Western Union Cracked, Credit Cards Stolen

TrumpetPower! writes "NPR just reported that Western Union is recommending that customers who used their web page to send money should cancel their credit cards after somebody cracked their online credit card database. As I type this, the Western Union homepage simply states, "Our Web site is temporarily out of service We apologize for any inconvenience To find the nearest agent location plase call: 1-800-325-6000."" Not much online yet besides the AP brief. (Normally we don't post this stuff, but its getting submitted a lot, and it is kinda a big deal). Lends more credibility to the disposable credit card concept.

Comments

Re:Why do peopel feel the need to store Credit Car

[rcw-work]

Wonderful. I'm not familiar enough with the intricacies of the MD5 algorithm to know exactly how many bits of input randomness are needed to guarantee the full 128 bits of output randomness, but the several hundred bits you're using above should be plenty.

How do you store the random 56 character string so you can verify it later though? If you need to put all these pieces back together again at a later date, and the only thing the customer is entering is the credit card number, you have to store the other pieces in cleartext or a cleartext-equivalent. If the hypothetical cracker can get their paws on that table and the customer id table, you're back to a few dozen bits to bruteforce.

liability?

[jetson123]

It isn't clear that any numbers were actually stolen, only that people broke into the computer and that it actually had the credit card numbers on-line.

Of course, I think Western Union should be held liable anyway: their poor security is causing their customers and credit card companies a lot of effort and expense, whether the cards were stolen or not. Keeping personal information, in particular credit card numbers, on a system that is accessible from the Internet is grossly negligent.

Re:liability?

[jetson123]

With my CC, I have to dispute charges in writing and reissue takes more than just a day; what bank are you using?

People have gotten into problems over misuse of their credit cards, mostly when it happens on a significant scale and they don't notice for a while (as part of an identity theft). That can cause problems with your credit rating: you can dispute and explain all you want, for the lender, you still are less attractive than someone who hasn't had those kinds of issues.

Another problem with canceling credit cards is that they often have ongoing charges (ISP, on-line bookstore, etc.) on them, and all that needs to be changed as well.

Re:liability?

[sjames]

The correct way to deal with credit cards is to use an asymetiric algorithm (public-key) encryption, where the private key exists only on a system that has no connection to any network. The encrypted data is then pushed to a floppy/zip/etc, where is is processed by human hands at the secured processing machine. The processing machine is then protected by physical means (cages, keys, cameras), and is done by a person who has been deemed trustable (background checks, etc).

That is a good setup. A serial link should also be acceptable as long as an unprivileged processing daemon (w/o access to the secret key and with no capability to send data) on the processing system is the only thing listening to the serial connection.

Re:liability?

[mindstrm]

I know it can happen.. but..

When false charges show up on my credit card, that I know I didn't pay, I simply pick up the phone and tell the CC company that I want to dispute the charges. They take them off, and do their own investigating, and inform me of the results (ie: I have to pay, or not).

This in no way at all damages my credit rating. If a lot of charges are showing up, I have the company cancel the card and issue a new one immediately. It shows up the next day in the mail.

For the most part, if you stay on top of your credit card bills (ie: read them when they come in), you are fairly safe from this kind of thing.

Re:liability?

[sjames]

If someone with a mask and gun steals a bag full of CC receipts from Sears, then uses the numbers, is Sears at all liable for their misuse? Should they be? How does this change for e-commerce stores?

The important standard here is reasonable care. Sears would NOT be liable if someone takes the credit slips at gunpoint. It is not reasonable to expect someone to risk their life for that. OTOH, if a kid takes a big bag of credit slips from the loading dock and abuses them, Sears may BE liable, since they could have easily prevented the theft, and should have anticipated the possability.

It is the same for an e-commerce site. If the database server had default account and password and was accessable from the net, that's like leaving the slips outside. If someone got the passwords or stole the drives by holding an admin at gunpoint, they would not be liable.

It is also possable that their vendor could be liable if they had assurances that the security measures were adequate. This would be the real world equivilant of putting the slips in a locked office but discovering (too late) that the guaranteed security lock could be opened by jiggling the door knob.

Re:liability?

[joeytsai]

If you're really paranoid about your finances, you really shouldn't use a debit card. It's similar to carrying around your checkbook with every check signed.

Here's one article.

Re:liability?

[jetson123]

It ought to be the merchant's problem, but it isn't. It is the consumer who has to deal with the false charges, the damage to his credit rating, and going without a credit card for a while. In fact, the liability of merchants and credit card companies for causing the consumer harm through their credit-related actions seems pretty limited.

Re:liability?

[trog]

I would suggest that this is bordering on overkill. There are lots of brick-and-mortar businesses that handle credit cards without needing precautions like those.

There is no such thing as overkill security; only difficulties in implementation because of the extra work it places in production.

In online business, credit card theft is much rarer, but it is more devastating, because it is usually many thousands of credit cards at once, rather than just one or two carbon reciepts stolen out of the waste basket.

Don't get complacent...

Absolutely. This is just one component in an overall security policy. Trust me; there is MUCH, MUCH more to the systems I have built than this.

What might be even better would be a Java applet running on the client side doing the encryption there. That way the plaintext never even enters the server.

Unfortunately, the legality of this is still in question with current US crypto laws. This would also be very difficult to implement, due to differences in java runtime environments, etc, etc. But it is an interesting idea.

Re:liability?

[osu-neko]

OTOH, I've seen banks happily pay checks where the signature bore no resemblance at all to the owner's signature. Running around with all your checks signed only really lets the theif know he can do what he can probably do anyways without the checks being signed.

If someone steals your checkbook, make sure you report it immediately...

--

Re:liability?

[austad]

Sue. Sue their pants off. I use my card for work and my company can call me in the middle of the night and say, "you're on a plane at 10 for New York", and I'd have to go. My bank takes 2 weeks to replace a card, I had to do it a couple of months ago. During that time, it was impossible for me to travel.

A large financial site should take every possible precaution to prevent such things. It's essentially the same as leaving a stack of credit receipts on the store counter and walking away for 30 minutes.

I can guarantee you that when my online store is up (if I ever get time to finish it), there will be absolutely no storing of card info at all. Even if the card numbers are "sneaker net'd" over to a box with no NIC or modem in it. None. If I stored card numbers and someone broke in and got them, I would fully expect my customers to hold me liable.

Re:liability?

[Admiral Burrito]

An important component is that no sysadmin at the company has any access to this processsing machine. Only technically inclined executives (i.e. CTO, CIO, COO) have root access to this machine, and if maintence must occur at this machine, the sysadmin is logged into it by the executive, who then physically watches what the sysadmin is doing (and the executive knows his/her shit, so there is no question of foul play).

I would suggest that this is bordering on overkill. There are lots of brick-and-mortar businesses that handle credit cards without needing precautions like those.

Attacks over the internet are serious because they are relatively anonymous. Credit card numbers stolen by employees are less of a concern because the pool of suspects is small and you know where they all live.

In this scenaro, if the website is completely compromised and all credit card numbers are stolen, they are completely useless to the cracker, as they cannot be decrypted without that private key.

Don't get complacent. As long as your system is working and those credit cards numbers are getting encrypted, you're okay. But if you're hacked that can change. Someone could capture credit card numbers as they enter the system- after they come out of the SSL-encrypted socket, but before they get encrypted by your application. A good rootkit could keep such a process hidden for a long time. Of course, this is a much more difficult attack than just dumping the contents of a database.

This is ideal practice, and should be implemented at all e-commerce sites.

Not quite ideal, but a major improvement over what most people are doing right now.

What might be even better would be a Java applet running on the client side doing the encryption there. That way the plaintext never even enters the server. The applet should be signed so that if someone breaks into the server they can't simply replace the applet with a trojan. But this assumes that the users would notice if the applet was not signed- a bad assumption.

Re:liability?

[mindstrm]

I don't know the legalities.. but from a purely idealistic view, it's like this:

The CC Company values customers over merchants. Merchants pay to accept cards. (not that merchants aren't important).

The Card is simply a token of the credit the company has extended to you. It is a means to an end; it is not the credit itself. Same with the number on that card. The number simply identifies your account.

From what I remember from personal issues with cc companies, it is fairly easy to dispute charges.
It used to be that a card imprint was requried. Later, anything would do, but a signature was required. Remember, you have to authorize each and every use of your card.
If a merchant cannot show that YOU actually authorized the transaction, he has no right to collect funds on your card.

Simply using the card yourself is authorization enough; but the merchant should be able to prove it. ie: registered delivery of goods to your home.

The onus should be on each and every merchant who accepts credit cards to ensure that they are taking part in a legal transaction. This is why there is a signature on your card; this is why you must sign your receipt. It *IS* permissible to ask for ID when someone presents a credit card!

Like cheques these days, the system does not verify everyhing. IT's far cheaper to deal with issues should they arise than to simply check every transaction.

Just because society is rushing like a madman into using credit cards for digital transactions for everything on earth, and merchants are forgoing safety checks... this is the MERCHANT'S problem, not the consumers.

Re:liability?

[trog]

The correct way to deal with credit cards is to use an asymetiric algorithm (public-key) encryption, where the private key exists only on a system that has no connection to any network. The encrypted data is then pushed to a floppy/zip/etc, where is is processed by human hands at the secured processing machine. The processing machine is then protected by physical means (cages, keys, cameras), and is done by a person who has been deemed trustable (background checks, etc).

An important component is that no sysadmin at the company has any access to this processsing machine. Only technically inclined executives (i.e. CTO, CIO, COO) have root access to this machine, and if maintence must occur at this machine, the sysadmin is logged into it by the executive, who then physically watches what the sysadmin is doing (and the executive knows his/her shit, so there is no question of foul play).

In this scenaro, if the website is completely compromised and all credit card numbers are stolen, they are completely useless to the cracker, as they cannot be decrypted without that private key.

This is ideal practice, and should be implemented at all e-commerce sites.

Re:liability?

[mindstrm]

Royal Bank of Canada. It is possible they do require written notice beyond a certain point; I am unsure.

As for identity theft, yeah. I can't dispute that. It sucks.
Perhaps Credit companies should have a way for you to be issued a new card and 'flag' valid transactions.

Hmm. Come to think of it, why not have a card that is *just* for regular payments? Keep it locked up somewhere.

Re:A Clue About Security

[um... Lucas]

Plus it lends more strength to the idea that money cards, anonymous, variable in value, and secure, desperately need to be implemented, whether Big Brother likes it or not.

well, that seems to be quite a task to properly create and implement. Why don't you get on it and create such a system in a feasible manner and come back then?

And it's not like this is a big, big deal to consumers. Worst case, they pay $50. Probably won't even have to do that, since western union has money and won't flinch about reimbursing for that rather than risk a class action suit.

it'll probably just end up meaning that western union has to pay higher processing fees and take a charge off against earnings because of it. that's it.

Re:The Problem

[techfreak]

traced to human error .. Somebody left a database open

Geez... either stupidity/carelessness, or intentional. Not to sound conspiracy-ish, but there is some, however unlikely, chance that the 'somebody' did this on purpose.


---

Re:Wait a minute.

[dangermouse]

ugh. don't i feel stupid.

coulda sworn I quoted him there. oh well. still, my point was valid... it just took a little bit more reading ability (say, 4th grade) than I remembered.

No way

[l33t j03]

Many of the posts on this story suggest that no credit card information should ever be stored on a web connected server for a very long period of time. I tend to agree, and have tried to make that point to many of my company's e-commerce clients (I build DBs). The point at which the discussion ends is when I inform them that their customers would be required to enter their CC info every time they visited the site. It seems that most companies feel like their customers would rather take the chance that security is 'good enough' if it means that they will be saved a few seconds of typing.
This feeling seems to be borne out by reality, the few companies who have taken me seriously have provided the customer with the option to retain CC info. (some of those guys store it regardless) Suprisingly, most people choose to store it, security be damned.

Might this be because the general public is ignorant of the way these systems are connected to the internet? People are used to keeping their money in banks, with big physical barriers to theft, not on a computer that is subject to a seemingly endless stream of security holes.

-----------------------------------------

Down with Credit Cards!

[Darth Eggbert]

I think the time has come for a true electronic currency. Something like the credstick idea in Shadowrun. Cheap, disposable, and safe, just like cash.

Re:root

[benedict]

Some network client code has buffer overflow or other security problems. Running network client code as root is therefore riskier than running it as an unprivileged user.

--

Why Store CC Info?

[lw54]

Why should anyone store my CC info?

We run an ecommerce site and I went as far as to verify that our credit card processor doesn't *ever* store credit card details?

Doesn't anyone care anymore? Am I the only one that doesn't like my financial information being stored?

Re: Why Store CC Info?

[chrischow]

on ecommerce websites i have built in the past i have always made sure the CC was not stored anywhere on the server (except for the few moment the transaction was taking place). gee what a nightmare if someone should break in and grab the numbers! the bad PR could kill a small company if a hack did take place.

Re:End the pesimism, research OS security!

