providesecurity.com; frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: RE: Question About Ethics and Full Disclosure
>
>
> Try calling the sales department for the shopping cart vendor. Tell
> them you hard about the 2 vulnerabilities, thll them that when they are
> fixed, you might perhaps buy their product... Sales motivates
> development... Or at the least might get you to a person at the vendor
> who cares.
>
> -----Original Message-----
> From: Tom [mailto:tommy@providesecurity.com]
> Sent: Thursday, May 20, 2004 3:43 PM
> To: frogman@infosecwar.net
> Cc: bugtraq@securityfocus.com; security-basics@securityfocus.com;
> vuln-dev@securityfocus.com; webappsec@securityfocus.com
> Subject: Question About Ethics and Full Disclosure
>
>
> I have sat on 2 vulnerabilities for a shopping cart for over a year and
> nothing has changed. Now I have found a 3rd with new services added to
> this shopping cart.
>
> I have emailed support several times but NEVER get a response. As a
> security professional and not to be Unethical what would be a
> recommended path to follow?
>
> * Notify their customers (several 100)
> * Notify the Payment Gateways they are Authorized to use (VeriSign,
> PayPal, Authorize.NET)
> * Be a total A** and just release it to all the mailing lists and at
> DEFCON
>
> BTW...I have sent several emails to various parts of VeriSign and NOBODY
> has responded as to the proper person to notify within the organization
> about this. I chose VeriSign because this cart is at the Top of Their
> List!
>
> IF anyone knows who to contact from VeriSign, authorize.net and PayPal
> about this please email me directly.
>
> Thanks,
>
> Tom Ryan

--
Slapen is nuttig. Het zorgt er namelijk voor dat je niet meer hoeft te slapen -
en aangezien slapen compleet nutteloos is, is slapen dus een nuttige bezigheid.