STE WILLIAMS

A Glaswegian business has been fined £160,000 for making 1.6 million nuisance calls to people on the UK’s opt-out database – five years after it received a £90,000 fine which was also for dodgy dialling.

“Bespoke” bedroom, kitchen and bathroom biz DM Design Bedrooms made this round of unsolicited calls between April and November 2017, eliciting 99 complaints to the UK’s data protection watchdog.

The recipients of the calls were registered on the Telephone Protection Service (TPS), which is an opt-out database that companies are required to screen against so they don’t call people on the list.

DM Design told the Information Commissioner’s Office that it did this – but it turned out that the last time it downloaded the TPS list was March 2017. Adding to that, there was no evidence anyone had consented to being contacted.

The firm was fined £90,000 in 2013 for making thousands of nuisance calls, and the ICO noted that – despite paying up – this latest breach showed “a clear lack of remedial measures” had been taken.

This time, it was fined £160,000 for the breach of the Privacy and Electronic Communications Regulations, which govern direct marketing.

Meanwhile, a separate investigation by the ICO handed down a £90,000 fine to a firm that made almost 75,000 calls to people registered on the TPS.

This company, Solartech, registered in northeast England, is also something of a repeat offender, having first been placed under investigation by the ICO in 2014.

At the time, the company said it had purchased information from a third-party data broker and had “assumed it was TPS checked”. The ICO didn’t issue a fine, but monitored Solartech activities for three months and saw a drop off in complaints.

However, Solartech came back on to the watchdog’s radar in 2016 and despite promises to fix its non-compliance, continued to flout the law.

After two further monitoring periods, and a number of advisory letters, the ICO found that for one group of numbers, 99 per cent of all calls made were to TPS-registered numbers.

Overall, there were some 74,902 calls made in contravention of the Privacy and Electronic Communications Regulations between January 2017 and 30 June 2017.

“Making marketing calls to people who are registered with the TPS is completely unacceptable, and we will take robust enforcement action against firms that are contacting people without their consent,” said ICO enforcement manager Andy Curry. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/26/ico_fine_dm_design_160k/

The recommendation for paper ballots may go unheeded in all or part of at least 6 states in the next national election.

While Florida might be a “laughingstock”, according to a Federal judge ruling on the 2018 election re-count, at least the state had a paper trail to fall back on for that process. The same may not be true for as many as 6 states in the 2020 election, according to an article published today in the Washington Post.

Texas, Indiana, Tennessee, Kansas, Mississippi, and Kentucky are likely to be without paper ballots in all or some of their counties by the time of the next election, according to the Brennan Center’s Democracy Program. While some had hoped that Federal money would be available to make the change, the Secure Elections Act, proposed in the aftermath of the 2016 election, is now mired in controversy and unlikely to be taken up by the lame duck congress.

No security breaches of voting machines have been alleged for the 2018 elections, but many security experts continue to push for paper ballots as a back-stop to possibly hacked systems. Since the responsibility for choosing the election mechanism falls to the states, and in many cases, counties within the states, it seems unlikely that there will be a nation-wide security standard for the foreseeable future.

For more, read here.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/paper-trail-absence-may-still-plague-2020-election/d/d-id/1333330?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cybersecurity means more than bits and bytes; threats are out there IRL, and IT pros need to be prepared.

Cybersecurity tends to focus on dangers that appear on networks or in messages. The attackers may be half a world away, so the threat is the only thing that matters. But what happens when the threat actor is walking through the front door or sitting next to you at an airport coffee shop? Firewall rules and DNSSec can have minimal impact on the thief sliding a company-owned laptop into his backpack and walking out the door.

“If we all took our computers, encased them in concrete, and dropped them into the middle of the Atlantic Ocean, nobody would ever steal our data, but it wouldn’t matter because our data would be on the bottom of the Atlantic Ocean,” says Tim Callan, senior fellow at Sectigo. The challenge, he says, is reconciling physical security with the fact that people need to use their computers and mobile devices for legitimate work.

