What do you say to the boss who has been robbed blind by the outsourcers?
- Thread starter gremlinz273
- Start date
Sutekh
Blackwing Lair Raider
- 7,489
- 106
You should do what any self-respecting person does, create an anonymous email and mail the security team about it. Then of course disclose the details of the backdoor the next day when they don't respond instantly.
PatrickStar
Trakanon Raider
- 1,529
- 558
Scorched earth and cover yo ass. In the game of life Paper always beats words so fire off emails like you're giving a porn star a facial.
- 684
- 785
I'm sorry I'm an NYC consultant. Shitty human and shit-eating grin kind of go hand in parcel with the job.
I've been trying to determine a reason to bring the FBI in. Some sort of nightmarish auditing scenario would be my ideal endgame here. I can't think of any actual crime that has been committed. Other than the crime of extremely bad and insecure code, which to my experienced eyes was by flawed by design.
Stosh
Bronze Knight of the Realm
- 201
- 12
So if that's the case, why not say something? You might even get additional work out of it to fix the issue.
- 684
- 785
- 684
- 785
'Burn in hell', I'm not sure what you mean by that. I have trouble coming up with a response to these guys that don't care about security. When one of these high profile hacks occurs and does make the press, no one so much as loses their job. It doesn't make a blip on there stock valuation, so the board of directors won't give a damn. Why should they care, even if it is highly sensitive PII?
chaos
Buzzfeed Editor
- 17,324
- 4,839
Because there are millions upon millions in costs associated with each of these high profile hacks. The Target one alone is going to end up costing like half a billion dollars.
And just wait until the CC companies lobby Congress enough to get the laws changed and make the attack victim foot some of the bill for that based on negligence. Woe,I say woe.
And just wait until the CC companies lobby Congress enough to get the laws changed and make the attack victim foot some of the bill for that based on negligence. Woe,I say woe.
You are somewhat correct. Some stocks don't take a huge hit at the moment the hacks happen, some do over time. To say no one gets fired for not protecting the companies assets and information is crazy talk. Someone gets fired, not the guys making millions tho. Prolly some chump making 40k a year in charge of 3 monkeys.
Wasn't that much of a drop for these guys.
- 684
- 785
Now, if it isn't payment card data or health insurance or some other regulated industry such as financial, would they even have to divulge if they were hacked?
Palum
what Suineg set it to
- 23,498
- 33,837
So as an independent contractor who 'discovers' this security flaw, if this blows up who do you think is a good scapegoat? Keeping in mind the truth is largely irrelevant if they have deeper pockets to fight a PR battle to hang you in the court of public opinion.
- 684
- 785
So for someone in this particular situation, a preemptive strike might be one of the better options available. And a smart little hobbit doesn't simply walk into Mordor without a full nuclear arsenal scorched earth policy backup plan.
Still, if there was no audit trail and no logs, was there ever actually a crime?
Still, if there was no audit trail and no logs, was there ever actually a crime?
Angelwatch
Trakanon Raider
- 3,053
- 133
- 684
- 785
It became a known issue - not going to fix. So now as a contractor, am I liable in some way if this thing get's used for an unlawful purpose simply because I was aware of it.
moonarchia
The Scientific Shitlord
- 21,562
- 39,252
Not if you got your telling them and them saying they don't care in writing. In writing is the biggest thing when doing basic CYA.