Feeds

Fund manager withdraws legal threat over security vuln

Sanity prevails

Combat fraud and increase customer satisfaction

First State Super, the company that called the police and fired off legal threats when a security researcher notified it of vulnerabilities in its online funds management application, is reportedly softening its stance.

According to Australia’s Financial Standard, the company has decided against further legal action, and instead is setting up a meeting with Patrick Webster, who notified the company that its use of direct object references in the URL bar meant any logged-in user could view other users’ information merely by changing the ID number.

After originally welcoming the notification, the company then called police and sent legal letters threatening Webster.

The ensuing media storm, which began when Webster told his story to security podcaster Patrick Gray and was broken on his Risky Business site, has apparently helped bring about the change of heart. While the fund still needs to ensure that Webster has not retained any of the records he downloaded when crafting his proof-of-concept, FSS has now arranged a meeting with him.

However, FSS is still subject to criticism for other aspects of its response to the security breach. Its decision to notify only those users whose data was downloaded by Webster has come under fire from acting NSW Privacy Commissioner John McAteer, who believes that all of its customers should have been notified.

The Australian Privacy Commissioner, Tim Pilgrim, has also launched an investigation into the matter. ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.