[Peaker]

There is work in Linux and several other Unixen to move to a capability based systems and implement the principle of least privelege

As pointed out by the main EROS engineer (if it is right to put it that way), Linux and other systems can never evolve to pure capability systems.
Internally, Linux uses capabilities, but that does not matter at all, as the external API of the system is not capability-based, and can never be one. In order for it to be capability based, the change will be so huge, you wouldn't recognize Linux in the other end. Pure capability systems have to be built from the ground up, because a combination of ACL and Capability systems seems to always end up worse than both.
Another issue with capability systems is that the machine state becomes more complex to set up, while implementing the principle of least privilege, and simplicity. The simplest solution is EROS's, to use Orthogonal Persistancy. This makes a file system obselete and redundant, and only a prone-ness to security holes, not to mention it is the basis of all which is UNIX. This means UNIX will never be able to EFFECTIVELY implement pure capability systems, not while remaining a UNIX.

Re:Cracked... Where was the encryption

[BMIComp]

CDNOW? Are you talking about the incident with CD Universe?

Well, it's probably pretty obvious, but all of these companies don't care about security. Security comes in a distant second compared when compared to money. They'd rather concentrate on methods of obtaining more revenue online, than securing their website. That's just my thoughts on these businessmen.

Although, it said that while performing routine security checks they found this problem, right? Well, at least they realized that they had an intrustion. The worst is when the company, and/or the public doesn't find out about the theft, until it is too late.

Re:Ass raped monkeys

[Lord of Caustic Soda]

I was working on a project that involved building a website for a freight moving company, because of the way things are charged the credit card number do have to stored temporarily (Even though the details will be in the database for at most a day or two). Sometimes the requirement for the business mean that you have no choice but to store information better just sent to the bit (or in this case, decimal) bucket.

But yes I agree, storing credit card numbers simply for the users "convenience" is BAD - afterall, who wants to use a stolen card number more than once ;)

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:suuuuuuuuuuuuure

[juuri]

hahahahahaaaaehheaoehaoahoeaeoheo

wait

haeiehaihaeehoeoeah

"my workstation". you mean your peecee right?

---
Solaris/FreeBSD/Openstep/NeXTSTEP/Linux/ultrix/OSF /...

Wait a minute.

[dangermouse]

I've NEVER heard from a credit card company that the consumer would be held liable. In fact, if I recall, most have used the non-liability of a customer in the event of credit card theft as a selling point for their card.

Re:Wait a minute.

[dangermouse]

Not true. Read his first sentence, in which he accuses credit card companies of covering up this policy and propagating the idea that the consumer is liable, despite the contrary being true.

That is the statement I was addressing, which should have been obvious as I quoted it.

I'm sure I don't even have to point out the irony of your calling me a "thickheaded nitwit".

Re:Wait a minute.

[jareds]

That is the statement I was addressing, which should have been obvious as I quoted it.

You did? Go reread your post.

I'm sure I don't even have to point out the irony of your calling me a "thickheaded nitwit".

And I think the overall irony here speaks for itself.

Re:No, you haven't

[juuri]

rwalld

gnufingerd

both now fixed

---
Solaris/FreeBSD/Openstep/NeXTSTEP/Linux/ultrix/OSF /...

Re:They should take the blame, not "hackers"

[sbergstrom]

That's true, but the blame that's put on the poor security should be blame for allowing hackers to do what they did. They shouldn't take the blame for what the hackers did.

Re:The Problem

[agentZ]

HAL9000: This sort of thing has cropped up before, and it has always been due to human error...

Microsoftware == Needs to be hit w/a clue bat.

[soren]

Here's how it works, site I would use for e-commerce-anything:

www.paypal.com: Server: Stronghold/2.4.2 Apache/1.3.6/L C2NetEU/2412 (Unix)

Site I would NOT 'trust' with such nfo:
www.westernunion.com: Server: Microsoft-IIS/4.0

Get a CLUE. Idiots building on retarded crap deserve it...blah...shame on whoever used westernunion.com or anysite that claims security with IIS.

bleah.

Comment removed

[account_deleted]

Comment removed based on user account deletion

More than one problem

[Ozwald]

There's the obvious problem that millions of /.ers have stated. Blah blah, firewalls, encryption, blah blah, blah.

While this is true, there is another problem. Recently I was camping and I found the previous camper's site reciept. After a milisecond I noticed that this person's credit card number was on it. Easy money I guess but it immediately found a fire.

This isn't an isolated incident. Has anybody ever heard of people digging in business garbage bins for reciepts that contain credit card numbers? I have. Restaurants are famous for this one.

I can never defend careless security, on or off the Internet. But either people must assume that credit card numbers are insecure or banks must find a way of making them secure.

Wouldn't that be cool; imagine if you could scream out your credit card number on /. without worring about being hosed.

Ozwald

Why store CCs?

[Malevolent]

The question is - why on earth did Western Union keep an /online/ database of transactions. I can understand that companies need to keep records, but why this has to be kept online, and not simply downloaded and burnt onto CD or some other storage mechanism. Having your security broken is one thing, but having databases like this easily available is another!

Programmers should be licensed, like engineers.

[Anonymous Coward]

They try to save a few nickels by hiring CHEAP PROGRAMMERS

Don't jump to conclusions. I've known many completely incompetent programmers who earned $100K - $200K per year. The problem is that, unlike other engineers, programmers are not licensed, and held responsible for their mistakes.

When a bridge collapses, you damn well want to know who designed it. An engineer who is caught making stupid mistakes will quickly lose his license. But in computer programming that engineering ethic is strangely absent. Most programmers seem to care only about whipping out a script that handles most test cases, and let QA catch the errors. But any programming team that follows this practice will sooner or later come to grief.

It's their fault...

[Docrates]

To me, the only way to prevent crackers from getting into some system and steal credit card numbers is to not store them in your system... I run an ecommerce site and every transaction made, once cleared with the bank, gets its credit card info deleted.

the advantages of storing users credit card numbers does not justify the risk. It's like a restaurant that keeps your credit card number so that next time you eat there you don't have to wait for the check...

sure there could be trojan horses that store credit card info as soon as it arrives to the server, but that seems to be less common.

Re:It's their fault...

[um... Lucas]

So, tell us please, which e-commerce site do you work at? I'd downright LOVE to order some stuff from them... Or will you not say?

Re:Liability after warnings like this?

[um... Lucas]

No... Interest rates spiked at the end of the 70's due to inflation or deflation or what not. Once the card companies realized that they could charge that much interest, they never really bothered lowering them again even remotely match bank rates...

Interest rates are just profit for the card companies. they hype it up and say otherwise, but they're not really losing a dime over anything.

Didn't anyone read the CNET story?

[Drestin]

A Western Union spokesman said the vulnerability was caused when "performance management files" were left open on the site during routine maintenance, allowing the hacker access. He did not know when the maintenance began or how long the site had been left unprotected.

"We are still in the due diligence period," said Peter Ziverts, a spokesman for the Englewood, Colo.-based company. "But this wasn't an architectural problem; this was due to human error."

Repeat: "it wasn't an architectural problem; this was due to human error."

So, get off the IIS/SQL/NT crap - being desperate for ANYTHING anti-MS doesn't paint /. users in a positive light to anyone.

This could have just as easily been a *nix box and it still would have been compromised if propery security methods weren't followed, as was the case here.

Re:Putting out the fire - with CRACK

[MSG]

I couldn't agree more. But that being said, have you seen the view from the other side?

No. If someone breaks into Western Union's computers, and they even THINK about Napster, DeCSS, or anything involving Open Source, then they have some problems of our own. This doesn't concern "us" as a hacker community. I don't see the connection that you do, obviously.

Doesn't matter to them that you specifically didn't do it, just "one of your gang".
That's about as sensible as saying that since if a black man robs a convenience store, the store owners are going to blame black men. Blaming the faceless boogeyman might make some people feel better, but it doesn't solve any problems. I don't think that such scapegoating should be encouraged.

Re:This should _never_ have happened!

[kirwin]

Who would sue them? Oh, a class action suit? The articles say that as of now, none of the potentially comprised card info has been used. Do you really think the 1337 D00d5 are going to use them with all of the media hoopla about the crack? I doubt it. WU will take a major loss of e-business over this, which will probably teach them not to be so careless next time. Plus everyone will forget this by Friday.

Re:Liability after warnings like this?

[Merk00]

Well, I believe US Federal law requires the credit companies cover any fradulent charges over $50. I also believe that there is a limited amount of time where you can report those fradulent purchases (I'm not sure how quickly it is). So, basically, the credit card companies have to eat the cost. Most credit card companies will cover the $50 also but YMMV. Now, debit cards are another matter and I don't believe that fradulent use of a debit card is covered.

Matt Leese

Re:The Problem

[generic]

Hey did you password the DB sa account after we finished the install? "Nah, I will get to it after lunch"

Re:This should _never_ have happened!

[Demona]

But see, to the proles, "proper safeguards" consist of what even the most larval of script kiddies knows is completely laughable. As for those who actually have a clue, we've seen how often they're truly in charge of decision making. So they go and Do the Right Thing, like a right and proper BOFH, and usually end up being yelled at or sacked for making things "difficult", or for just BEING "difficult".

Not the first time...remember CD Universe?

[IvyMike]

I was one of the poor saps unfortunate enough to have been a one-time customer of CD Universe when their credit card database was stolen and held for ransom. I had purchased one CD (Nina Simone, for the curious) about 10 months before the hacker took the numbers, and I still had to go through all the pain of cancelling my credit card. Worse yet, I had several services (my newspaper, my ISP) auto-billed off the credit card, which I forgot about, and those services were cancelled once they were unable to bill to that old number.

I was very fortunate that there were no purchases made against my number, probably because I had it cancelled very quickly.

In any case, it seems ridiculous that sites should keep your credit-card information forever, thus amplifiying the damage caused by any hacks.

Re:Not the first time...remember CD Universe?

[radar bunny]

in any case, it seems ridiculous that sites should keep your credit-card information forever, thus amplifiying the damage caused by any hacks.

they shouldn't keep them at all. Once my purchase has been made and the product has been sent out the door there is no need to keep the credit card number on any computer. They can print a reicept and file the thing in a locked cabinet if they absolutley have to. And, that is only so they can back up any "disputed charges". After sixty days (the normal time allowed to dispute charges) they shouldn't have my cc number anywhere. If i decide to make a second purchase i will be glad to take the entire 8 seconds it takes to re-enter my cc number.

Re:Not the first time...remember CD Universe?

[Evro]

I had a Fleet card and *they* automatically cancelled my card and fedexed me anew one. I had forgotten that I had even had an account with CD universe.

But I agree with you about the other hassles, the autobilling, etc. My EZ pass was on the card among other htings.

__________________________________________________ ___

facts are in short supply, other sites are serious

[drowsy]

Maybe they only used MS for the brochureware. The rest might have been built on any vendor's stuff.

I will be interested to hear _why_ they believe any violence was done to the DB. What the clues were, etc.

I do know that once I was attempting to build a site for a company that had content which was going to be integrated into the [insert very large card company here] web site. This small fact was enough for two of their security folks to grill me, they sent a rep to conduct a physical security check, and they wanted a white hat to give our dev server a go. They wanted two firewalls in front of my dev server. I was fairly impressed. So on some sites yr info is considered important.

Re:Disposable Credit Cards

[Evro]

I thought of the dispoasble credit card thing about a month before reading about amex's idea on slashdot. The problem I found with it is that you would want to sell them at a place like 7-11, but with that much cash-equivalent laying around, the store is just begging to get robbed. 100 $50 or $100 cards is a lot of moolah in a pretty small space. I think less that $50 would be sort of useless, as would these cards for expensife electronics, unless shops implement the ability to accept multiple cc#s for a single purchase, which I doubt they'd want to do (10 cc#s as opposed to 1 are 10 times more chance for the transaction to be canceled, etc).

__________________________________________________ ___

Re:They should take the blame, not "hackers"

[Lord of Caustic Soda]

True it's not moral, but when you're in a country where there are no laws against this kind of stuff, why not?

Heck, you can rationalise it as improving the economy, weed out the weak.

Even better, do a $5 charge from each of the thousands of cards to a charity of your choice. Now no decent person would actually go to the bank and demand a refund from a charity, would they (I sincerely hope that still counts as a rhetorical question, or else I might as well start working on that doomsday device that'll obliterate the evil human race from this planet)?

learn http, idiot

[x-empt]

a proper request is "GET / HTTP/1.0" or "GET / HTTP/1.1\r\nHost: www.porn_cc_database.com\r\n\r\n"

Re:learn http, idiot

[FooBarson]

Apparently you have not heard of HTTP 0.9.

In the future, please reserve use of insults to for those who are less knowledgeable than yourself.

Re:learn http, idiot

[psamuels]

You mean HTTP/0.9 which is case-sensitive and

requires "GET" to be in uppercase?

Re:learn http, idiot

[kirwin]

if all I want is the server's OS and webserver....do I really need to make any more unnecessary keystrokes?

