Also Mastercard: has expressed concerns about the public nature of this disclosure.
Good for him for making it all public. The only way to (sometimes) get big companies to fix their mistakes (besides the legal system) is to shame them into it.
You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two years.
We aren’t calling you about the TV. We’re calling about the $8 car wash.
(Actual incident)
Nobody even cared, but a payment I made for 2 euros wasn't accepted becuase reasons, and every online purchase needed some authorization.
When I called them, they said they'll look into the purchases. Well, they cancelled the purchases quite fast, but the surrealism of it all...
There's always some third party thing I'm trying to figure out why it's telling me 'no' and not providing useful error messages and it's because they can't tell me without also telling the mischief-makers.
Seriously?!?
Everybody knows that's not a random number.
Which is to say, if someone used a random number generator and received 12345 and then huffed online about how it isn't generating 'real' random numbers in a security thread, you would be right to second guess anything they had to say if they start with an immediately false premise.
I hung up and instead called the actual number on the back of the card. The whole thing was real, the bank had actually contacted me by text and sent me a follow up phone number.
Truly I don't understand what they're thinking sometimes.
Disclaimer: my bank does this
And they definitely have the 2FA-through-app capability because it's used for auth when I sign into online banking on a computer— the app has to grant permission for the new device. But hilariously they don't seem to have it wired up yet for phone interactions.
Of course the more automation you put around this, the easier it becomes to MITM it, like a scammer simultaneously calls both you and the bank and passes the codes back and forth, pretending to you that the call is about a credit card offer, while using the call with the bank to drain your account. That's a lot harder to pull off with a human in the loop as the real bank person will get suspicious at the delayed responses, even barring some amount of stalling ("oh hang on I left my phone downstairs, let me find it oh god it's updating again, let me just get you that code, give me a sec here"). But it becomes trivial if the authentication is moved to IVR and by the time the human operator is on the line the call is already considered safe.
FFS guys, at the bare minimum you should have white-labeled that behind a domain like id.irs.gov! Not just to avoid mis-educating users into terrible security habits, but also to avoid giving some Montenegro DNS folks the ability to intercept or man-in-the-middle all the information.
They did stop putting hyperlinks in email communications though. It’s a start.
On the flip side, it's somewhat difficult to buy an expensive TV without showing up on camera at some point. As methods for monetizing stolen cards go, it's pretty uncommon.
Most companies do not actually optimize for profit. If they did they'd stop whatever it is they are currently doing and switch to whatever industry makes the most profit. They don't though, they keep making/doing whatever it is they start with generally. That means they aren't actually optimizing for profit.
That cost has to be factored into the return from pivoting.
* if everyone who sold donuts suddenly went into AI there'd be a huge profit opportunity in donuts - optimizing for profits would be to wait for the other donut sellers to switch into AI and rake in the cash.
* the cost of retooling constantly based on the latest profit fad would just make the toolmakers the main profit center, and the toolmakers would just use their own gear to take all the profits in abandoned markets.
* the constant shift of areas of business would be sub-optimal because most people entering it would know nothing of how to succeed in that field, it's not optimal for your company to be incompetent in an area with much competition.
* labor costs in the "only profitable field" would be through the roof as everyone scrambled to hire competent people - not an optimal way to maximize profit in a crowded industry (also, this compounds with the above point).
In fact this idea is so bad (and yet weirdly beleived by many) that every boom there's memes and jokes about how absurd it is that random companies from completely different industries are getting involved... as if they have a chance to compete against the established players. And even more jokes about how they predictably go out of business.
It’s a middle class fantasy that money is power. Look at the Cheeto. How many times has he been bankrupt? What does he say about bankruptcy? He knows he’ll be fine because power brings money, not the other way around.
Taxing billionaires will help the economy absolutely, but it won’t control the billionaires, because a lot of their deals aren’t denominated in hard currency. We don’t know how to tax favors or threats.
There are other sources of power besides money, but money is definitely one kind.
Consider Twitter. Musk managed to get institutions to put up a fabulous amount of money, but he still had to pay a massive amount himself. If he had $1,000 in the bank and nothing else, that deal would never have happened. Heck, even with $1 billion it wouldn’t have happened. As it was, he got to take a couple dozen billion units of monetary power and convert them into massive non-monetary power.
Like I said, money isn’t the only power. But power is the only thing money is.
No one cared.
The challenge is for customers and companies to communicate and agree to the new social contract.
