mailing list archives
Re: Wachovia Bank website sends confidential information
From: Bob Toxen <bob () verysecurelinux com>
Date: Thu, 12 Jul 2007 05:55:30 -0400
Wachovia Bank's Web Security people did phone me late yesterday to thank
me for raising the security issue. They also stated that they were
investigating why my initial contacts with Wachovia did not result in
an appropriate response.
They said that they also were working with their legal people to determine
what notification to consumers, if any, was required due to the California
data breach law and similar laws elsewhere.
It was not made clear whether their phone call (and their correction
of the web page) was directly due to my posting on the Full-disclosure
list or because Steve Ragan saw my posting and contacted Wachovia.
For those who questioned whether I made sufficient attempts to contact
them, please note that I talked by phone both with customer support and
web support people and then FAXed the details to the web support person
who took my call. Note that I bothered with this at all as a courtesy
to Wachovia. Nobody paid me for my time.
For those who questioned whether I gave them sufficient time to react,
I stated in my FAX to them, in effect, that all they had to do within
7 days was to respond to the FAX and ask for more time to deal with
the problem. I then waited 15 days, not 7, before posting on FD after
having received no response and seeing that the problem remained.
For those who questioned my motives and suggested that I deliberately
did not make sufficient effort to contact them, well, I detailed my
3 contacts above and then got no response for 15 days. For those who
suggested I was motivated by fame, well, I already have that. I won't
blow my horn here but anyone is welcome to do a Google search on me.
Wachovia has fixed the problem. They are working to ensure that future
advisories are handled properly. Thanks to all who responded. Shall we
put this matter to bed?
Horizon Network Security
http://www.verysecurelinux.com [Network & Linux/Unix Security Consulting]
http://www.realworldlinuxsecurity.com [Our 5* book: "Real World Linux Security"]
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: Wachovia Bank website sends confidential information Alexander Sotirov (Jul 11)
Re: Wachovia Bank website sends confidential information Bob Toxen (Jul 11)
Re: Wachovia Bank website sends confidential information Steve Ragan (Jul 11)
Re: Wachovia Bank website sends confidential information Bob Toxen (Jul 12)