Re:Cracked... Where was the encryption

[paled]

that's because you can't tell if someone has issued the query
"select name,credit_card_num,exp_date
from web_user_info;"
once it has been flushed from the shared pool. If you noticed that something strange was going on, the DBA could pull or the text from the recently issued queries from v$sqlarea and v$sqltext. Unless auditing is enabled (or logging is provided within the application), there is no record of queries issued against the database - its just too much overhead for most apps.

After 'em!

[Dirtside]

The varmints're gettin' away on their horses! We'll never catch 'em!

Re:Putting out the fire - with gasoline

[benedict]

What's this "us vs. them" crap? I am no more part of a "we" that includes skr1pt k1dd13s than I am part of a "we" that includes Western Union. Give it a rest.

--

ATM + 'credit' card things

[dangermouse]

(Now if you used one of those silly "ATM + 'credit' card things" that lets people irreversably take money out of your bank account you'd better think again...)

Ummm... no. My card, at least, when used as a credit card, carries nearly the same consumer protection a normal credit card does.

Re:Oh, the things I've seen

[Pontiphex]

I have found VNC to be a perfect utility for installing Oracle on a remote unix box. Its as good as X, but you can use it in disconnected mode so that if the network is slow or unstable, it doesn't kill all the stuff running under your session...you just reconnect and everything is still there as you left it. Look it up on FreshMeat or Yahoo!. --b

Already in the works

[empesey]

You can see information about this here:

http://www.boston.com/dailyglobe2/252/business/To_ ease_online_fears_AmEx_plans_one_time_cr edit_cards+.shtml
http://www.chainstoreage.com/news_desk/index.htm?# 2243
http://news.cnet.com/news/0-1007-200-2718520.html? tag=st.ne.1007.thed.ni


--

I got the letter

[Anonymous Coward]

There is more to this than what they say. Think blackmail......

CC Co's and Fraud

[benedict]

Given that the credit card companies eat the cost of fraud, they have every motive to minimize it.

I do think the ball's in their court to develop more secure systems, but remember that they have a vast amount of infrastructure and investment to deal with.

I haven't looked into the details of American Express's new one-time-use CC numbers, but at first glance it looks to me like they are moving in the right direction.

--

Re:CC Co's and Fraud

[tiwason]

Given that the credit card companies eat the cost of fraud, they have every motive to minimize it

Nope... The merchant eats all of the fraud cost and more... CC company doesn't suffer a bit... cept some adminstrative costs....

Re:Oh, the things I've seen

[SuiteSisterMary]

Yup. Full of shit. Client: Can you guys do a one time install and configure of Oracle for us? My Boss: Sure thing. SSM, get to it.
Me: Sure thing, boss. I'm assuming that they've guarenteed that the Internet between there and here will be both fast and stable enough to keep an X session going for the several hours it will take to install and do basic configuration?
Boss: Huh?
Me: *points to docs that say no character mode install*
Boss: AAAARGH!
Clients: AAARGH@
Nobody was happy at the end of the day.

Re:Cracked... Where was the encryption

[Lord of Caustic Soda]

You typical user info are stored so that you can read them later - now imagine a few GB of data, think now bad the crunch will be when you change the key used to encrypt them. (Which you should, regularly)

And if they can get to your db, they can always just grab a copy of the data and proceed to brute force crack that single key.

If you are about to say "But you can have one key per user!" May I ask where you you're going to store those few thousand keys?

....

[Anonymous Coward]

...the fastest way to send money to LEET HAX0RS.

Re:Liability after warnings like this?

[KingBozo]

It is not the credit card company that take the hit on this. It is the Merchant that accepted the card that looses out. The Bank just doesn't give them the money.

Back to the Future

[Britano]

Maybe the hackers are searching for the letter Dr. Brown sent back in 1885?

Re:Back to the Future

[myke_hines]

lol!! thats fucking funny

The Problem

[Andrew Dvorak]

The problem, as reported by NPR, was traced to human error .. Somebody left a database open, which is where the vulnerability existed. Western Union will correct the problem, says they.

Re:The Problem

[msnomer]

Damn humans! They're nothing but trouble. Someone should get them away from computers.

--meredith

Re:The Problem

[karmma]

Western Union will correct the problem, says they.

hmmm... they'll close the proverbial barn door?

Re:The Problem

[Icebox]

Thats the human error, the person who left the database open doesn't work for WU, they work for MS.

Re:The Problem

[NuclearArchaeologist]

Somebody left a database open

Open? What did they do, take the case off? Did they forget to turn the key?

"It's my fault boss. I was using pcAnywhere last night, and I fell asleep." Could have happened to a company using MS IIS/2.

Re:The Problem

[ActionListener]

>> The problem, as reported by NPR, was traced to human error .. Somebody left a database open, which is where the vulnerability existed. Western Union will correct the problem, says they.

Hmm. Here is another problem they should also correct :)

bash$ lynx -head -dump http://www.westernunion.com/
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Sun, 10 Sep 2000 18:29:13 GMT
Content-Type: text/html
Set-Cookie: ASPSESSIONIDGGGQQRVA=FHJINCOAOHANHOGNFICFFEGA; path=/
Cache-control: private

Re:suuuuuuuuuuuuure

[kirwin]

I have the right to. I have the skills to. I don't have a credit card database on my workstation.

Re:(Normally we don't post this stuff...)

[legLess]

Well, if you use "normal" mathematically, he's probably correct. If /. posted every story about CC #s getting cracked, we wouldn't have time for Napster stories.

Think different

[e-gold]

...Lends more credibility to the disposable credit card concept.

That's not the only concept that should be considered (and neither is e-gold, I'd just like to see better/deeper thinking on payment options here).

Western Union has objected to e-gold-selling market makers in the past, ostensibly because some interesting sites use the currency for gram-based gambling. Of course, Western Union is owned by First Data, a giant credit-card payment processor, which I'm sure would NEVER process payments related to plastic-using-gambling on the internet, since I'm convinced that they're the very model of moral decorum compared to venal exchange-providers using the filthy yellow metal as a currency. (smirk!)

I want folks to play with our system, especially Slashdot readers, so my usual offer to click a bit to any /. readers who create an e-gold account and send me the number applies, as does my usual "I don't care if you moderate this comment down because you think it's 'spam' because I'm self-interest personified," and "my opinions are mine alone" attitude(s). Thanks.
JMR

Re:(Normally we don't post this stuff...)

[RickHunter]

Its the royal we. Notice that none of the names on that list reads "CmdrTaco." ;-)

-RickHunter

End the pesimism, research OS security!

[Peaker]

How many more thefts and breakins will it require, until people realize that for security, the principle of least privelege MUST be implemented!
This principle CANNOT exist in a UNIX system, which has very rough granulity to its security, and is based on very huristic security methods that form an extremely complex, impossible to secure system.

Most people gave up, "all systems are hackable", and basically give up the search for more secure technologies. I, on the other hand, am more optimistic.

The positive side of these cases, imo, is that people may finally start looking for more security in their systems, and divert the efforts from various near-useless OS kernels (that hardly add any functionality, albeit adding some elegance and sometimes even performance), to CAPABILITY based systems, which are the best security systems we can implement, and truly implement the principle of least privelege.

EROS technology is the future, it truly is the solution to all of this.
Progress will not be made, until we dump the unsecure designs of the past.

www.eros-os.org

Re:End the pesimism, research OS security!

[benedict]

> A file system is a file system, even if it is based on persistant objects in virtual memory space.

Wasn't that one of the lessons of MULTICS?

--

Re:End the pesimism, research OS security!

[sjames]

Internally, Linux uses capabilities, but that does not matter at all, as the external API of the system is not capability-based, and can never be one.

All of the capability information is there, it just never leaves kernel space.

A file system is a file system, even if it is based on persistant objects in virtual memory space. It doesn't really matter if the appropriate pointer to the object containing my new mail is 0x37f739d7 or '0x2f7661722f73706f6f6c2f6d61696c2f736a616d6573'

Granularity IS a problem of course, but I have also heard the alternate view that too fine a granularity will be 'too much trouble' or an 'undocumented mess'. Either condition will lead the very human admins to be too permissive, and thus defeating the security.

Re:End the pesimism, research OS security!

[Peaker]

P.S:
This UNIX comment applies to Windows as well, which is of the same class of security mechanisms (ACL's). (Not to mention various other systems that are not capability-based)

Re:End the pesimism, research OS security!

[sjames]

This principle CANNOT exist in a UNIX system, which has very rough granulity to its security, and is based on very huristic security methods that form an extremely complex, impossible to secure system.

Sure they can! There is work in Linux and several other Unixen to move to a capability based systems and implement the principle of least privelege.

EROS does look interesting though.

Whoa, CT Finds The Conspiracy

[Hrunting]

Lends more credibility to the disposable credit card concept.

You hit the nail on the head. American Express, a huge corporation, but second fiddle to the likes of Visa and MasterCard, needs something to promote its new idea. With the Internet at hand, it has its weapon. It sends some crackers to crack Western Union, thereby pushing people to the 'safer' disposable credit card.

Or maybe they didn't send anyone at all. Maybe they just got Western Union in bed with them. Who knows. The point is, CT found the conspiracy.

Re:Whoa, CT Finds The Conspiracy

[osu-neko]

Visa and Mastercard are non-profit organizations.

Err, so? What difference does that make? If someone markets a similar product to mine, they're competition, it matters not a bit whether they're making a profit or not, or whether they ever intend to or not. In fact, competition against people who don't want to make a profit can be the toughest competition of all to beat...

--

Re:Whoa, CT Finds The Conspiracy

[lw54]

American Express, a huge corporation, but second fiddle to the likes of Visa and MasterCard, needs something to promote its new idea. With the Internet at hand, it has its weapon. It sends some crackers to crack Western Union, thereby pushing people to the 'safer' disposable credit card.

American Express doesn't have any competition. :-( Visa and Mastercard are non-profit organizations.

Liability - Hassle your Customers

[DiS[EnDeR]]

I think its about time that the consumer became legitamately protected from the ignorance of copmpanies such as WU. 20,000 people now have to cancel their credit card numbers and debit numbers and obatin new ID. This is not an easy process and is time consuming. What if their are fraudulent purchases? Once again it wont be WU on the phone convincing an operator that they didnt purchase a pass to farmsex.com.

Their needs to be some sort of control over these e-commerce buffoons who screw us by running unsecure boxes and poor transaction servers. would a class action lawsuit be an idea? I wonder what the credit card companies are going to do to WU. I mean it is their property WU messed with. If I were MAstercard or VISA I would be laying some heavy restrictions down on WU, the cost to replace cards and cover any illegitamate purchases is reason enough.

Re:c|net's article

[brunes69]

I don't see where. This is just a rehash of the AP article linked to in the story.

Re:Liability after warnings like this?

[Wansu]

My wife's CC# was one of the ones posted on the Russian cracker's website after CD Universe was cracked last winter. One day, the credit card company called her to say they were cancelling her account and opening a new one and that she'd be getting a new card in the mail. It showed up a couple days later.

Re:Why do peopel feel the need to store Credit Car

[rcw-home]

If they get the contents of that table, MD5 won't save you. No one-way hash will.

MD5's relatively generous 128 bits only helps if the text being hashed has 128 bits (or more) of randomness in it.

A 16-digit credit card number is 54 bits, the last twelve digits of it minus the check digit are 37 bits. I'd guess that real credit card numbers have less than 25 bits of randomness.

It'd be a magnitude easier to bruteforce than a DES-hashed passwd file.

I don't troll.

[chazR]

OK, sometimes I drag the bait along the bottom to see what bites, but I wasn't doing that here.

If you are prepared to telnet to port 80 on a known compromised box, then you are also likely to be the sort of person who runs Netscape as root. Or [insert IRC client here] as root.

Doing unneccessary stuff as root is, um, bloody daft? If you are lucky, the worst that will happen is that you accidentally hose your entire filesystem. But connecting a client to the internet with root privileges? I can't stop you, but I don't think it's needed.

Ask yourself: Does this make the ankle-biters job harder or easier?

Don't be afraid. Be paranoid.

Re:Ass raped monkeys

[kugano]

Well, the problem is not that the companies are keeping records of credit card numbers. In fact, you're supposed to keep the credit card numbers as part of your transaction records. That way you know who ordered what, for how much, and on what credit card from you in case those records are ever needed.

The problem is that the companies are keeping these records online. Most companies that keep credit card records keep them either on paper (rarely anymore) or on a special computer system not accessible to the outside world. This is what people should be doing, and I can only hope that this Western Union business will set an example for other companies that they need to take their security much more seriously.

This is going to be expensive

[Howl]

If we take the middle number of 15,000 customers and say $80 each to issue a new plastic (yes that's what it cost to issue a new card) then we're talking $1.2 million for this incident alone.

Ouch!

Re:suuuuuuuuuuuuure

[bellings]

Sorry... I don't have any reason to pay attention to the IIS security reports. Does IIS/4.0 have some security issues?

Re:Putting out the fire - with CRACK

[Soko]

Doesn't matter to them that you specifically didn't do it, just "one of your gang".
That's about as sensible as saying that since if a black man robs a convenience store, the store owners are going to blame black men.