In 2016, Bitglass reported that one in four breaches in the financial services sector were due to lost or stolen devices, while one in five were the result of hacking. Physical security might not have the glamour of fighting malware writers, but there’s no question it’s a serious component of any effective data protection program.

So what are the physical dangers to enterprise data? Several, but they tend to echo the dangers to any physical assets an organization owns. As a result, some IT security groups leave physical security to the physical-plant security force, but there are both strategic and technical reasons to involve IT security in protecting both the data on systems and the hardware that surrounds those precious bytes.

After talking with security professionals, querying the security community via Twitter, and looking at major security incidents from the recent past, we’ve put together a list of seven threats that definitely deserve attention. Protecting systems from these threats takes a combination of user education, behavior modification, and technology, but remedying the problems themselves can make a huge difference in an organization’s risk profile.

(Image: Stevepb)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/risk/7-real-life-dangers-that-threaten-cybersecurity/d/d-id/1333326?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Are you thinking of changing your career route from techie to CISO? Are you making the right choice? Only you know for sure.

Remember that dreaded question on your first job interview? No, not the “What are your weaknesses?” question, but the other one, equally as challenging: “What do you want to be doing in five years?”

How do we even attempt to answer that question when the only tools in our toolbox at that point is a college degree, some work experience at a minimum wage job, and, if we were lucky, an internship in our field? Is it even reasonable that we would say, “I would like to lead the security operations team — and within three years after that, I would like to be the chief information security officer (CISO) for a small to medium-sized firm”?

Not likely. We muddle through the question and make up some lofty leadership-type role to show the employer that we are thinking of the big picture and want to continuously develop ourselves. The prospective employer is satisfied with the answer and slots us into work it needs done. We progress through our careers gaining technical or audit process experience, until, one day, we are faced with the question of whether we should continue becoming the best technical expert or choose the leadership/management track, to advance monetarily. Easy, right?

Let’s pause here. What is the right choice? Only you know what is best for you. The answer lies in examining the functions for which these roles are responsible and the skill sets required to accomplish them. More importantly, will you be happy performing this new leadership role while the technical competencies start to fade away?

In this world of rapidly advancing technology, leaders in an organization need to be well-versed on emerging technologies and trends, but it is unrealistic to think that the leader will continue to retain the same depth in the technology as when they were focusing on the technology directly for the bulk of the workweek. So, are you willing to no longer be regarded as the expert in the technology you worked with every day? Are you comfortable with leading or managing the individuals that understand the technology more than you do? Are you comfortable with leveraging and relying on their insights and ideas for enhancing business practices? Are you willing to spend time learning in addition to the “day job” to keep up with the technologies?

The CISO role has evolved over the past 25 years from primarily technical beginnings in many organizations to a role requiring more leadership, business savvy, and data-awareness. CISOs are managing risk, reporting to the board, managing security incident communications, planning strategies, and implementing multiyear plans to increase the maturity level within their organizations. As indicated in recent culture of cybersecurity research from ISACA and CMMI Institute, 41% of company boards of directors appoint an executive to own the cybersecurity culture and 38% schedule one or more discussions about it each year. Additionally, 55% of respondents place the cybersecurity culture ownership responsibility on the CISO, compared with 43% on the CIO and 24% on the CEO.

These numbers clearly demonstrate the security leader is “on the hook” and needs to be able to influence executive management to secure adequate funding to make a difference in the cybersecurity culture. This results in preparation of many presentations translating the business needs related to security requirements, and explaining, and re-explaining, why the investments need to be made. Business relationships must be made across the organization with an understanding of the stakeholder needs. CISOs must embrace ambiguity and uncertainty as they navigate the organization, with each department head vying for the same pot of critical investment funds.

The technical role is in stark contrast to the security leader role. Technical staffs are typically rewarded for the mastery of the technical skill, application of those skills to an initiative, and implementation within the project schedule and budget. The result is often a concrete, non-ambiguous solution — it works, or it doesn’t, and feedback of success is more immediate. High levels of individual contribution are rewarded. Technical positions are obtained more easily, as the evaluation of technical skill sets is less abstract than evaluating subjective leadership qualities.

