It is interesting that Kevin was willing to take the stand, considering that his original employer had fallen behind on his payments and that there were no signs of tampering.

Though Sprint is foolish if they keep up the charade of being secure. If you've been had, why hide it? A con or social engineering is like any other con. If you're a mark and you've been had, then you have been had. If someone breaks into your house, you're not going to deny it. You're going to shore up your defenses to prevent the next attempt.

Sprint is doing what amounts to putting a piece of shrubbery in front of the hole and claiming that the incidents never happened. In which case, they are foolish and have no concept of how to handle a security breech.

But what if it is worse than that? what if its true that they have no idea what is going on security-wise? That people are penetrating their networks and they have no means to find out if people have been screwing with them or not? In which case, they aren't just fools, they are a threat. A liability to themselves, their customers, and to their strategic business partners.

Wonder if that's the reason why my sprint phone has been missing it's messages lately.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/497/13396#13396