What Happens When You Send a Zero-Day to a Bank?

Re:What Happens When You Send a Zero-Day to a Bank? by tptacek on Friday April 21, 2017 @06:54PM (#14170082)

Vulnerabilities like these aren't likely to cost anything close to $10K, even if they stay open for years.

But stipulate that there's some number here, and the answer is: because nobody in management at Zecco ever built a plan for how to handle incoming vulnerability reports, and so nobody who got the report was empowered to do anything but escalate the issue --- and halfheartedly, at that, because nobody in management at Zecco ever build a policy that ensures anyone cares about vulnerabilities, so this is for them the moral equivalent of a WONTFIX.

How diligently would you escalate a WONTFIX?

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by fulldecent on Saturday April 22, 2017 @11:34PM (#14176333)

The person I was in contact with was the CTO Michael Raneri and the General Council. And the CTO was promoted to CEO while the bug was still broken. And then he cashed out and sold the company.

Escalation enough?

[ Parent | on HN ]

Re:What Happens When You Send a Zero-Day to a Bank? by tptacek on Saturday April 22, 2017 @11:57PM (#14176399)

What do you want me to tell you? I agree with you: they don't care. It didn't appear to matter for their outcome. They WONTFIXed a CSRF. Are you shocked?

[ Parent | on HN ]