The technical background may be a basic requirement for many organizations hiring their first CISO, as they may only be hiring one or two individuals to start building out the program. However, once the team has been built, the technical skills will not be enough for the individual to remain in the role. Security professionals must decide where they would like to spend most of their day and must be honest about the answer. That is the only path to true career happiness.

(This evolution to CISO and the impact on skill requirements are detailed in the author’s upcoming book, CISO Compass: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers.)

Related Content:

• 9 Traits of A Strong Infosec Resume
• 95% of Organizations Have Cultural Issues Around Cybersecurity
• 7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
• Good Times in Security Come When You Least Expect Them

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Todd Fitzgerald has built and led information Fortune 500/large company security programs for 20 years. He was named 2016–17 Chicago CISO of the Year, ranked Top 50 Information Security Executive, authored four books  —   CISO Compass: Navigating … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/transforming-into-a-ciso-security-leader-/a/d-id/1333307?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

One of Intel’s fixes for the Spectre variant 2 chip flaw (CVE- 2017-5715) appears to have taken a big bite out of the performance of the latest Linux kernel.

The mitigation in question is the Single Thread Indirect Branch Predictors (STIBP), one of three that Intel proposed not long after details of the Meltdown and Spectre flaws were made public in January.

Duly implemented in Linux 4.20, benchmarks run by Phoronix suggest that running it with Intel chips using Intel’s proprietary hyper-threading technology (principally Core i3s, and Core i7s and above) comes at a heavy cost.

Depending on the application, that could be anything from 30% to 50% on a top-of-the-line Core i9, a clearly unacceptable hit – and that’s before factoring in the smaller losses from previous mitigations for Spectre and Meltdown.

When the flaws were made public in January, performance drops were always on the cards, but a consensus emerged that this might be somewhere in the ballpark of a few percent for most users.

Less than a year on from that and anyone running 4.20 (and 4.19.2, which apparently has backported STIBP) is staring down the barrel of something much worse.

Enter the Linuxfather

And so the issue might have bounced around unhappily if Linus Torvalds hadn’t taken a look at numbers and come up with a radical suggestion – disable Intel’s STIBP mitigation.

Wrote the Finnish sage in his reformed no-swearing style:

When performance goes down by 50% on some loads, people need to start asking themselves whether it was worth it. It’s apparently better to just disable SMT entirely, which is what security-conscious people do anyway.

SMT – Simultaneous Multi-Threading – being the technical term for what Intel calls hyper-threading.

Interestingly, Intel has recently been losing interest in hyper-threading, which was introduced as long ago as 2002 as a way of magically turning one core executing one thread into two virtual cores running two threads.

Only now it’s become clear that this offers a theoretical opportunity for side-channel attacks in which one thread can spy on the contents of the other running on the same physical core, as underlined by the recent PortSmash hyper-threading vulnerability.

Where does this leave users?

Regarding Linux, if Torvalds has his way then it’ll choose performance over security in this case, and leave users to turn on Spectre mitigations if they want to. Of course he didn’t put it exactly like that:

I think we should use the same logic as for L1TF: we default to something that doesn’t kill performance. Warn once about it, and let the crazy people say “I’d rather take a 50% performance hit than worry about a theoretical issue”.

For Windows 10, Microsoft thinks it already has Spectre variant 2 under control using Google’s original Retpoline patch.

It’s all a bit nerve-racking even if Torvalds has, for once, managed to be the calmest head in the room.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/pa16yLpv-Xs/

Promo Defending organisations against security attacks is an ongoing challenge, with new threats constantly emerging to test the beleaguered security professional.

Heighten the skills and knowledge you need to square up to the cybercriminals at SANS London 2019 from 11-16 February. The week-long event provides the well-known SANS immersion training through a larger than usual range of courses aimed at all security roles and levels.

