Slashdot Log In
Verizon Exposes the Wrong 1,200 Email Addresses
Posted by
timothy
on Fri Oct 10, 2008 02:22 PM
from the but-this-was-the-before-picture dept.
from the but-this-was-the-before-picture dept.
netbuzz writes "If you're going to market your expertise by inviting 1,200 IT professionals to a seminar about securing data and protecting personal information, it's probably a good idea to protect the personal information of those you invite. On Tuesday, Verizon forgot that advice and blasted each of the 1,200 email addresses to everyone on the list ... and they did it 17 times."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Blunder (Score:5, Insightful)
Whenever email scripts have too many recipients, they do tend to refresh and try again, which can cause dupes. These addresses were likely supposed to be in the BCC field, or nonexistent (duh). So it was a mistake.
That's an embarassing blunder, to hold a seminar on keeping private info secure and then spamming who is attending the seminar. I wonder how much time they will spend on that blunder, explaining how it can happen to anyone, even the mighty Verizon, but this foolishness will not strengthen Verizon's sales pitch.
Spammers attend these conferences. Now spammers have known email addresses of everyone there.
This would only make a difference if spammers made money based on sending targeted email. They don't. They make money based on volume of addresses when a shady merchant pays them. So maybe they could make $25 on this list?
Apart from making one person in Verizon look stupid, this also enforces the theory that it only takes one idiot to... the whole internet.
Re: (Score:2, Funny)
Re: (Score:3, Funny)
Re:Blunder (Score:5, Funny)
you showed him dude, I certainly wouldn't want to be him because I would be reeling from that burn
Parent
Re:Blunder (Score:5, Funny)
Spammers attend these conferences. Now spammers have known email addresses of everyone there.
If it's just spammers attending, then they only got the email addresses of other spammers. The spammers can spam themselves all they want for all I care.
Parent
Re:Blunder (Score:5, Interesting)
Because that's what's at stake. It's not a question of sending email selling \/|agra to these people. It's a question of a very specific, highly targeted spam operation with the express purpose of getting access to the networks of these specific individuals, in the hopes that they can provide the access the infiltrator would want to the company as a whole.
Now, I am not saying that this is a big deal; it's not like these emails wouldn't have been available from some other source than this email list. However, I will say that by completely dismissing an entire segment of spam email, that of targeted emails to specific individuals, you are unnecessarily lulling both yourself and anyone who reads your comment into a false sense of security. Highly targeted spam is a real risk; don't discount it as a very real attack vector. You must be ever vigilant, and I don't think you can be with that kind of attitude.
Parent
Re:Blunder (Score:4, Interesting)
Similarly, you'd think that spamming "postmaster" or "abuse" at a domain would be futile and wasteful, but I get more spam there than at my actual address.
Parent
Re: (Score:3, Insightful)
Re: (Score:2)
At my domain blacklist-admin@ gets a surprising amount of spam.
Re:Blunder (Score:4, Funny)
You accidentally... the internet? The whole thing?!
Parent
Re: (Score:2, Informative)
I write email software [listmailpro.com] and there are ways to prevent this. The way I do it is insert rows into a queue table for each mailing, with each row containing the userid and messageid. As messages are queued to the SMTP server they are removed from this queue. The sending process checks in every 20 seconds. If a queue fails for more than 1 minute, it can be safely resumed with no duplicate messages. A further simple step is taken to prevent a "refresh" on the sending/queuing page. It seems to me they just ne
Title is Misleading (Score:5, Insightful)
/bad title?
Re:Title is Misleading (Score:4, Insightful)
Sometimes you can get away with doing something stupid because nobody notices.
This was not one of those times.
Parent
Re: (Score:3, Interesting)
Yup, time for a reply all.
I seem to remember a similar thing happened when a Univeristy made a similar stuff-up, and emailed a raft of journalists. However, in that case it actually brought together journalists who hadn't talk to each other in years.
