Is this happen to be critical a vulnerability that you would like to inform Bank One about?
Posting any information prior contacting BankOne would cause a greater risk. Doing so, would be like giving a clue to a fellow hacker. Next thing you know you have all the Blackhats going to BankOne website trying to find the same vulnerability that you have found. Knowing how bright some of them are I wouldnt be surprised if they find it and exploit it. This is a problem with many financial websites. Responsibility of every Risk Assessment Group should be to have proper contact information availabe to public, for cases like these. Many large organization websites fail to have this process in place. They should have contact information along with their public key. Martin Mkrtchian On Tue, 7 Dec 2004 16:11:07 -0600, Owned You <[EMAIL PROTECTED]> wrote: > Post your issues with BankOne on: > > http://finance.yahoo.com/q/mb?s=JPM > > That may get their attention. Or not; posting here will get the > attention of the infosec journalists. > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