Choose between these 10 courses…

• Security Essentials Bootcamp style
  
  If there were compromised systems on your network, would you be able to find them? Do you know how effective every security device is and whether all are configured correctly? Are proper security metrics set up and communicated to your executives? This course provides the answers in a bootcamp-style format reinforced with hands-on labs.
• Intrusion detection in-depth
  
  Security measures are moving from the perimeter to the protection of permanently connected mobile systems. Learn the underlying theory of TCP/IP and application protocols such as DNS and HTTP, and practise using open source tools such as tcpdump, Wireshark, Snort, Bro, tshark, and SiLK.
• Hacker tools, techniques, exploits and incident handling
  
  Follow a step-by-step response to computer incidents and explore the ways attackers undermine systems. The course also covers legal issues such as employee monitoring, working with law enforcement and handling evidence.
• Securing Linux/Unix
  
  In-depth coverage of Linux and Unix security issues includes configuration guidance and real-world examples, tips and tricks. Examine the general problems in all Unix-like operating systems and learn to use freely available security tools such as SSH, AIDE, sudo and lsof.
• Web app penetration testing and ethical hacking
  
  Discover a repeatable process to spot web application flaws and learn how to alert your organisation to the business risk. A capture the flag event on the final day drives home the penetration testing lessons.
• Network penetration testing and ethical hacking
  
  Comprehensive coverage of tools, techniques and methodologies for network penetration testing. Study a target’s infrastructure by mining blogs, search engines and social networking sites.
• Advanced digital forensics, incident response and threat hunting
  
  Prevention systems alone won’t stop determined adversaries who know how to get past security and monitoring tools: defenders need to catch intrusions in progress, rather than after attackers have done their worst. Threat hunting uses known adversary behaviours to identify new data breaches.
• Mac and iOS forensic analysis and incident response
  
  Investigating Apple devices is no longer a niche skill. This constantly updated course teaches the techniques and skills necessary to take on any Mac or iOS case.
• Cyber threat intelligence
  
  Malware is the adversary’s tool but the real threat is the human one. Acquire the art of analysing an adversary’s intent, opportunity and capability to do harm.
• ICS/SCADA Security essentials
  
  The course is designed to help traditional IT personnel understand the design principles underlying control systems and addresses the need for control system engineers and operators to understand their role in cybersecurity.

Read the full details and sign up here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/26/tighten_up_your_security_defences_at_sans_london_2019/

Are Ethereum’s new-fangled smart contracts the ultimate point of the blockchain or a risky experiment whose vulnerabilities presage trouble?

Right now, few doubt that smart contracts – instruction workflows in a language called Solidity that automate complex, profitable processes on Ethereum – require close scrutiny.

The latest security flaw was discovered by smart contract developers Level K – a ‘minting’ flaw that would allow an attacker to drain Ethereum exchanges initiating smart contracts.

There are several scenarios in which the vulnerability could be exploited, which has already been revealed to most of the exchanges the researchers thought might be affected.

Explaining gas

Before getting to the weakness, it’s necessary to understand that on the Ethereum network sending Ether cryptocurrency from one address to another means paying a minimum fee to miners in a unit called ‘gas’.

This rewards miners according to the amount of computation involved in executing each set of Solidity smart contract instructions.

Recently, someone had the idea of turning gas into a sort of tokenised currency of its own – GasTokens – generated thanks to Ethereum’s complicated storage refund system (blockchains desire storage efficiency).

GasTokens are a new thing but seem to have taken off because gas price varies according to smart contract demand (and some think Ethereum gas is too expensive in the first place).

So, the Ether cryptocurrency being moved around the blockchain has a fluctuating value, but so do the computational units that fuel the transactions on this blockchain.

The bad bit

To simplify, the weakness found by the researchers is one in which an exchange could be made to pay very high gas transactions fees by sending Ether to an address controlled by the attacker (i.e. the exchange pays the gas) using a smart contract ‘fallback function’ that eats computer cycles.

This would require that the exchange had set no limits on gas and the attacker was able to set up lots of receiving addresses thanks to poor know your customer (KYC) controls.