I beg to differ. The normal human response to an unknown group are (unfortunately) fear, mistrust and resistance, especially when it seems a representative of that group has attacked you. There have been people who looked at me, a hardware guy, sideways because in their mind, since I know how to build a computer, I _must_ be able to crack into them. Stupid? Youbetcha, but a reality none the less.

I am not encouraging scape-goating - I'm advocating that we use a measured and well thoght out response, instead of resorting to finger pointing and name calling. If anything, I'm hoping that we differentiate ourselves from the h4xor doodz by not adding any more fuel to the fire. I think a concilliatory attitude is best, not the "Well you stupid fucks, you were asking for it" that seems prevalant so far.

Re:Liability after warnings like this?

[benedict]

If Western Union can warn all 50K customers, they should much more easily be able to warn a couple of credit card companies.

--

Netcraft says...

[THATDOG!]

www.westernunion.com is running Microsoft-IIS/4.0 on NT4 or Windows 98. Hahahahah.

Re:On-line Databases

[YKnot]

Since the webserver must verify the CC-numbers, it has to have a connection to a system where these are stored. While it is easier to secure a simple API which implements only verification, this way of separating the database from the webserver is not automatically secure. You could still hack the webserver and move on from there to hack the verification API. That is theoretically possible even if there is no direct return channel (data can only be sent to the database-server). See ->IP-Spoofing for an example of what you can do without getting any replies just by knowing exactly how the other system will behave.

Re:Oh, the things I've seen

[SuiteSisterMary]

Thanks, I'll have to look into it. The problem is that clients aren't always amenable to having extra network service installed. Should be perfectly good for internal stuff, though. And some clients. ;-)

Re:Ass raped monkeys

[an_mo]

Why the hell do they keep a cr. card database? I'd be happier if they didn't. And it's not necessary for them to do so.

Re:Disposable Credit Cards

[paled]

I bought someone a gift certificate card fom Barnes and Noble. Until it is activated at the cash register via a transaction, it is just a plastic card with a magnetic strip. I can't see a clerk at a 7-11 as being able to activate more that 1 of these per minute. If 10 are generated within 10 minutes, it ought to generate a notice that an irregular event is taking place. What robber wants a holdup in a 7-11 to take 10 minutes?
When a redemption trasaction is put through with the "stolen" disposable credit card, the local authorities and Fox's COPS and Deadliest Car Crashes would be notified for the ensuing car chase.
Up and at 'em.

Re:(Normally we don't post this stuff...)

[talks_to_birds]

I think the real definition needed here is for the word "don't"

Clearly, "they" "do"...

t_t_b
--
I think not; therefore I ain't®

what about other services (like paypal)

[darthpenguin]

With this incident, I was reminded of many other services, like Paypal and Billpoint, that store credit card numbers. What would happen if someone was able to break these systems? What security measures have they taken? When I signed up for Paypal, I don't ever recall anything about their computer security, so I'm left wondering how vulnerable is the service to giving out my CC#?

-http://MSD.dyndns.org

Re:Oh, the things I've seen

[Cramer]

Well, I'd give Oracle part of the blame for this. Nowhere in he installation instructions or printed documentation with ANY Oracle product do they tell you what users and passwords they are loading. I've only ever been asked for a password during installation on a windows system. I had to look through the setup scripts to find their damned default password.

BTW, this is a problem in alot of places. Software installs things you aren't aware of (esp. on windows.) And admins aren't paying attention or aren't trained to manage what they are handed.

Putting out the fire - with gasoline

[Soko]

This is NOT good. Western Union is Old Money - they've been around for a long, long time as far as companies go. This will get the establishment REALLY pissed. Do we really want an all out war with The Man? Something like this will not help the cause of Napster, DeCSS and Open Source in general.

The establishment is not used to how the Hacker culture does things - they are used to order and directed control. The Internet is a terribly chaotic place - if you want something done, you go ahead and do it. Also, the first one there usually controls the situation, no matter whom else joins them in the endeavour (witness that newer posts on /. usually garner more moderation points, and therefore direct the comment stream). Even in Internet startups, there is usually one person who starts the company and then hands over the reigns to an established Buisiness man to run the show (Yahoo!), not like what happens with Internet based projects, where the Alpha Geek or Lone Coder is regarded as the undisputed leader, regardless of how much education or money he has (a Good Thing, BTW).

The establishment will likely view this as futher validation that we are out to kill. While the Hacker community has control of the Internet attacke like this may end up being more common. The only way the Establishment can ensure it's continued existatnce is to wrest control back. Napster being stamped out might be the first salvo in the Great Internet War. This little faux pas (likely by a script kiddie) will only accelerate the zeal and ruthlessness with which The Man deals with us. They just might see such attacks as a threat to thier very survival, and react accordingly.

OK, some of you may post "Yeah! Stick it to the man, l337 h4x0r d00dz" and think it's good that the rich are getting thiers. That's fine, and welcomed on one level. However, we need to look at the big picture - The Man can pull the switch on the Internet if he's really threatened (not literally, figuratively), so we end up out in the cold (InternetII, anyone). Or just toss your ass in jail, rights be damned. As much as we don't like it, we have to compromise and let the establishment have its way - for a while.

I hope we can start to see things from the other side of the firewall soon - and use articulate argument, humour, understanding and gentle persuasion to get our way instead of random guerilla attacks on established companies.

Re:Putting out the fire - with gasoline

[Anonymous Coward]

Vandalism and theft have nothing to do with freedom. If I mug or if I pick your pocket and get your credit card and proceed to buy stuff and you just happen to be rich, I'm not sticking it to the man. I am thief, Napster and DeCSS are about very different things, and while the MPAA may try to paint being able to access copyrighted digital data as theft, they are trying to manipulate the language not talk about what pirates are doing. This is illegal because CC#s which can be used to purchase things and cause the unauthorized transfer of money have been taken into posession of which was never intended.

Re:Putting out the fire - with gasoline

[Soko]

Exactly. However, you may get lumped in with them anyway - that is at the discretion of the Western Unions of the world. Saying "I am no more part of a "we" that includes skr1pt k1dd13s than I am part of a "we" that includes Western Union." won't do you any good, unless there is some tabgable way of demostrating that to the established powers that be.

Re:Putting out the fire - with gasoline

[Soko]

I totally agree with you.The problem is some of these l337 h4x0rs wrap themselves in the cloak of "Free Speech on the Internet" when they get caught. That ties them to OSS in general in the eyes of society at large - don't forget that the "unwashed masses" tend to not differentiate between the sub-sections of a group. If you can use a computer for more that e-mail, you're a hacker, and you'll be lumped in with the idiots who did this. As I said, that's NOT good for worthier things like DeCSS and Napster. Stealing CC#s is illegal and theft - and by current legal standards, sending your friends and MP3 of Metallica's latest song is illegal and theft, too.

From the establishments point of view, these two are one and the same. As such, they deserve the same method of remedy - litigation.

Re:(Normally we don't post this stuff...)

[ShaunC]

I believe "this stuff" was a reference to "stories that just came over the wire ten minutes ago with next to no details," not a reference to "stories about credit cards."

Shaun

Re:They should take the blame, not "hackers"

[sbergstrom]

How can you possibly say that hackers aren't to blame? Just because someone was careless doesn't mean it's instantly moral to exploit the new weakness and use it for less than acceptable purposes. Hackers are to blame, because they're the ones who did it.

Re:(Normally we don't post this stuff...)

[mangu]

CmdrTaco, define 'we'?

4 MSNBC: Stealing Credit Card Numbers Online is Easy by Roblimo on Sun 16 Jan 05:22PM EST 341

4 Largest Online Credit Card Heist Ever? by Roblimo on Sun 09 Jan 04:59PM EST 359

3 RealNames Customer Data Stolen by emmett on Mon 14 Feb 06:55AM EST 129

4 British Crackers Demand Millions in Inforansom by Roblimo on Sun 16 Jan 11:52AM EST 195

On February 15 CmdrTaco saw the wrongness of his acts and decided to stop posting this stuff normally.

obdcping, build a mssql default install scanner

[joejoejoejoe]

I have been meaning to write a script to find default installs of mssql. The reason is the password is blank by default. Mssql comes with a tool called odbcping.exe. A sample command would look like this:
odbcping.exe -S 10.0.0.4 -U sa -P
If the returned text contains "CONNECTED", you are in.

This isn't ground breaking or anything, but now I can write a script that takes a list of hosts that were listening on port 1433 (use a port scanner) and I have an almost sure fire way of finding a server that is misconfigured(a.k.a. insecure).
The rest is trivial. If you can access the system as sa, you do just about anything(xp_cmdshell 'net user') or what ever you 31337 heart desires.
The admins of a system on the Internet with a blank a password need to have their fingers chopped off.
Regardless of how WU was vulnerable or hacked, the Internet is driving people online who don't belong there, and they are being put in possitions of power and they don't even know or care.

my .02 on personal security:
most people compromise their own privacy...

Comment removed

[account_deleted]

Comment removed based on user account deletion

amazon

[csbruce]

Perhaps amazon.com's one-click patented technology will be less appealing after amazon.com's online customer database is ultimately hacked by 1337 h4x0r d00dz. What we really need is one-click class-action lawsuit technology.

The practice of keeping credit-card numbers around on an internet-accessible machine after a transaction has cleared is brain-damaged and companies that do that deserve to be sued.

When web sites tell their customers about how safe their transactions are because they are using secure sockets, etc., they should also be telling their customers that, after the safe, encrypted data has arrived on their server, it will be available in plain text to anyone who can type "system/manager".

Inserting CC#s into Databases with ...

[x-empt]

Why not insert the CC#s into a "NO-SELECT" privileges table (encrypted of course, both at record level and at filesystem level)? Then grant select to a different user (that is denied login from non-priveged IP#s).

Simple solution for many online stores, yet it is NEVER done (at least that I have seen), except for on my own store that I am coding.

So now, you have 3 levels of security on top of the normal database server, firewall, etc.

Then follow a new standard procedure of deleting credit card #s after billing and possibly replacing the field with only the last 4 digits or an MD5 so that you can verify it later.

Common sense, but nobody seems to want to follow it.

Re:the only uncommon thing is that they admitted i

[groke]

How does that work? wouldn't having a -$25 balance make the card useless to you as well? I'm a wee bit confused...

Disputing charges

[KMSelf]

From what I remember from personal issues with cc companies, it is fairly easy to dispute charges.

So you'd think. In my case, the company was Chase Manhattan, and it took over nine months to resolve a $200+ disputed charge which appeared on my acount after I'd closed it. The charge wasn't posted to me for over a year, following a resubmission by the merchant. I immediately notified Chase by phone and mail that I wasn't responsible for the charges (to a Florida hotel -- I live in California and have never been to Florida). The charges (and interest, and late charges) continued to appear on my statement. Repeated requests for copies of the actual charge slips failed to produce anything.

It was ultimately the threat of legal action, including criminal charges for fraud, misrepresentation, and malfeasance, and libel (credit history), if the dispute wasn't resolved within 30 days, which got the charges cleared from my account -- nine months after they'd initially appeared, seventeen months after they'd been made, a year and a half after I'd closed the account.

Yes, I got the dispute resolved, the dollar value was low, but it was a complete PITA.

What part of "Gestalt" don't you understand?

huh?

[dangermouse]

So where's the public key? And what has this bought you, at all? If you can't decrypt these numbers without the private key, which exists only on the non-networked machine, then why store them in encrypted form on a networked machine at all? They're not just useless to an intruder in that form, they're useless to you, too.

This is a very elaborate scheme you've cooked up, but its only advantage seems to be having the numbers stored on a non-networked machine, which could be done without the encryption and all the other hoops you have the merchant jumping through.

Re:huh?

[trog]

So where's the public key?

On the production servers. It doesn't matter where the public key is, because you can only encrypt with it. You cannot derive the plaintext from only the public key when you use a well tested (both mathematically and in practice) asymetric algorithm. You can tatoo the public key on your forehead if you like; it is no less secure.

(Of course, with credit card numbers, you have very real problems with known-plaintext attacks. These are dealt with quite easily; I'll leave that answer as an exercise for the reader.)

And what has this bought you, at all?

It's pretty obvious you don't work with financial data.

It has bought you (close to) airtight security. The database containing the encrypted card numbers could be completely compromised, and it doesn't matter. Without access to the private key, they cannot be decrypted in our lifetime (Of course, this assumes our current understanding of mathematics.)

What many people fail to realize is that for most credit card transactions, the vendor has to keep a record of the cards. You cannot simply discard them. Most businesses have to keep them indefinately.

Doing it this way is much more secure than storing them in a locked file cabinet somewhere.

but its only advantage seems to be having the numbers stored on a non-networked machine

Again, it is very apparant you don't work with financial data. The card numbers have to be downloaded in batches. Because the decryption machine is physically seperate from all other networks, you cannot do this in real time. The encrypted cards have to be stored SOMEWHERE before you download them; without the proper use of an asymetric algorithm, they would be stored in plain text in a database (a bad idea, remember?), or encrypted with a SYMETRIC algorithm, which is just as good as storing them plaintext (In a symetric algorithm, the same key used to encrypt also decrypts. Because you would have to store the key on the server that encrypts them, the key is subject to compromise)

Re:A Clue About Security

[Lord of Caustic Soda]

Why not? When the additional cost outweighs the benefits, the bottom line is what matters. Why else you think car manufacturers release cars with defects (if they CARE about your safety, would they so actively promote those big dumb SUVs?)

