Slashdot Mirror
Hacker Warns Starbucks of Security Flaw, Gets Accused of Fraud
Andy Smith writes: Here's another company that just doesn't get security research. White hat hacker Egor Homakov found a security flaw in Starbucks gift cards which allowed people to steal money from the company. He reported the flaw to Starbucks, but rather than thank him, the company accused him of fraud and said he had been acting maliciously.
In the new days, he posts to Sacurity and 5000 bored coders implement his hack for the hell of it.
They start with $100 gift cards and double their money.
Starbucks is out half a million dollars on the first day. The second day it's 5x that.
Since it's a Saturday, this goes on until Monday, 11am Pacific time. Emergency meetings are held but the hole can't be plugged overnight.
Total loss to the company is about $5 million by Wednesday afternoon.
more proof that responsible disclosure is foolish unless you are delaing with an organization you already have a solid IT/security relationship with.
in any other situation, just post the exploit kit anonymously and make a bowl of popcorn
Snowden and Manning are heroes.
Looks like we need a security wall of shame that lists the response to flaw disclosures of each organisation, so people can quickly determine which companies will fix a flaw upon receiving a report, and which companies are hostile and should not be contacted.