Alternatively, an attacker could use the same setup to generate GasTokens using the refund system while making the exchanges pay for the computations generating them.

The researchers’ solution:

Implement reasonable gas limits on all transactions. If any expensive transactions are made, ensure that the user bears the cost. Fees for a given withdrawal should always cover the gas needed.

Far from being bad news, the discovery of this and other flaws is, arguably, a necessary step if blockchains such as Ethereum are ever going to thrive.

Previous vulnerabilities have included a problem with smart contracts from the Coinbase exchange that could have allowed attackers to reward themselves with infinite Ether.

Then there was the infamous DAO hack of 2016 where an attacker siphoned off 3.5 million Ether (worth at least $50 million) – not exactly a confidence boost for a system that’s still only three years old.

If Ethereum, smart contracts and the blockchain overcome this bad press, they will need to counter the view that their inscrutable complexity isn’t hiding a system ripe for double-dealing and chicanery.

Developers understand this but do the customers and users?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/x7xvruUtfoc/

As internet users migrate from desktop and laptop computers to mobile and Internet of Things (IoT) platforms, cybercriminals are making the journey with them.

The SophosLabs 2019 Threat Report has tracked this shift across a range of mobile threat types, most of which target Android.

The simplest tactic here is to try and sneak malicious apps past Google’s Play Store security checks on the assumption that some victims will download them before they are pulled.

Cryptominers

A good example from this year is the short but taxing boom in malicious cryptominers, which weren’t explicitly banned by Google until July.

Anyone unlucky enough to end up with a cryptominer on their phone – possibly hidden as a function inside another innocent-looking app – would have noticed their device’s processor straining under the load.

Phones that do this constantly would appear to have significantly reduced battery life when compared to identical models that do not have the miner code running on them.

Making detection harder, some of this activity could be called by the app from JavaScript-based cyptomining on an external website.

Mobile clickfraud

A parallel track for mobile cybercriminals is the lucrative industry of advertising clickfraud, again embedded inside apparently innocuous apps that simulate users clicking ads to generate revenue.

Long-established on desktop computers, clickfraud is a growing problem in the mobile space because the number of apps and devices makes it an inviting target.

As with cryptominers, spotting apps with this intention isn’t easy to do but the negative for mobiles is the same, battery and processor drain, while advertisers are charged for useless clicks, and the cost of online advertising is driven up.

Supply-chain compromise

In 2018, SophosLabs discovered a legitimate app supplied as part of the stock firmware image of a small phone maker that had been ‘Trojanised’ in the supply chain, before anyone purchased the device.

The app, Sound Recorder, had been modified to covertly intercept and send SMS text messages:

The malicious version of the app could have been inserted into the supply chain in a number of different places. It was never made available through any app store, only in a specific firmware image on a specific model of inexpensive Android phone.

Detecting let alone removing this type of malicious app is almost impossible until the equipment maker is aware of the compromise.

Internet of Things

One thing today’s IoT devices have in common is that they are typically left unattended. This means they are rarely, if ever, patched and often rely on default credentials – this might explain why SophosLabs saw a surge in attacks against IoT devices in 2018.

However, IoT malware is now evolving rapidly to target more capable devices such as home routers. Router compromise has been around for a while, of course, but common attacks during 2018, such as VPNFilter, offer clues as to its new ambitions.

VPNFilter could successfully attack dozens of routers from numerous vendors, and the botnet it built in the process looked every bit as potent as something that might affect PCs or servers.

The successors to the Mirai botnet of 2016 that borrow bits of its code – Aidra, Wifatch, and Gafgyt – are still alive and kicking. Wifatch is a particularly curious oddity, infecting vulnerable devices before warning their owners in vigilante-style to secure them against attack.

As for what’s next, SophosLabs reports that the IoT target list is expanding to include database servers, commercial-grade routers, and networked CCTV cameras and DVR systems.