Re: (Score:2)
I remember receiving a spammy email like this. And just for giggles, I used "Reply All" and bitched to the sender about how all these email addresses are public knowledge, and about how all the recipients of the email were going to be spammed by any spammer with a worm on anybody's computer on the list, and how annoying it was to receive email like this with everybody on the "to" line...
By replying to all, everybody's address was on the "to" line.
Again.
Maybe I'm just sick. I don't know. But I did get a few
Re:Title is Misleading (Score:4, Insightful)
Parent
Simple fix: boycot & save time (Score:4, Interesting)
If I were one of those invited, then a thing like this would immediately make me loose interest in whatever they'd have to say. Show in advance you can't do yourself what you're preaching about. Duh!
I'd just decline the invitation, and spend my time elsewhere (probably more productive). If a majority of the invited folks would do this, the event would be dead in the water. Killed by stupidity of the organization.
Parent
Re:Simple fix: boycot & save time (Score:4, Funny)
Why, was your interest tight before?
Parent
Re:Title is Misleading (Score:5, Insightful)
It's not that Verizon exposed "the wrong" 1200 emails, it's that Verizon exposed any email addresses at all.
If ever there was a worst-case-scenario set of 1200 email addresses, this list was it.
Parent
Re: (Score:2)
Re:Title is Misleading (Score:5, Insightful)
Yes and no. In terms of potential harm done, these people are much more equipped than your average person to be able to mitigate this fuck up.
On the other hand, if there was ever a subsection of people who you donn't want to piss off in this regard....
Parent
Re:Title is Misleading (Score:4, Funny)
Verison is so sure about their new security policies that they wanted to show the experts that publishing their collective addresses is no longer a problem.
Parent
Re: (Score:2)
"The time has come for someone to put his foot down. And that foot is me."
Re: (Score:3, Insightful)
I think it's awesome. (Score:2, Insightful)
Maybe now we can have secure, authenticated email.
It's only laziness and the lack of any security mandates that prevents us from having decent email.
Re: (Score:3, Insightful)
I'm sure the lack of any authenticating authority doesn't make it any easier.
Re: (Score:2)
It's not that Verizon exposed "the wrong" 1200 emails, it's that Verizon exposed any email addresses at all.
It is a figure of speech - its like saying "The thieves choose the wrong van to break into when they burglarized an FBI SWAT team's van. [news4jax.com]" Breaking into a vehicle is wrong, no doubt, but some vehicles are more worse for the burglar than others.
Similarly, the most likely people to raise a ruckus and thus embarrass Verizon about poor emailing procedures are security pros. Do it to a buch of joe sixpacks and chances are they won't even notice, much less publicize it.
Re: (Score:2, Insightful)
That doesn't seem like the wrong van. Seems a reasonably high value score for robbing a van. They weren't caught (at least when that article was written) after all.
Re:Title is Misleading (Score:5, Funny)
While I agree that the email slip-up was pretty bad, I was more concerned about some of the other sensitive information that Verizon publicized. In addition to those 1200 emails, Verizon also emailed other sensitive information including:
1.the secret herbs and spices that go into KFC's chicken
2. the combination to the door of the Bat Cave
3.The location of Dick Cheney's 'undisclosed location'
4. The chemical composition of Kryptonite
5. The burial site of Jimmy Hoffa
6. the nuclear launch codes for U.S. Trident nuclear missile submarines
7. the full name, post office box address, and social security number of the The Good, the Bad, and the Ugly's Man with No Name
8. the address and repository information for that government warehouse that contains the Ark of the Covenant (it's on rack 12, shelf 7, box 336)
Parent
Re: (Score:3, Funny)
The chemical composition of kryptonite was already known - sodium lithium boron silicate hydroxide. And it exists in nature too!
Re: (Score:2)
Oh, the news was they exposed the mailing list?
I thought it was that Verizon had figured out e-mail.
