Slashdot Mirror
Hacker Warns Starbucks of Security Flaw, Gets Accused of Fraud
Andy Smith writes: Here's another company that just doesn't get security research. White hat hacker Egor Homakov found a security flaw in Starbucks gift cards which allowed people to steal money from the company. He reported the flaw to Starbucks, but rather than thank him, the company accused him of fraud and said he had been acting maliciously.
He would have been better off helping himself to free coffee until the wankers fixed their system.
Brackets contain world's first nanosig, highly magnified:[.]
Everyone knows that you get a negative reaction for stealing a small amount. Steal a couple million and you'll be respected.
Just do the black hat thing next time: steal a few hundred thousand dollars - anonymously. You'll still be accused of acting maliciously, but then they'll also address the flaw, which is better than just telling you to stop trying to help.
Foamy the Squirrel nailed it.
"Egor Homakov did you a favor, I think you owe him a thank you, and an apology for your response to his discovery of a security flaw in your system.
This will be your only hope if another security flaw is found, and the discoverer of the flaw now ponders between letting Starbucks know (less likely after your response to Egor Homakov), not letting anyone know (which leaves the security flaw available for anyone to use), or letting the wrong people know about this flaw!
I feel like I am explaining something to a child. You are a corporation, act like one!"
So docent this make starbucks liable for all damages this flaw causes to customers then since they knew and didint fix it?
The man's name is Egor! I've seen movies about this. You shouldn't get on his bad side.
Just sayin'.
He should have posted instructions via a proxy to different places.
So that everyone would get free coffee and Starbucks would get the message and act way faster.
What would they do then? Sue all their customers?
I think Hitler tried something like that already.
more proof that responsible disclosure is foolish unless you are delaing with an organization you already have a solid IT/security relationship with.
in any other situation, just post the exploit kit anonymously and make a bowl of popcorn
Snowden and Manning are heroes.
and people still don't learn? If you find something like this keep your mouth shut. No good will come from you bring it to their attention.
Only the State obtains its revenue by coercion. - Murray Rothbard
Starbucks can have a new slogan.
all bow and fear me
Starbucks is a nasty company. Its CEO Howard Schultz is a fanatical Zionist; if you patronize Starbucks, you're supporting Israeli genocide.
Being a publicly traded company, the financial information is available, so go ahead and show on their financials where they are sending money to support Israeli genocide.
If you are not allowed to question your government then the government has answered your question.
Looks like we need a security wall of shame that lists the response to flaw disclosures of each organisation, so people can quickly determine which companies will fix a flaw upon receiving a report, and which companies are hostile and should not be contacted.
When responsible reporting is deterred to uphold an illusion of flawlessness and corporate infallibility, blackhats are the only ones who benefit.
Schultz sure made a point of distancing Starbucks from Israel.
He's clearly more concerned with raking in as much cash for Starbucks than supporting Israel using Starbucks, which is appropriate for his role and entirely ethical.
Besides, the Aroma (spelled phonetically in Hebrew) coffee chain in Israel is quite a bit better than Starbucks on quality, price, and customer service.
As there is no transcript of the phone call we have no idea what was actually said. It could have been something along the lines of "We try to guard against fraud and malicious behavior" or "continuing to do this could be considered fraud or malicious behavior". There is no proof the reporter was ever accused of either of those. Being accused makes a better story though.
That's why you let them eat shit and get sued. Why would you even volunteer this information? You deserve to be what you got.
I vote with my dollars for the megacorps I want running the planet. I have not given Starbucks money in years and now have even more incentive to do so-- they're so fucking stupid they don't know when they're being helped.
Defamation lawsuit.
A $20.00 double caffoo-express-mocca-with-strawberry-double-low-fat-high-density-provolone-cheese-Liquorice-hold-the-expresso-two-unbrella coffee
might be closer to fraud than you think...
r in ur coffee na0, $tarbuck$
They probably wrote something like Eager Homacake on the accusation anyway.
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
If you dislike acidic coffee, use a max dark roast (note that for darker roasts the quality of the beans doesn't matter quite as much, though Arabica will still be smoother) and cold brew that stuff overnight (you can buy a kit from a company like Filtron for pretty cheap, or just a DIY setup.)
The stuff comes out like motor oil--thicker than espresso. You store in the fridge, mix a shot of it with water and nuke it whenever you want a cup. Incredibly convenient, and in my experience it really cuts down on the acidity. The end result, when drunk black, has a "crisp" bitterness... not unlike a good beer.
Why would anyone use those? There's no discount. A $25 gift card just entitles you to spend $25 worth of whatever that company has to sell. What's the point? To show someone that you know that they like coffee, so instead of giving them $25 you give them a $25 Starbucks gift card? It's not really more thoughtful than giving cash yet it's far less convenient for everyone involved. And why would you even refill those for yourself? Because you don't trust yourself with your own money?
And a Starbucks gift card is not like those gas credit cards, the last resort of degenerate gamblers, junkies and broke-ass idiots who offer you to fill up your car using their card in exchange for $20 cash. At least those are convenient if you happen to stop for gas at the right place and the right time.
Fuck gift cards.
lucm, indeed.
And extremely short-sighted.
Just an observation from real life experience...
The Palestinian population in the occupied territories has gone from 1.03 million to 4.55 million since 1967. Either you don't know what the term means or the Israelis are the worst at implementing genocide.
When a BIG CO is confronted with a security flaw, by someone outside the CO, they react in anger first, then fear, then they turn one the person/persons who confronted them. When you distill all the emotional cruft, it's that their pride was hurt. Never mind someone did "their" homework for them. They want to"save face".It makes them angry that YOU did something they should have done. No sharing of information for the common good, with arrogant pricks.:)
Starbucks makes Wal-Mart look like the good guys
I noticed you accidentally left your front door unlocked last Monday. You should really remember to lock it everyday. By the way, you should not leave money in your underwear drawer. I counted three hundred dollars. I doubt you so called ethical hackers would be thrilled about it. In fact I bet you'd feel violated
Why would anyone use those? There's no discount.
Sometimes there is a discount. The local blood plasma collection center pays donors for their time on a debit card. The bank that issues this debit card charges a service fee for cash withdrawals at another bank's ATM, for bank account transfers smaller than $300, and for inactivity after so many days. So when I didn't feel like donating anymore for a while, to get my $190 balance out without having to pay a service fee, I used the debit card to buy $190 of gift cards at businesses I already frequent.