On to another god damn no good SUV killing off nice (and actually affordable) sports cars, utterly OT:

When you're charging down the motorway on a rainy day, would you rather be in a 2 ton truck or some 4WD sports car (call me a wimp, but I like the technology as a crutch when it comes to driving).

And when is the Subaru Legacy (what do they call that twin-turbo tweaked version again?), the Mitsubishi Galant VR-4 or the Nissan Skyline not big enough for a family?

Re:Cracked... Where was the encryption

[osu-neko]

At the beginning of the record, encrypted using the common key. Encrypt the rest of the record using the (completely randomly generated) record key, and encrypt the record key with your single, common key. The common key is now pretty much unbreakable, since the ONLY thing it encrypts is random bits. No way to make a known plaintext attack against that, and brute forcing it is not an option unless you have a few centuries to kill. And each record is now encrypted using a different key. Give me a few years computing time, and I'll be able to crack one users CC#, with which I'll be able to make changes worth 0.001% of what it cost me to get it.

--

Re:c|net's article

[Anonymous Coward]

"No fraudulent transactions had been reported"--YET. Have any credit card statements been sent out--YET?

I've been walking someone through covering her ass after having her CC# stolen (not through Western Union) and was astounded when the fraud unit of this company (again, not Western Union) admitted that it believed that someone had broken into its database. And she does no online commerce.

So far, it's been nearly a month from the time that she was notified that her card was over her credit limit that she's been able to dispute fraudulent charges (can't dispute charges until the credit card statement arrives; can't file a police report without a credit card statement; can't put an alert on other personal records without a police report).

Translate "No fraudulent charges have been reported [YET!]" to "The shit hasn't hit the fan [YET!]". It's going to take some time before fraud reports can even trickle in. Perhaps about the time of the Thanksgiving Day parades.

Re:This should _never_ have happened!

[paled]

well, if you leave a default password open on a database that is publicly accessible, a simple (example) query against all_tab_columns such as

select table_name, column_name
from all_tables
where column_name like '%CREDIT%'
or column_name like '%CC%'
or column_name like '%EXP_DATE%';

might turn up the table that contains all of the user credit cards, not just one at a time when they're entered.

Re:This should _never_ have happened!

[alleria]

presumably by batches of tape several times a day, I would assume. *Shrug*.

Re:A Clue About Security

[osu-neko]

Why else you think car manufacturers release cars with defects?

Same reason Debian or RedHat or whoever you want to name releases software with bugs. They'd rather not, but it happens, and will continue to happen as long as people remain imperfect. When we all become perfect beings, then we'll start producing cars without defects. Until then, it's kinda stupid to expect that, and immediately decide there are conspiracies and/or shady motives involved when it doesn't happen.

if they CARE about your safety, would they so actively promote those big dumb SUVs?

If that's what people want to drive, sure they would. Your logic here is extremely spurious. The fact that other cars are safer than SUVs doesn't mean people selling SUVs don't care about safety. That's like saying because taking a ride at the county fair is safer than SCUBA diving, SCUBA instructors care less about safety than the idiots running the county fair, and I can assure you this is not the case, knowing representatives of both groups.

--

Re:This should _never_ have happened!

[Jon Peterson]

No, it's not a good analogy.

Computers are deterministic. Your 'con' is simply lock picking on a more complex scale. The fact that some logical constructs involving words similar to English are involved is not relevant. When you con someone into opening their house to you they make a voluntary decision. Computers can't do that.

Nonetheless, hacking computers is not equivalent to housebreaking, because no property is interfered with.

Hacking a system and looking around without making any changes or taking any information is, perhaps, closest to the crime of peeping tom or voyeurism in real life.

Re:Ah Yes, Western Union Uses Microsoft Software(z

[paled]

Yes, that solves it!
All SysAdmins should be required to read Slashdot for accurate info as to how best to secure their boxes and networks.

maybe not.

Liability -- Insurance

[KMSelf]

I'd actually like to see guidelines coming out of the insurance industry. Sears, in your example, would be liable, but would have liability coverage through their business insurer if they'd taken appropriate risk-mitigation steps. OTOH, if the credit slips are in an unsecured area and free for the taking, the insurance company would refuse coverage. There's a whole field of risk management concerned with both financial and physical business risks.

What part of "Gestalt" don't you understand?

Re:I just mail cash

[joshv]

Christ, ever heard of sarcasm?

Re:Oh, the things I've seen

[beacon]

Indeed so. I recently worked on a very large (>$1m) project for a multinational client, with a significant ecom component, where:

• The sysadmin had never heard of apache
  
• I and several other developers had full root access to the production environment
  
• The oracle manager account was system/manager
  

and various other nasties like that. In their defence, they never stored credit card numbers. But nonetheless, I couldn't believe it. IMHO, this all comes from abmitious young new media execs who know nothing about technology being given far too much money to throw around. They hire people who are good at BSing and dressing up their CVs, and they end up missing out the itsy little technical details, like getting a sysadmin who knows what routing is.

Just for fun, let me say that first bullet point again: "the sysadmin had never heard of apache".

the only uncommon thing is that they admitted it

[Splork]

This happens all the time people, the only truely uncommon thing is that they admitted to the public that they had a break in. Most of these are kept hidden.

As for cancelling your credit cards, why? With a database of zillions of stolen cards the chance that yours gets used is slim. It's less hassle to deal with the potential fraudlent charge appearing on your bill than to get new cards!

(Now if you used one of those silly "ATM + 'credit' card things" that lets people irreversably take money out of your bank account you'd better think again...)

whatever...

[AssFace]

99.9% of the places out there that encrypt their databases just use some lameass XOR scheme (b/c it has to be fast in and out) so that you wouldn't be able to look at it and immediately know what it is, but if yo uwant to crack it, you sure as hell can - esp if you have a full database of them and know the table name is something like "credit_cards".
--------------------------------- -----------------

More info on hole?

[AssFace]

What hold was left open? It looks as if they were on an MS syste - which would mean MS's SQL server, and I'm not sure what version they were using, but up until very recently (and perhaps still, haven't followed it) - the default login/password for the SQL server was "sa" loging and no pass wasn't it? Tight as a drum, nobody will ever figure that one out.
-------------------------------------------- ------

Re:Liability after warnings like this?

[ahaning]

Perhaps credit card companies should now offer "hacker" insurance.

Possibly. But, unlike earthquakes, fires, flooding, and tornadoes, there are ways of protecting yourself from intruders in your computer systems.

On your house, you put a lock. If you're more protective, you get a noisy security system that alerts the police and you pay a fee. I suppose they could call it a "mandatory security fee" rather than "hacker insurance". Would you buy into a company which would basically be telling you "We know we will get hacked. Pay us if you want protection." ? They would at least have to make it sound nicer. A security fee sounds much nicer than "hacker insurance". And a security fee shouldn't even be NEEDED. This sort of thing should be AUTOMATIC when you got a service involving monetary transactions. There should not be optional security.

Re:Ass raped monkeys

[beacon]

AFAIK, most of them do. At least, all the banks I've dealt with demand that you follow certain security procedures before you use a merchant account for Internet transactions. The problem is, they get you to sign a bit of paper, but they don't enforce it, and their requirements are fairly lax (e.g. SSL and a firewall).

An Ounce of Physical Separation...

[64.28.67.48]

Is worth a ton of firewalls and proxies. The fact is, if you make it possible to get at the credit card numbers over a public network, someone smarter than you will work harder to get them than you worked to secure them. The solution is simply to physically isolate the long-term storage of credit card numbers -- put them on a database server which is not accessible to the Net. Use a zip disk or a tape or whatever to batch what comes in to your web site. Every day (or hour or whatever), you have a process on the web database server dump the info to removable media, you physically walk it over to the isolated server, and you load it there. Once the batch is transferred successfully, you run a second process that deletes the credit card numbers from the web database server. If anyone manages to crack your web server, they can only credit cards entered from the time the previous batch was completed. If you don't have repeat customers enter their information again (you have the transactions go through the isolated server), then there's even that much more protection. The compromise of a few dozen credit cards (or even a few hundred) is a very manageable situation.

Putting all customers' credit card info on a publicly-accessible server is saying "we don't think anyone can get in" because the result of someone getting in would be catastrophic. That's a foolish and arrogant position. It's like not having homeowner's insurance. If you design your system, which, to some people's surprise, includes actual physical and human considerations, to minimize the effect of failure on any one piece, then you don't have to say "everyone who was ever our customer is now at risk".

Well, now we are seeing the (possibly lack of) disaster recovery plans by Western Union. We didn't ever think it would happen -- now what do we do?

----------------
The truth is out th - oh, wait, here it is...

-------------

No, you haven't

[chazR]

Here's what you did: You connected over the internet, while logged in as root, to a machine that is known to be compromised.

Trust me, if you knew enough about Unix to have a root password, you would't have done this. There is now a finite possibility that a nasty cracker type is looking through the web logs from the compromised box. When they find your connection attempt, you become a target. And now we know you connect to the internet with apps running as root.

You, madam, are now about to become just another roadkill on the information highway.

Share and Enjoy

Re:No, you haven't

[tftp]

And now we know you connect to the internet with apps running as root

We know; the cracker doesn't. Telnet does not send any HTTP headers to the Web server and there is no way to find out from this very TCP session. I can think only of identd (which is evil anyway and is not installed by default by many distros). This request will be indistinguishable from millions of other hits.

Get a gold card.

[mrsam]

Speaking from experience, it's a major pain in the ass to cancel a credit/debit card and get a new one, not to mention trying to figure out how to live without one for a week.

Most banks who issue gold or platinum CCs will overnight you a replacement card for no extra charge. I've lost my credit card twice, in the last ten years. Each time the bank fedexed me a replacement by next morning.

---

Re:Oh, the things I've seen

[Johnny Starrock]

No one is going to be able to just sit down and effectivly or securely run an enterprise DB. You're going to need either training or preferably real-world experience.

Re:What a title for this post.

[AFCArchvile]

The title looks more like it would deserve a score of -1, in contrast to its current score of 2. Oh well, never judge a book by its cover.

Re:This should _never_ have happened!

[Lord Ender]

Your guidelines aren't so foolproof. Say the attackers cracked the site before they took credit card data. They could just hack the website, then have the web frontend forward the data to their database, instead of trying to crack some write-only database.

A write-only database is no good if the crackers control the web page front-end to the database.

Re:Oh, the things I've seen

[Lord of Caustic Soda]

And the worst is having a project where the web "designers" are calling the shots.

"Can you please put in some helpful error messages to tell the user whether they've entered an incorrect user name or just a wrong password?"

"No problem, should I list the most likely username intended and display the password hint as well? Come think of it, why don't I just delete all the files and drop the database on the live site, and save the "user" some trouble?"

Knowing how to do fancy graphics (actually not all that fancy at all) does not a web designer make.

Re:They should take the blame, not "hackers"

[weeble]

I agree to a limited degree I think both are at fault.

A parallel may drawn between this and the army. If you leave your locker open and have your kit stolen you will be punished for providing a temptation to others.

You have to be responsible for your kit and the army's kit (or credit card numbers entrusted to you).

I cannot even order pizza now on debit card in London due to the high level of fraud.

Re:This should _never_ have happened!

[tswinzig]

How do you get stuff from the one computer to the other if the other is not connected to the internet? via disk?

Well, one way to do something like this would be to use a protocol other than TCP/IP to connect the "offline" machine to the "online" machine.

-thomas

"Extraordinary claims require extraordinary evidence."

Re:what about other services (like paypal) - Uh Oh

[paled]

wow, I hadn't thought of that.
Yes, its always NIMBY thinking until one's own account is compromised.
Looks like its time for me to get a dedicated credit card for internet use with a smallish limit - apply principle of least privilege to one's own credit cards.

Too many amateurs around.

[shippo]

Reports of e-Commerce sites being breached seem to be occurring daily. Every one appears to stem from some clueless amateur screwing up. Default passwords, open ports, sensitive data on the wrong side of firewalls. I've even heard of CC details appearing in a flat-file made visible by deleting a couple of levels from a URL.

Even my local newspaper, covering around 20,000 people, had as the main headline this week a story about a security breach on a local website. The report was laughable, with the web-hosting site believing that the attacker must have known the userid and password into the web publishing system, as they were unaware of any other means into the machine. Obviously someone else who has never heard of CERT, Nessus or Bugtraq. I'll probably be writing to the newspaper this week to put them straight, once I've let Nessus have a proper probe.

Re:This should _never_ have happened!

[kubalaa]

Yes, but in this case it's more like someone conned the president of the bank into giving out access to everyone's accounts. I'd sure as hell sue any bank president that stupid.

Perhaps...