Verizon responds (Score:5, Funny)
Re: (Score:2)
No, the typical inter office response is for the same stupid clerk who screwed up in the first place to first send out 1200 message retracts, followed by 1200 "Sorry, please ignore this message". After that of course the only slightly more clueful network administrator sends a message to everyone telling them not to send messages to everyone.
It can only get better from here.
The reason is obvious (Score:2)
Clearly, the email blorf and the conference itself are one in the same -- a cry for help from Verizon.
Times Time Times Time (Score:2, Funny)
and they did it 17 times.
They were afraid that if they did it 18 times, it might look suspicious.
--
Oh Well, Bad Karma and all . . .
So if the story only gets reposted 16 times... (Score:2)
Does that mean the Slashdot is more responsible than Verizon?
Just more of the same from Verizon (Score:3, Insightful)
Note that their cell phone business is completely separate from the rest of the morons. Neither business unit talks to each other and neither knows what the other is doing. If the wireless side of the business had any brains they would split off and change names. Verizon is associated with incompetence and greed.
Re: (Score:2)
Their business model is how to screw the customer out of the most money and provide the least amount of service.
This is the business model of EVERY wireless carrier. I have tried them all (in the USA) and have yet to find one that is honest and interestedin delivering good service. So I pick the lesser of all evils and switch when that one become more evil.
Re: (Score:2)
You fucking kidding me? The wireless side is the problem - their other enterprises aren't great, but they're tolerable at least, and unobtrusive at best.
If Verizon-not-counting-wireless had any brains, they'd kick out VZW.
Re: (Score:2)
Well, I was just about to mod you informative, but the next Slashdot story:
http://mobile.slashdot.org/article.pl?sid=08/10/10/209209 [slashdot.org]
tells me they are trying for a merger instead. (Verizon to charge providers $0.03 per SMS).
Re: (Score:2)
In a somewhat related matter, I once had the exact same thing happen when applying for a job at the NSA. They had us go through this whole song and dance about how we shouldn't disclose what we were doing in Maryland. Then they emailed us all after the interview process was over (which wasn't fun, btw) thanking us for coming out. Sadly, they must have mixed up the BCC and CC fields. I let them know, but they didn't seem to be perturbed.
Verizon's next product (Score:2)
Sweet, now maybe I can have Verizon start sending me more information on Breast Enlargement and Erectile Disfunction Pills.
Similar email blunde with bandwidth.com today too! (Score:2, Interesting)
very strange coincidence indeed. Bandwidth.com blasted about 300 addresses in an email today as well - it's fun to see all the COO's, CIO's and CEO's of bandwith.com customers acting like children and trolls by 'reply-all'ing' and complaining about exposing their addresses.
Uh, hello mr. ceo - your reply is unsolicited - you are the SPAM you are complaining about!
what a weird coincidence.
Reply? (Score:2)
Didn't anyone replyed to all? I'd love to see the thread of flames.
So is this like (Score:2)
They should have listened to that good advice that they obviously just didn't take.
Who would have thought ... it figures!
This happens more than you think... (Score:2, Interesting)
The person responsible... (Score:3, Funny)
is dead. No really, someone killed him already. Securely and anonymously. We have a list of 1200 suspects and their names. Actually, 1200 people have a list of 1200 suspects and their names.
What a coinsidence - bandwidth.com - same today (Score:2, Insightful)
Some bandwidth.com representative sent an email to 1,300 of their customers this morning. The reply list was so big it crashed Evolution when opened.
One interesting thing about the event was that a great discussion raised from it. Customer's were bouncing ideas off each other, asking what their different configurations were, etc. Some were whining about the service or complaining that we should stop spamming them.
Then, shortly afterward, in the middle of some pretty decent discussion - the CEO of Bandwidth.
Re:I know this is /. and all... (Score:5, Insightful)
Except that there is absolutely nothing to distinguish some clerical errors and actual security issues. If information is leaked by clerical error, it's leaked just as effectively as if it were hacked out of an on-line database through cross-site scripting. Maybe more effectively.
Parent
Re: (Score:2)
.03 cents? What a steal!