Live data from Hacker News

What Happens When You Send a Zero-Day to a Bank?

privacylog.blogspot.com

31–40 of 454 posts

Re: What Happens When You Send a Zero-Day to a Bank?

#31
post #29
post #16

Earlier quoted context omitted.

Are you saying NDA without putting a dollar value are unenforceable?

Consideration doesn't have to be denominated in dollars.

Consideration can be as minimal as "your continued employment with this company." It does not have to be any sort of additional dollar amount.

Re: What Happens When You Send a Zero-Day to a Bank?

#32

On a similar, but separate note, my bank launched a new version of its online banking platform. From launch I noticed it opened my accounts in a new tab while leaving my credentials (password and all) in the sign-in form. Not so bad when signing in from home - horrific if you're signing in from a public computer. I tweeted to the bank and spoke to someone on the phone about it. It's been 3 months and the bug is still…

Tell us what bank so we can avoid them.

Re: What Happens When You Send a Zero-Day to a Bank?

#33

Earlier quoted context omitted.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

I believe the idea is nobody would willingly sign a contract that does nothing to benefit themselves so they must have been mislead into the agreement thus it is invalid. Sort of a rational actor theory of law.

Isn't the benefit for William that he was provided some confidential information in addition to what he already knew?

Re: What Happens When You Send a Zero-Day to a Bank?

#34
post #7

The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.

Consideration is a common law concept as far as I can tell. As someone unfamiliar with how it came to be: Why was consideration introduced? What's the rationale, the goal behind it?

Is this a test? Are we allowed to use Wikipedia? Because Wikipedia has a lot on it.

Re: What Happens When You Send a Zero-Day to a Bank?

#35

Earlier quoted context omitted.

I'm guessing if you used a popular web-based email service, or any browser email client, then this would be possible.

Possibly, but you'd still have to (try to) "render" it in your browser by opening the mail. On a similar note, your web mail could fetch images in emails ahead of time, but that would still be out of your browser's context

note that the url is inside an tag.

Re: What Happens When You Send a Zero-Day to a Bank?

#36

I would not be surprised if this turns into a class action lawsuit. The negligence here is remarkable.

You need damages to have a class action lawsuit. What are your damages?

I am not saying no one has damages, but if 100s of people had damages, I expect something would have happened...

Re: What Happens When You Send a Zero-Day to a Bank?

#37
post #5

Wow. Going on with your life as a C-level executive with this knowledge, as if it's just all good, is just insane. I'm sure they're in the clear personally now, but I can certainly see why they would wanna sell their company fast after gaining this knowledge in 2010.

Given my experiences with C-level executives it's unlikely the leadership thought this was a "real" security issue - and it is entirely possible that there haven't been any attacks made using this vulnerability - Zecco isn't Fidelity or MorganStanley.

Wouldn't the FTC want to know about this though, as this would be a great way to execute a pump-and-dump scam...

Re: What Happens When You Send a Zero-Day to a Bank?

#38
Lesson learned: when reporting a vulnerability, record all discussions from first contact with the vendor. At least in cases where the vendor doesn't have a clear, easy to find policy and/or bounty for disclosures.

I think it's totally fair to reject an NDA but I don't blame him for fearing an overzealous reaction on their part. Even being on the right side of criminal and civil law, you really do have to be willing to spend time and money to mount an affirmative defense.

Re: What Happens When You Send a Zero-Day to a Bank?

#39
post #22

Why did the author post in 2017, so long after? He said in early conversations he was going to go public much sooner.

He was afraid that he was bound by the NDA not to disclose it. Now, in 2017, he flouts the NDA and acts in the public interest.

But why now? What changed?
Post reply on HN