In 2000(?) I employed this same 'hack' against Ameritech's online bill viewer, but couldn't get anyone's attention. I called several people at Ameritech, but couldn't get through to anyone who understood anything I was saying.
I tried to get ahold of newsmedia, but realized afterwards that the links I was sending did have a session timeout associated, so by the time a reporter clicked a link, they got nothing.
Finally, I managed to get in touch with someone at 'fuckameritech.net' (IIRC) - a consumer watchdog (I hesitate to say 'group' - I think it was just one guy) who said "I'll take care of it". He made some contacts - I think got it to a reporter in Chicago, and that afternoon Ameritech's online bill view and pay was taken down (a wednesday IIRC) and it wasn't brought up again until Monday.
The 'fix' was not much - they were now hashing the account number in some massively long (128 char?) ID instead of just your account number. But it was all still visible in the URL, which was the bigger problem to start with, because it encouraged 'hackers' like me to change my account number by one digit.
I suspect others had noticed this before, tried to contact citi, and couldn't get in touch with anyone who understood what the caller was saying.
Companies need separate 'web vulnerability' hotlines to call/contact to report issues like this - perhaps just hidden in the 'view source' - if you're good enough to find the info, you know what you're doing enough to report a problem. Too low a bar?
I imagine that publicizing a web vulnerability hotline would result in more trouble that it would solve. Normal people really don't understand computers. If you somehow give off the message that your system is not perfectly secure or bug-free they would get scared and run off to competitors who are just as bug-ridden but at least appear to be more secure.
Normal phone techs should know how to deal with such calls (even if they don't understand the exact problem) and have a line/department to forward the call too. That provides filtering for legit claims, and avoids advertising it and scaring people. Simple.
While I sort of see, marketing/wording of this could spin this as a positive (assuming it was even something that was publicized - perhaps hidden in the markup is good enough?).
We've popularized crime reporting as a social good - mcgruff the crime dog, etc. When will we start taking online safety and security with the same level of seriousness?
As much as I don't like the idea, being able to report issues to a state or federal agency might be a way to go.
Eh I dunno. Google does this with its Vulnerability Reward Program [1] and people seem to be fine with sharing almost all of their private data with Google from all their e-mails to their credit card numbers (Google checkout), etc., etc.
Also Facebook has a form for reporting vulns [2] and people are still happy to share their personal info there. I'm sure there are other companies that have "hotlines" but these are just a few I can think of.
I don't think having an avenue for responsible security bug disclosure gives anyone the impression that their data is unsafe.
I agree that companies need an easy way for people to report potential problems or risks. One company I was with had no idea it was a botnet C&C until months later somebody looked up our WHOIS and sent an abuse e-mail. Some non-hacking-related forums had known for a while.
I tried to get ahold of newsmedia, but realized afterwards that the links I was sending did have a session timeout associated, so by the time a reporter clicked a link, they got nothing.
Finally, I managed to get in touch with someone at 'fuckameritech.net' (IIRC) - a consumer watchdog (I hesitate to say 'group' - I think it was just one guy) who said "I'll take care of it". He made some contacts - I think got it to a reporter in Chicago, and that afternoon Ameritech's online bill view and pay was taken down (a wednesday IIRC) and it wasn't brought up again until Monday.
The 'fix' was not much - they were now hashing the account number in some massively long (128 char?) ID instead of just your account number. But it was all still visible in the URL, which was the bigger problem to start with, because it encouraged 'hackers' like me to change my account number by one digit.
I suspect others had noticed this before, tried to contact citi, and couldn't get in touch with anyone who understood what the caller was saying.
Companies need separate 'web vulnerability' hotlines to call/contact to report issues like this - perhaps just hidden in the 'view source' - if you're good enough to find the info, you know what you're doing enough to report a problem. Too low a bar?