Hacker Warns Starbucks of Security Flaw, Gets Accused of Fraud

Andy Smith writes: Here's another company that just doesn't get security research. White hat hacker Egor Homakov found a security flaw in Starbucks gift cards which allowed people to steal money from the company. He reported the flaw to Starbucks, but rather than thank him, the company accused him of fraud and said he had been acting maliciously.

Comments

You stole too little

[rebelwarlock]

Everyone knows that you get a negative reaction for stealing a small amount. Steal a couple million and you'll be respected.

Re:You stole too little

[fahrbot-bot]

Everyone knows that you get a negative reaction for stealing a small amount. Steal a couple million and you'll be respected.

Not just stealing. As Eddie Izzard pointed out in his standup performance Dress to Kill:

You know, we think if somebody kills someone, that's murder, you go to prison. You kill 10 people, you go to Texas, they hit you with a brick, that's what they do. 20 people, you go to a hospital, they look through a small window at you forever. And over that, we can't deal with it, you know?

Someone's killed 100,000 people. We're almost going, "Well done! You killed 100,000 people? You must get up very early in the morning. I can't even get down the gym! Your diary must look odd: “Get up in the morning, death, death, death, death, death, death, death – lunch- death, death, death -afternoon tea - death, death, death - quick shower"

Re:No good deed goes unpunished

[infolation]

In the old days, he'd have posted it in 2600 and we'd ALL've got some free coffee.

No free lunches anymore :[

My email to press@starbucks.com

[Anonymous Coward]

"Egor Homakov did you a favor, I think you owe him a thank you, and an apology for your response to his discovery of a security flaw in your system.

This will be your only hope if another security flaw is found, and the discoverer of the flaw now ponders between letting Starbucks know (less likely after your response to Egor Homakov), not letting anyone know (which leaves the security flaw available for anyone to use), or letting the wrong people know about this flaw!

I feel like I am explaining something to a child. You are a corporation, act like one!"

Re:My email to press@starbucks.com

[Andy Smith]

For most of my life I've worked freelance so I haven't had much experience of the corporate world. But I recently worked for a small newspaper company (approx 400 employees) for a year and it was an eye-opening experience. It amazes me how anything ever gets done in these blind, ignorant, slow-moving organisations.

I'll give you one example. The company's web filter had an issue with our own web sites, which prevented us from reading them. When I asked IT about it they knew what the problem was, but they couldn't authorise the fix and they suggested I raise the issue with my manager. But my manager was unapproachable -- asking for something to be done was the best way to make sure it didn't get done. It took over a YEAR for a small newspaper company to fix an IT issue that prevented staff from reading their own newspapers' web sites.

I dread to think what life must be like in big corporations. I don't want to ever experience it.

Re:No good deed goes unpunished

[AmiMoJo]

The sad thing is that publishing the vulnerability anonymously, in 2600 or on one of the disclosure mailing lists, is now the responsible thing to do. Not great for the company involved, but it protects the researcher and it protects the user in some cases.

At this point I'd only even consider warning the company before anonymously publishing the vulnerability if they had a bug bounty programme. Not because I want money, but because it's the only way to be sure they will actually be thankful and not call the cops right away.