[ffatTony]

he did what I did and renamed the user with uid 0 to 'bob' and made a non-privledged user named 'root'. I just did this to confuse people at work.

flawed concept

[rtscts]

Lends more credibility to the disposable credit card concept.

the whole system is screwed. which idiot decided that a merchant should be given authority by the customer to charge their bank account? bah

BPay rules. You tell your BANK to pay the money to the merchant. A payment consists of Biller Code (the company to pay) and the Customer Reference (your customer/account/bill # with the merchant).

Online ordering is easy - either you open an account with the company and all your purchases are pooled together and get paid for under your Customer #, or the website gives you a unique bill number after you confirm your order, and you pay for each individual purchase. Once you have your customer #/bill # you head over to your bank's website, log in, type in the details and your bill is paid.

AFAIK, it's only debit at the moment, but there's no reason it can't be extended into credit. It's no substitute for an in-person credit card, but for online shopping, it can't be beat, IMO.

Re:Disposable Credit Cards

[TheUnknown]

They are testing something similar in my hometown. You can have a card with any amount of cash on it. At the store (or vending machine), you insert it in the slot, the amount is displayed, you press OK and you remove the card. You can fill it back if you want more cash on it.

You can temporarily (sp?) protect it with a PIN but the way to use it is without PIN. It has the same problem as regular cash though : you lose the card, you lose your money.

For now, I think you can't buy cards at 7-11 but still the concept is there.

Benoit Potvin

Best practices anyone?

[Anonymous Coward]

The issue is that upper-management wants their web presence NOW. They don't care what corners get cut as long as you meet your deadline and it looks like it works.

I'm sure that if some group came up with a basic list of best practices for e-commerce security this sort of thing would be less rare... I'm sure companies would love to show their probably-hack-free compliance(tm).


stv

seriously, this is getting blown out of proportion

[AssFace]

They are just covering their asses. If this happened and they didn't tell peopel that maybe their credit cards were in the shit that was seen, then I have a feeling they'd get in more trouble with the lawyers that are inevitably swooping in as we type.
------------------------------------------- -------

Re:They should take the blame, not "hackers"

[luckykaa]

Personally, I think that people who have ludicrously poor security should take some of the blame. Obviously the hackers are the problem, but its a lot harder to feel sympathy for people who take no measures to stop something that shuld be predictable.

argh!

[dolo666]

Quick!! Purge the pagefiles!!!

Abandon ship!!!

ARGH!!!

Our data has been stolen!

{{ fade to black }}

/d o0-{W.U. HU BU HU}

Re:This should _never_ have happened!

[aozilla]

Nope, that's not true. Even if you have a 1 way cipher for the credit card data, if you can break into the webserver, you can steal the credit card numbers before they even get encrypted.

Re:You are the candle in the powder magazine.

[AFCArchvile]

And I suppose that you would also say that the Hindenburg was sabotaged? That aliens steered the iceberg into the Titanic? That the US Navy Seals had a sting operation to sink the Kursk?

I hate people like you who start the rumors.

Crypto is outlawed to keep it from terrorists...

[Anonymous Coward]

...and child pornographers. Yes sir, these anti-crypto laws sure are doing us good.

Re:Ass raped monkeys

[ZeroData00]

If they took the data that was more then a month old in there database and made a back-up and then deleted it (or least the CC numbers) off there server's maybe the world would be a safer place. yes if they ever needed it, they would have to put in the back-up disks back in the computer.but what really frights me are the companies that remember my Cardit card number, so "I" can use it again.

Re:On-line Databases

[Foogle]

I don't know about that. The webserver never really needs to see the CC#s. The customer is probably not going to need (or want) the website to re-display their own number... This is something they already have. All it might need to do -- as you mentioned -- is confirm the number; an action that does not require the webserver to actualyly have the number.

A perfectly viable method would be to send the pending credit-card number over to the database server, and have it (and it alone with access to the actual numbers) confirm it.

-----------

"You can't shake the Devil's hand and say you're only kidding."

Re:On-line Databases

[Detritus]

The web server doesn't need to retrieve credit card numbers from the database server. It needs to be able to store the information, request an authorization, and submit a charge. I'm assuming that the authorization and charge submission is done on the secure database server. It can report success/failure back to the web server. If you want the user to verify the stored information, you could do what some web sites currently do, X out all but the last 4 digits of the card number.

First Data Corporation

[gUmbi]

Is there any indication how far the hackers went?

Westion Union is owned by First Data Corporation, one of the largest credit card issuers in the US. Assuming the networks of the two corporations were somehow linked (or have systems shared between the two), if the hackers were able to get into FDC's systems, this could be disasterous.

It may be wise to invest in some put options on FDC...hmm

Jason.

Re:suuuuuuuuuuuuure

[Foogle]

You think that "rm" is all a root-user has to worry about?

-----------

"You can't shake the Devil's hand and say you're only kidding."

Re:They should take the blame, not "hackers"

[Stu Charlton]

Hmm. Last I checked, IKEA's core business was selling cool & affordable furniture. How does their bad expereinces with a website lead to the conclusion that they shouldn't be in business?

Many mistakes are made because people don't know any better. Really. "Cheap programmers"? More like "programmers that don't break the bank". It's hard to swallow that anyone with half a brain these days is worth well into a 6 figure salary.

Ass raped monkeys

[Greyfox]

It seems like a fairly common practise for these web companies to store your credit card numbers in their database forever and ever once you make a transaction with them. The very same people seem to have no concept of how to keep a system secure. What will it take to get these idiots to design their sites with some level of security in mind? Maybe a class action suit (malpractise or something) on the behalf of all the customers and credit card companies inconvienenced by this is on order...

Re:Ass raped monkeys

[buss_error]

IANAL: Actually, Errors and Omissions would be a better supposition.

Re:Ass raped monkeys

[0xdeadbeef]

Because that's the only way they can do effective customer profiling, so they can screw people the way Amazon does.

And don't think the credit card companies are on your side. They're part of the problem, pushing a security model where the identifier is also used as a "secret" key. It is their fault credit cards are such a risk to begin with.

Re:Ass raped monkeys

[um... Lucas]

naah... they need to keep that stuff, otherwise after 32 days, people could charge back all the charges to their cards and the companies would have no means of recourse or any way to attempt to show that they were not fraudulent charges...

Re:Ass raped monkeys

[Detritus]

I would expect the credit card companies to set and enforce security standards for merchants that accept their cards. If you want to accept credit cards, you have to sign a contract with, and be approved by, the card's issuer.

Comment removed

[account_deleted]

Comment removed based on user account deletion

IKEA (Re:They should take the blame, not "hackers"

[JimPooley]

It was probably one of those cheap self-assembly websites you can get.

Though they should have been warned when they saw the name.

HÅXØR

Quote from site

[kcarnold]

"Helping people make their lives better, everyday". Right...

Re:This should _never_ have happened!

[aozilla]

you steal the data before it's inserted into the database, not after.

Can anyone point me to an example of this?

[XNormal]

Storing partially encrypted data in the database and keeping the decryption key on a separate, secure machine definitely sounds like a good idea - but has anyone here actually seen this done in practice?

Can you point me to any references I can quote for management?

----

Re:They should take the blame, not "hackers"

[JimPooley]

Not any more it doesn't...
I mean, do you still use "Gay" as a simile for "Happy"?

Words change. Get used to it. Stop moaning when people say "Hacker" to mean someone who breaks into computer systems. That is now what it means, as "gay" now is a simile for "homosexual"

They should take the blame, not "hackers"

[imagineer_bob]

When it's usually their own damn fault for hiring BAD PROGRAMMERS and ENGINEERS! Since I don't know the details of WU, I won't comment on that, but let's talk about IKEA!

IKEA was cracked because you could do any query against their database by changing parameters in their URL.

Fortunately, a QA company caught this before it was too late.

IKEA has NO RIGHT TO BE IN BUSINESS. PERIOD. They try to save a few nickels by hiring CHEAP PROGRAMMERS and it's their own FAULT. p I hope IKEA and Western Union both go OUT OF BUSINESS.

--- Speaking only for myself,

Re:They should take the blame, not "hackers"

[imagineer_bob]

I certainly don't think the "hackers" are innocent, either! They should rot in hell, too.

But the company that hires cheap, young, inexperienced programmers should also be responsible, perhaps even CRIMINALLY repsonsible, just as much as the hacker is.

--- Speaking only for myself,

Re:They should take the blame, not "hackers"

[kazzuya]

I don't think IKEA needs to save money on programmers. I think that web development is a big business and very well paid.. everybody wants to jump in and it's a relatively new kind of development where there isn't a solid experience of the field.
Every software developer knows that there is no room for perfection when deadlines and money are involved. It's very common to have bugs here and there.. the problem now is that in web development bugs can easly mean security holes.
Eventually web developers will be required to be educated about security issues.. for now.. it's just a risky business for the customers.

Re:They should take the blame, not "hackers"

[Nathan Russell]

Um, I think you're all missing that the correct term for online thieves and vandals is 'Cracker', not 'Hacker', which means programmer.

Re:They should take the blame, not "hackers"

[um... Lucas]

that's lame. should a gunshot wound victim ever be held responsible for being shot because they weren't wearing a bullet proof vest? No...

Don't sit and defend the culprit just because the company didn't lock down their boxes strong enough. They might have screwed up, but that's like forgetting to lock your door. If someone breaks into your house, they're still the ones that get in trouble, not you.

This should _never_ have happened!

[CTalkobt]

This should never have happened. With the proper safeguards - ie: having a 1 way cipher to the credit card data and then another machine not connected to the internet to process it; the accounts would merely be a jumble of characters and digits encoded.

Any company that does business on the Internet without proper safeguards ( which is what it sounds like ... ) deserves to be sued.

Granted, my view may change - because there is not enough information about how - but this has happened at other sites and it still amazes me.

Re:This should _never_ have happened!

[CTalkobt]

There's two issues that the commenters are running into here. Intent and Action. The intent may be all well and good - educational, learning to be 'leet without any harm or ill malice towards the targeted machine.

The problem lies with the action the person took - If I go into a bank with good intents but happen to have a gun and wave it around and say give me $20.00; the bank teller is probably not going to ask me for my account number. I'll be arrested for bank robbery because of how I carried about my action - not because of my good intentions.

Freedom is not illegal. Abuse of it is. Deal with it. Grow up.

Re:This should _never_ have happened!

[CTalkobt]

Whether a robber breaks into your house and takes something is not the issue. He broke into your house. Here, the stupid script kiddie ( probably ) broke in, and managed to lift some confidential information. It's that disregard for security that I find offensive. It should be punishable.

By just taking a major loss on e-business - woop-de-doo. Like that's really going to affect the company 3 years from now. Larger companies aren't so concerned about 1-time hits of 3 or 4 months duration - they're more concerned about their long-time PR etc... You think Ford really cares about the tire recall right now? For PR sake's they have to - but they know they'll weather this storm. ( in fact, I think it's more Firestone was at fault.. but anyway... ).

Memory is so fleeting. Time passes. People forget. Companies go on without a bump.

They shouldn't. They should hurt, feel pain and remember the lessons learned.

Re:This should _never_ have happened!

[paled]

Wrong.
Don't give the account that is on the webserver the "SELECT ANY TABLE" privilege.
create packages (stored procedures) on the Oracle Server that perform operations such as insert_cust_info and insert_cust_credit_card.
Don't use public synonyms on the Oracle Database.
In this manner, if (when) the webserver is cracked, the account that is now owned can only insert data. By storing customer credit card info in a separate table that only DBAs (and specific procedures) have access to - the compromise dof the webserver does not allow the type of access that the hAx0r is looking for.

I believe that this is called "Principle of least privilege". Apply it.

Re:This should _never_ have happened!

[(void*)]

Interesting. So you are saying that becuase the computers actions are totally predictable (deterministic), it should not qualify as a con?

I have to disagree. There is nothing about humans which says they are not deterministic too. If I could give you a truth serum, then get you to reveal your password, is that not placing you into a deterministic state of mind, before "conning" you?

Or what about exploits that make use of race conditions in file locking and such to penetrate the system? There is an element of chance in such exploits - so that makes it a con game?

Actually, I was just pissed at the bad analogies that plague the whole issue. IMHO, saying cracking computers like lock picking is only accurate up to a certain point. A computer is not a house. Neither it is totally a con game. But anyone who want to equate cracking computers with housebreaking is probably not examining their metaphors enough to refute my con game analogy. I claim in fact, it is _slightly_ better.

And no, I don't approve of either house-breaking, cons or cracking.

Re:This should _never_ have happened!

[(void*)]

Do you consider hacking a computer to be equivalent to housebreaking? IMHO, they are not the same thing at all.

I consider hacking a computer to be more a con-game really. You see, your computer is chatty - when hooked up to the internet, it talks to other computers. Just that it could be untrusting or trusting about who to talk to, what to say, etc. Any computer that is naive can be tricked to reveal it's secrets, just like you can trick a idiot to telling you his mother's name, so you can use it to take money from his bank account.

I say this analogy is more accurate than housebreaking. Who do you say?

and in related news ...