Read more in the SophosLabs 2019 Threat Report.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/klhETPv4sIM/

German chat platform Knuddels.de (“Cuddles”) has been fined €20,000 for storing user passwords in plain text (no hash at all? Come on, people, it’s 2018).

The data of Knuddels users was copied and published by malefactors in July. In September, someone emailed the company warning them that user data had been published at Pastebin (only 8,000 members affected) and Mega.nz (a much bigger breach). The company duly notified its users and the Baden-Württemberg data protection authority.

The largest breach, according to Spiegel Online, exposed over 800,000 email addresses and more than 1.8 million user pseudonyms with their associated passwords had been published on Mega.nz. The chat platform said it had verified 330,000 of the published emails.

The regional data watchdog deemed that plain text storage of passwords breached legislation that implements the GDPR in Germany (specifically article 32 of the DS-SGVO), and imposed its first penalty under the regulation.

Announcing the fine, the authority noted Knuddels’ cooperation, so presumably the fine could have been higher.

“By storing the passwords in clear text, the company knowingly violated its duty to ensure data security in the processing of personal data,” the authority said.

As well as acknowledging Knuddels’ cooperation, the authority’s State Commissioner for Data Protection and Freedom of Information, Stefan Brink, said it was avoiding the temptation to enter a “competition for the highest possible fines”.

The watchdog also wanted to avoid bankrupting the company. “The overall financial burden on the company was taken into account in addition to other circumstances,” the authority noted. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/23/knuddels_fined_for_plain_text_passwords/

The US Postal Service (USPS) ignored a security flaw affecting millions of its registered website users for over a year until a researcher took his discovery to prominent blogger Brian Krebs, it has been alleged.

According to Krebs’s write-up, the unnamed researcher contacted him a week ago with news of a weakness he’d uncovered in the USPS.com ‘Informed Visibility’ API.

This API enables a USPS service that gives customers real-time tracking data on mailshot campaigns and deliveries.

Although described in general terms (see the before and after APIs), the authentication flaw found by the researcher…

…let any logged-in usps.com user query the system for account details belonging to any other users, such as email address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data and other information.

Krebs estimates that there are 60 million USPS account holders, all of whose data (passwords excluded) would have been viewable and, for fields such as email addresses or phone numbers, potentially modifiable.

An attacker who was aware of the flaw could even have run wildcard searches with no special knowledge of tools beyond a bit of nous about how to view and modify data elements using a browser.

When contacted, USPS told Krebs that the company had uncovered no evidence that the weakness had been exploited by an attacker:

Out of an abundance of caution, the Postal Service is further investigating to ensure that anyone who may have sought to access our systems inappropriately is pursued to the fullest extent of the law.

Told of the vulnerability by Krebs on 18 November, USPS is said to have fixed it by 20 November.

Brick wall

That turnaround sounds swift until you read the claim that the researcher first told USPS of the vulnerability over a year ago but was unable to get any response.

Krebs seems to have had more luck getting through:

After confirming his [the researcher’s] findings, this author contacted the USPS, which promptly addressed the issue.

Naked Security has no way of confirming the researcher’s claim but, if true, it would fit the pattern of a known phenomenon – a customer/researcher notices or complains about an issue relating to an organisation’s service, technology or security, reports it, but is stalled or ignored.

The customer then complains to a newspaper journalist or blogger, who contacts the organisation for clarification after which it suddenly becomes a more urgent priority.

A cynical interpretation is that some organisations prefer to ignore complaints unless it’s about to do their reputation serious harm.

Or it might be a problem with the reporting process: an employee receives an email highlighting a flaw but fails to pass it on or passes it on but without an understanding of how to prioritise it. Perhaps it’s nobody’s job (or it is, but the right person isn’t told). Or maybe it’s simply the special inertia that stops the second thing on your TODO list from ever reaching the top.

Four years ago, USPS suffered a data breach affecting employee data, while last year a separate service run by the company, Informed Delivery, was criticised for its security design.

The moral here is that having any form of customer-facing technology without a clearly signposted way for external researchers to report flaws is always asking for trouble.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xos2g7EaOt4/