This means that at least in theory a security researcher could work as a contractor at a competing firm to then let their legal department send a cease and desist letter and demand recouperation of the legal fees including the money paid to the security researcher to find the vulnerability.
Anyone who quotes me on this in their court case is an idiot.
in the golden years of twitter the quickest way to get proper support from companies was to talk shit about their services on twitter.
i was always amazed by how quick i could get in touch with an actual human being using that strategy.
this remind me of some other borderline unethical techniques i read online...
basically when dealing some kind of problems with non-IT infrastructure, if you cannot get "support" to acknowledge issues then you change your strategy and write to the lawyers from the company or public entity managing that piece of infrastructure and inform them of the legal liability deriving from the issue that you noticed.
once that is done, if ANYTHING happens, they cannot deny knowledge of the issue.
they will involve whoever is needed, internally, to get the issue fixed.
so yeah... basically often times to get technical issues fixed you're better off resorting to a human (rather than technical) approach.
Even if it would be legally possible (I don't think you can force your 'services' on an unwilling entity and then force them to pay), it would be absolutely awful optics.
For the bank situation to work, they would have to add an unrequested service to your account and then attempt to charge you for it. i.e. Bank adds overdraft protection to you checking account and then bills you for it.
Say you have an internet plan with a 5GB download limit and after 5GB the connection would no longer send data, one month it lets you download 7GB and then they send you a bill for going over. You probably would not have to pay the bill since they changed their behavior and provided extra without prior notification.
To put a hypothetical example, if I fix a life threatening electrical or structural issue in a children's hospital unsolicited, whatever hit to my reputation I take by charging for unsolicited work, is dwarved and possible restored and reversed by the gravity of the issue fixed and the consquences avoided.
Of course this is contingent on whether the value was actually provided and whether it is provable.
Where do I send the invoice?
Of course that (3) is the contentious point typically, but you haven't even gotten (1) right. How does you reading my comment provide value to me?
It's also funny that, excluding the element of a relationship previously existing, This is the way most business on an hourly basis is made.
Suppose you have a lawyer, you agree on 300$/hr, then you ask them to draft a contract and pay them 600$/hr. If someday you are imprisoned and your lawyer is contacted by law enforcement, and they have to bail you out of jail. They would typically send you an invoice even if you didn't solicit that specific service.
While it's not insignificant that you had a previous hourly arrangement for a different type of work, it's certainly not a sufficient reason to claim that you owe them for their time and bond monies.
If your neighbor leaves their door unlocked while they’re at work, can you go change the locks (for their safety!) and bill them for your time?
No, of course not. Why would you be able to bill for a service that you weren’t asked to provide?
I mean, why should I even need to apply for any job? McDonald’s always needs workers; do you think they’ll mind if I walk into the kitchen, start flipping burgers, and then name my hourly rate at the end of the day?
This can happen; if you're found unconscious and taken to the hospital, you can be billed for medical care which you didn't ask for, based on the doctrine of presumed consent.
One could imagine a parallel -- a critical emergency where it's impossible to communicate but it's reasonable to presume that they would want to have the issue fixed if they were aware. I don't think it necessarily applies here, but it's at least possible that another case could meet that bar.
In this case there was a bug bounty program, so it is not as unsolicited as someone washing your windshield at a stoplight.
Secondly this is not a personal residence, thirdly the property was never broken into by the researcher (nor locks changed), finally there's is fiduciary duty from the company to their clients/users.
Since you are keen on hypothetical scenarios, let me present to you a more similar scenario. A school is situated near an old tree in a nearby lot that has a risk of falling, either on the school or on the public sidewalk, the researcher notices it, rents the nearby lot and safely chops down the tree. Then sends a bill to the school for chopping down the tree.
It is important to note that I didn't ask the question in order to get the opinion of strangers on what should happen based on personal ethics, rather I asked the question in case someone knowledgeable about the law knew the actual answer as to what the courts rule.
It will be a colossal waste of everyone's time and money, though, because they will never prevail.
A fine is punitive, an invoice is compensatory.
can i go from house to house, pick locks and then demand payment?
(spoiler: no)
The common example is that a house can have a door without lock, but it is still a crime to enter. Similarly, entering into a vulnerable system or a system without password even is not legal (although of course the existence of a password or lock mechanism makes undeniable the fact that the place is not for public entry)
In this case there is no entering into any system. There is no lock picked, no server accessed.
can i just decide on my own to do some work, and then *demand* payment for such work?
the answer is still no.