[Stavr0]

IKEA caught with its ePants down
IKEA exposes customer information on catalog site

In short, a bit of URL hacking exposed their whole customer database. Dan Huddle (CTO of xanga.com) said: "What a spammer's dream!", commenting on the potential for abuse of that privacy breach.
Continuous coverage of butt-headed, idiotic eCommerce web page designs continues after these dotCOM messages.
---

Cracked... Where was the encryption

[mmca]

Was the database encrypted? Or did they store thousands of people credit card information in the clear on a system that was online?
Who was the system designer who let that get through? When are people going to learn that even though nothing is totally secure, there are many steps you can take so that you don't end up looking like an ass (CDNOW! comes to mind)

Encryption! Encryption! Encryption!

Get some and use it... (especially if you run a large finacial database.)

Re:Cracked... Where was the encryption

[kirwin]

The article states that they don't whether or not the credit card data was compromised.

Not the first time

[cfish]

I'm surprised that no one mentioned this: it is well understood in the security community that companies usually pay off instead of letting the news out.

my theory is, Western Union and others have probably have payed off numerous times before and finally realized that they can't pay crackers to buy silence anymore.

security measure? How about maxing out your credit card :))

A Clue About Security

[1alpha7]

Lends more credibility to the disposable credit card concept.

Please. It lends more credibilty to the concept that big corps still don't have a clue. Technology security (unlike physical) is not a place to save a few buck by hiring a few minimum security wanna-be rent-a-drunks. Plus it lends more strength to the idea that money cards, anonymous, variable in value, and secure, desperately need to be implemented, whether Big Brother likes it or not.

1Alpha7

Re:A Clue About Security

[1alpha7]

. . . that seems to be quite a task to properly create and implement. Why don't you get on it and create such a system in a feasible manner and come back then?

Although you are just whining, actually, through my employer, I am working on it.

1Alpha7

Re:A Clue About Security

[Admiral Burrito]

Technology security (unlike physical) is not a place to save a few buck by hiring a few minimum security wanna-be rent-a-drunks.

How is a company to know which they are hiring? Anybody can call themselves a security expert even if they don't have any real qualifications. There are a lot of people who know less than they think. Heck, how is a "security expert" supposed to know if they really are one? Sure there are certifications but how do you know that the material covered is selected by security experts and not just people out to make a quick buck selling certifications?

From what I have seen, in the tech industry most successful people start most of their jobs without knowing what they are doing, but have the ability to figure things out as they go. That doesn't work in security- just because you've made something work doesn't mean you've made it secure.

Re:A Clue About Security

[six11]

This isn't really that the man is a dumbass, but rather that the credit card paradigm is fundamentally screwed. Ever work behind a cash register? Every time you handle a credit card, you have all the information you need to rob them. Name on the card, the card number, expiration date, ... I know for a fact that i've sponsored dinner for a number of people that i had never met.

A disposable credit card or some equivalent, would offer protection in that ethically challenged people can only steal money from you up to the value of the card, which in this situation would not be very much.

Re:A Clue About Security

[fonetik]

"...hiring a few minimum security wanna-be rent-a-drunks."

All the sudden it's WRONG to be drunk at work?!?! WTF man... quit pickin on the drunks. =)

Why do they store credit card numbers?????

[jfp51]

We run a small ecommerce site and I don't understand why these companies keep doing this. I don't see why you need to store credit card numbers on your own local servers. In the payment system we use we can look up the credit card number for any transaction we have processed, thus negating the need for keeping them on our server. I think ecommerce sites should be REQUIRED to say if they do/don't store CC numbers on their own server. It just looks like a liability just waiting to happen. Why do they feel that they need to do this? Sorry for the mini-rant but sometimes corporations piss me off. JF

c|net's article

[Speare]

c|net's article has a little more information about the hack.

It was unclear whether the hackers obtained any personal account information. No fraudulent transactions had been reported by late yesterday [...] Only Web site users who conducted online transactions would have been affected. Company officials were using email, letters and phone messages to alert between 10,000 and 20,000 consumers to cancel their credit or debit cards and get new ones.

Re:Putting out the fire - with CRACK

[MSG]

Slashdot should have a moderators-only poll:
Are you on crack?:

• Yes
  
• No
  
• Brak
  

This post isn't "insightful", it's delusional. Western Union getting cracked isn't about "hacker culture" any more than a convenience store holdup. Someone broke in and stole information (potentially money). This happens every day in the real world. Anyone who thinks that the same kind of attempts aren't going to be made against their electronic storefronts isn't paying attention. It's not new, and it's no more likely to stop in cyberspace than in the real world. If you have a resource that you regard as property then you must defend it, or someone else will take it. As far as we know, that has been true as long as humans have had property.

"Hacker culture" doesn't enter into it. I've never seen any evidence that "hacker culture" encouraged theft of the property of others. The only persons I can concieve would attribute such a thing to "hacker culture" are not even close to being a part of it. (That means you!)

ESR didn't break into the server. RMS didn't do it. Linus didn't mastermind the attack. This has nothing at all to do with Open Source, as a movement or software. It's got a lot to do with Microsoft's closed source software and stupid administrators.

No, this attack is "NOT good". However, if the corporate powers want to do something about it, that _would_ be a good thing. Invest in better software. Pay for better admins. Defend our (and their) property. Making their security better makes our security better, too.

Funny.

[tweder]

Taken from the WU website...

Helping people make their lives better, everyday

n0w 7h3 f45735t w4y 70 53nd m0n3y (70 31337 h4x0r d00dz)

i cant wait

[benshutman]

i cant wait until someone steals my toast from my ip-enabled toaster.

i wonder....

[wdf]

who wanted a date this time?

you bastard!

[NuclearArchaeologist]

You slashdoted western union! What am I supposed to do for fun now?

Re:Ah Yes, Western Union Uses Microsoft Software(z

[shepd]

Hey common man, according to netcraft Western Union is as good at security as:

- Burger King
- Gillette
- The NFL

Doesn't that make you feel better now? :-)

Why CC Databases anyway?

[buss_error]

With the number of CC DB's being cracked, hijacked, cloned to hostile servers, I mean why the hell do that have to keep your number after you use it? Amazon does this, B&N, Buy.com, and most e-stores. Once the transaction is approved, wipe the number. You don't have to have it anymore.

If you really, really, want to keep it, set up a dot matrix and print it out. I think the Credit Card companies should charge the fraud back to the company that stored the number. That ought to promote securing a server!

Consumer is NOT liable

[HEbGb]

One of the greatest misconceptions propagated by the credit card industry is that the consumer is liable for charges incurred on a stolen credit card.

Read your agreements carefully; most of my cards hold me with little if any liability (the worst is $50 maximum). The rest of the bill is footed by the credit card company/issuer, not the consumer. When the credit card company denies a charge to 'verify security', it is not doing so for 'your protection', as they say, but for their own.

So, if the credit card numbers were indeed stolen and used illicitly (which is not clearly the case), it's the credit card companies who have something to worry about, not the consumers.

Regardless, Western Union should have had more secure systems; I'm sure this is very embarassing.

Re:suuuuuuuuuuuuure

[fluxrad]

if their security checks are so routine, then why did this happen?

[root@solstice /root]# telnet westernunion.com 80
Trying 208.244.136.46...
Connected to westernunion.com. Escape character is '^]'.
get /
HTTP/1.1 501 Not Supported
Server: Microsoft-IIS/4.0

Oh, I see now.

"Hmmm...i don't get it. the only IRC servers that will let me connect are those on undernet"


FluX
After 16 years, MTV has finally completed its deevolution into the shiny things network

I just mail cash

[joshv]

Hell, this would never effect me, I just mail cash. Ones are the best for mailing.

-josh

Re:Oh, the things I've seen

[paled]

Its not just the fscking installer that's Java-based, but everything except for svrmgrl and sqlplus. The entire DBA studio, Oracle Enterprise Manager are java based - that's why you need 512 MB ram and 1 GHz in your desktop - to watch assinine rotating globe spin around. Assholes.
Have you ever tried to use DBA Studio over a dialup connection with remote control software?
The only way to do that is to use an ICA/RDP connection to the sites LAN to a Citrix server and run OEM from there.
Bastards.

Re:On-line Databases

[myke_hines]

that doesn't really make sense.. if the webserver can see the CC#'s, which it will to verify information.. then if the webserver is cracked.. they will be able to do the same thing..

www.westernunion.com is running Microsoft-IIS/4.0

[Anonymous Coward]

'nuff said.

Re:Oh, the things I've seen

[SuiteSisterMary]

Perhaps. Oracle's 8.1.x installer (fucking Java based installer; can't install over telnet anymore on most systems) tells you system/manager and sys/change-on-install or the like. But anybody who's used Oracle even once knows about system/manager. Anybody who's used SQL Server knows about 'sa/'. Anybody who's used Windows NT knows Administrator, Guest, IUSR_MACHINENAME. Anybody who's used Linux knows about root, guest, etc etc. There honestly does need to be criminal liability for this sort of thing. If an armoured truck full of gold bricks were stolen because the driver left the keys in the ignition, or in the sun visor, there'd be hell to pay. Well, default passwords and blatently poor installation should be just as liable. Of course, the armoured truck driver doesn't have a CEO who's never gotten a driver's license sitting behind him telling him which pedal to push and which way to turn 'that wheel thing' all the time. It's not always the sys admin's fault. And heaven help the admin who's boss knows JUST ENOUGH to get himself in trouble.

Oh, the things I've seen

[SuiteSisterMary]

I used to work as developer support for a web application development product. This often involved doing work dirctly on a customer's site. If I had a nickel for every time I asked for the login/password for an e-commerce related database, and it was the admin login with either a null password, or a default, I'd have a shitload of nickels. And if I also had a nickel for each time the database was installed on a computer completely exposed to the Internet, instead of, say, being installed behind a firewall, with possibly only the database access ports tunneled through (and only accepted from the IP of the web machine), or better yet, having both the web and database machines behind the firewall, and requests to the web machine being forwarded through, well, I'd have an even bigger shitload of nickels. Picking up SQL Server for Dummies or O'Reilly's Oracle In a Nutshell does NOT an e-commerce ready database make.

Re:This is why

[sconeu]

How could I be redundant? I was post #4!!!!!

Re:Ah, the joys of a Cashless society

[Tower]

of course, each card has to be individually activated at the register (like the gift cert cards at many places, prepaid phone cards at checkout line impulse areas, etc...)... that would take a long time...

--

Liability after warnings like this?

[Forgotten]

I have a question for all the IANALs out there. I know that normally one isn't liable for purchases made on one's credit card by other people - the card company takes the responsibility of chasing down the offender. However, in a case like this where a subsection of card numbers have been stolen and the cardholders have been warned by the entity that lost them does the onus begin to shift to those cardholders? Maybe I'm paranoid, but I'm visualising a scenario where the card company says "well you were warned and you failed to cancel your card, so you have some responsibility too". Could this happen? Could it happen if instead of Western Union warning the customers affected, it was the card company(s)?

The reason it occurs to me that the card companies might want to partially reverse their long practice of not blaming the customer is that (a) these things are going to become more frequent, and especially (b) when this does happen, it happens en masse instead of a single, easily-tracked theft. If 50,000 cards are stolen and used for 50,000 medium-size automated purchases, it could be hard to seek redress. Indeed the paperwork in tracking down all the unauthorised purchases would probably be more expensive for the card company than the actual purchases themselves.

Re:Liability after warnings like this?

[craw]

I was involved in a case of credit card fraud. I was charged with about $1K worth of charges (in one month) from various gas stations in California. Unfortunately, I don't live there. The credit card rep that I talked to when I reported this was very nice. Asked me for my account number and some identifying info, then brought up my account. She then said, "Oh gawd".

All the fraudulent charges were removed. I later found out that my account number was used, but it had a different name associated with it.

And you are correct, debit cards are definitely another matter. Oh cool. I'm also watching TV (multi-tasking) and they just ran the Western Union story. Where was I? Woops, pre-emptive multi-tasking failure.

Re:Liability after warnings like this?

[kirwin]

Perhaps credit card companies should now offer "hacker" insurance. Perhaps credit card companies should set up security criteria with commerce-related web sites for use of online credit transactions. After all, they are responsible for losses when your card is compromised.

Numbers not stolen?

[mindstrm]

Nowhere in that article (unless I'm blind) does it say that any numbers were stolen. ALl they said is that it was unclear whether any 'personal information' was stolen.

And if it was stolen... that's shitty site design. You quickly stash cc#'s off in a secure location; you don't make them retrievable off the website, EVER.

On-line Databases

[Detritus]

I still don't understand why anyone would store sensitive information in a database on a system that is accessible from the Internet. Put the database on a secure server that provides a restricted set of functions to a predefined list of systems. Even if the web site gets cracked, and it will, the intruders would not get unrestricted access to the database.

Re:On-line Databases

[levendis]

Yes, but, at some point the user has to enter the card number initially. It could be that the cracker's were intercepting this stuff, before it hit the secure database server.

suuuuuuuuuuuuure

[kirwin]

The problem was discovered during a routine security check Friday, he said.

If their security checks are so routine, then why did this happen?

[root@solstice /root]# telnet westernunion.com 80
Trying 208.244.136.46...
Connected to westernunion.com.
Escape character is '^]'.
get /
HTTP/1.1 501 Not Supported
Server: Microsoft-IIS/4.0

Oh, I see now.

HAHAHHAHHAHAHAHHAHAHHAHA

[linuxgod]

HAHA, Aw, did their little NT4 peice of shit
get hacked? "Your not going anywhere today."

Re:Ah, the joys of a Cashless society

[Accipiter]

Well, I don't think a 7-11 is the place to sell these things.

Your bank, maybe...FDIC is a good thing, and 7-11 isn't.

-- Give him Head? Be a Beacon?

Re:Putting out the fire - with CRACK

[Soko]

Good reply. However, you are the type that I was warning against.

"ESR didn't break into the server. RMS didn't do it. Linus didn't mastermind the attack. This has nothing at all to do with Open Source, as a movement or software. It's got a lot to do with Microsoft's closed source software and stupid administrators. "

I couldn't agree more. But that being said, have you seen the view from the other side?

You are a hacker, and a hacker broke into the Western Union credit card database. Doesn't matter to them that you specifically didn't do it, just "one of your gang". This type of attack undermines what the establishment wants the Internet for - commerce. As such, they will just bear down more on ANY threat coming via the Internet, not just this specific type of attack. If that doesn't work, they may go after the Internet itself.

I agree that it is shoddy programming pratices, mis-configurations and bad administration that are the usual causes of security breaches, but to a CEO who talks to the lawmakers, it's "Some punk hacker who got through the firewall", key word being "hacker".

My post was to show that we as a group had better be accomodating to the interests of everyone, else they will not be accomodating to us - which could conceivably spill over into the other cases stated in my post. The Man won't care that you didn't do it - just that you could.

Netcraft tells it all...

[Dice]

www.westernunion.com is running Microsoft-IIS/4.0 on NT4 or Windows 98

D'oh! Seriously, you'd think these big banks and money sending whatever it is western union does people would use a B1 Trusted OS or something.

May I suggest BullDog or possibly TrustedBSD? I haven't tried TrustedBSD, but I was quite impressed with BullDog's stats at this past DefCon. They put a server running thir OS (a modified Solaris) on the CTF (Capture The Flag) network running all sorts of insane services. A day into the competition they still hadn't been cracked so they posted the shadow password file. They never did get cracked.

Re:Netcraft tells it all...

[Dice]

You'll note that I said I hadn't tried out TrustedBSD. Would you be willing to share this elusive knowlege of yours that's oh-so-superior to the industry standard DoD ratings?
Also, you cause me to question wether or not you've actualy READ the rainbow books, orange in particular. Most of the stuff put forth in them is more general suggestions for methods to be used in a secure OS, stratagies if you will. The same concept applies to physical security of sites, the technology may change over time and require minute changes in implimentation (machine gun turrets and mortar cannons instead of sharp sticks and big rocks) but the basic ideas are still pretty much the same as they have been for hundreds of years.
In the same way we can define a basic set of standards for how a secure computer should operate. For instance, say I have two interfaces (eth0 and eth1). eth0 is attached to my internal network, which I consider to be fairly trustworthy. eth1 is attached to my external network, which I do not trust. I can, under a B1 OS, define a restricted permission set for users/processes coming in over eth1. Say I define these privs to the equivilant of "guest" access, these users/processes have permission to read my apache htdocs directory, but they cannot modify delete or create new files. With my permissions set like this, I can even be so stupid as to allow remote "root" logins (technicaly there is no root user under a B1 OS) and not worry about someone on the outside gaining more access than the interface rules allow for.
Simmilarly I can define more specific rules for my internal interface. Users coming in over vanilla telnet via eth0 are allowed up to a certain ammount of access, but no higher. Users coming in over ssh from the local net are allowed more access than that. Finaly, users logged in on the system's console are allowed unrestricted access, providing (of course) they can authenticate themselves properly (password, biometrics, some combination of the two, who cares?).
I think you'll have to agree that there really isn't much in there that's specific to 1990's technology, all the new tech does is change the details in the implimentation, i.e. 40-bit encryption is no longer secure and should not be used for sensitive transmissions, passwords are not longer an adequite means of authentication, there should be a biometric or cryptographic system to suppliment the traditional password access controls.

Re:Netcraft tells it all...

[Markvs]

Um... You *can't* run IIS on Windows 98!
As for B1 Trusted OS: THERE IS NO SUCH THING!

I'm a consultant for a Fortune 10 company. I've seen IIS/NT boxes that have been PUMMELED and were still secure. I've seen high school kids idiot hack an Apache box. And I've seen the reverse.

What annoys me is folks who have this backwards notion that the OS actually makes a difference for web serving. It's the ADMIN more than anything.

A site is only as secure as the Administrator can make it. :-)

Nuff said. HAHA

[linuxgod]

jd@linuxgod [8:15pm] ~ > telnet www.westernunion.com 80
Trying 208.244.136.46...
Connected to www.westernunion.com.
Escape character is '^]'.
HEAD / HTTP/1.1

HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/4.0
Date: Mon, 11 Sep 2000 01:29:08 GMT
Connection: close
Content-Length: 407
Content-Type: text/html

Connection closed by foreign host.
jd@linuxgod [8:19pm] ~ >

root

[pohl]

And now we know you connect to the internet with apps running as root.

I'm curious...what does an attacker gain by this knowledge?

Re:Ah Yes, Western Union Uses Microsoft Software(z

[jps3]

Wasn't there something on Slashdot a short while back about MS using default passwords for SQL Server... Or more accurately, admins not changing the default password. That would be grossly negligent if this were so.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Anecdote about Discover

[Anonymous Coward]

The following is a true story about Discover Card and my dealings with them on a security flaw that exposed over 20,000,000 million credit card numbers and other confidential data.

***

A year ago or so I was browsing the Discover Card web site and noticed they allowed viewing of your account balance and transactions online. I went to their account login page (not that I actually have a Discover card) and what I saw horrified me -- a CGI taking a file name as a parameter. If my assumption was correct, they were directly opening that file and spitting it back out. A simple test confirmed it: I passed /etc/passwd to the CGI and out came their system's password file. Using this same technique, I discovered (no pun intended) that the machine was an IBM server running AIX 4.3. Using IBM's online AIX documentation and some persistence, I was able to navigate throughout the server and read any file on the system that 'nobody' could. What I found next absolutely shocked me: Discover Card's complete database of account numbers, social security numbers, addresses and other contact information. Thus began my conversations with Discover Card.

I called Discover Card's toll-free number as they don't list any other way to contact them by phone. After convincing the rep that I really didn't want a Discover card and I just wanted to talk to someone in management, a lady came on the phone. I told her what I had found and that it was a serious issue. I don't think she knew what I was saying but she said she'd relay the information to the technical department and that they would get back to me quick style.

A week goes by and I have yet to hear from someone at Discover so I call again. I explain the whole story to this new manager and I'm told that I will be contacted about the matter.

A few days later I receive a call from the president of the technical department. After explaining the story for a third time he says that he will talk to his programmers about it and get back to me.

As the president promised, he did call me back -- this time with the president of security on the line. Once again I was asked to repeat my story and how I obtained access to their system. What happened next is a bit sketchy as I don't recall exactly how it took place or in what order: one of the presidents questioned me on whether I believed I was a 'hacker.' I assured him that what I had done was in good faith and even demonstrated that by contacting them as soon as I discovered the hole. I could have easily published a paper on it and sent it to the media and to their shareholders. Not only would their stock price have plummeted, but I'm sure someone would have found grounds for a lawsuit. Not to mention the damage it would have done to their credibility for touting excellent security.

The president of technical affairs mentioned that his programmers indeed looked into the problem but at this time they did not consider it a big issue. He said that if they needed anything more that they would contact me. In amazement of their lack of concern, I hung up the phone.

That was the last of my phone conversations with Discover. Over the next few days I periodically checked back at the site to see if the hole had been secured. I remember it being fixed the next day but then when I visited a week later the hole was back. I'm not sure how long the hole was sitting there in between my call and their permananent fix or even how long it was there before I called. As of today the hole has been plugged.

This just shows you what kind of companies we are trusting with our personal and sensitive information. It's one thing for someone to steal your credit card number -- they can easily be canceled. It's a whole different story if someone gets a hold of your social security number and private contact data. There is absolutely no excuse for these kinds of errors.

Re:the only uncommon thing is that they admitted i

[cryosis]

I came up with a great way to protect my check card. I always keep -$25 in my accts. That way if anyone tries to steal my number, flags immediately go up at where ever that the cards being used.

Life is a disease, sexually transmitted and fatal.

Ah, the joys of a Cashless society

[Accipiter]

Masked person walks into a 7-11, walks up to the counter, and pulls out a gun.

"PUT YOUR HANDS UP. GET THEM UP!"

Clerk does as he is told.
"Wha-What do you want?"

"GIMME ALL OF YOUR DISPOSABLE DEBIT CARDS! NOW!"

Clerk starts shovelling the cards into a bag.
"Don't you want the cash in the register?"

The Masked intruder shakes his head, and looks puzzled.
"...What?"

-- Give him Head? Be a Beacon?

Re:the only uncommon thing is that they admitted i

[cryosis]

Yeah I can't use it. But that's the beauty of the plan, you see. If I, the legimete owner of the card, can't use it, then no one else can either.

Life is a disease, sexually transmitted and fatal.

Disposable Credit Cards

[waldoj]

What would be even better than disposable credit card numbers would be disposable credit cards. I want to be able to walk to 7-11 and pay $51 for a $50 debit card (that can be used like a credit card.)

If we're ever going to move into e-cash, we have to have a system that is as anonymous as cash. This seems like the best way to assure that.

-Waldo

-------------------

(Normally we don't post this stuff...)

[Speare]

CmdrTaco, define 'we'?

4 MSNBC: Stealing Credit Card Numbers Online is Easy by Roblimo on Sun 16 Jan 05:22PM EST 341
4 Largest Online Credit Card Heist Ever? by Roblimo on Sun 09 Jan 04:59PM EST 359
3 RealNames Customer Data Stolen by emmett on Mon 14 Feb 06:55AM EST 129
4 British Crackers Demand Millions in Inforansom by Roblimo on Sun 16 Jan 11:52AM EST 195

Ah Yes, Western Union Uses Microsoft Software(z)

[Redking]

Well, a simple Netcraft query tells us that the website itself is Microsoft IIS probably on Windows NT. Part of the basic Microsoft ecommerce package is SQL Server, so I'm speculating that was the database that was compromised.

There definitely should be some litigation regarding this case. 10,000 to 20,000 possible credit card numbers?!? That is a lot of people and now they have to go thru the hassle of cancelling their credit cards and getting new ones.

This is Western Union, for crying out loud. A company that makes money by helping people transfer money. You think they would take better safety precautions and use encryption on their database. Or better yet, have the database server offline without a connection to the Internet.

-redking

Re:IKEA (Re:They should take the blame, not "hacke

[imagineer_bob]

Right! They put their website together with the Allen wrench included in the box!

--- Speaking only for myself,

OT: Use of the work "hacker" depreciated

[jorbettis]

'Hacker' has come to mean 'criminal' to the general public, and I think I've been seeing signs of the community accepting that.

I never use it to describe myself, nor do any other 'hackers' I know. Might I point out that even a Slashdot story recently used the word to describe computer criminals (I'm too lazy to look up the link). This is a Good Thing in my opinion, as I don't think we'd ever be able to reverse the meaning of the word in the public perception. As is, its use will only make us appear to be something we're not, and associate us with script kiddies like the ones that attacked Western Union.

I think the word 'geek' is replacing it. I think it is a great word to use because it is used by the general public to insult our kind. Sort of how homosexuals picked up the words 'gay' and 'queer' to describe themselves.

liability?

[legLess]

Speaking from experience, it's a major pain in the ass to cancel a credit/debit card and get a new one, not to mention trying to figure out how to live without one for a week. (Heck, I buy coffee in the morning with my debit card.) Never mind the nightmare of straightening out the false charges with your bank.

So is Western Union liable for this time/expense/pain in the ass? Should you have an expectation, visiting an e-commerce site of some sort, that your CC# will be kept private against the ravages of crackers?

If someone with a mask and gun steals a bag full of CC receipts from Sears, then uses the numbers, is Sears at all liable for their misuse? Should they be? How does this change for e-commerce stores? You can't really stop someone coming into your store with a gun and robbing you, but you can take much better precautions against someone hacking your site like this.

I see both sides of this - as an admin and a CC user. Should we have a zero-tolerance law? No mistakes, no excuses - the store that got hacked should just pay up, whatever its customer's expenses are? Honestly, I lean towards "yes." There have been enough public cracks in the last year to encourage even the most brain-dead (heh: "westernunion.com is running Microsoft-IIS/4.0 on NT4 or Windows 98" - NetCraft ) to really secure their stores and databases.

If you can't secure it, don't connect it to the web.