Slashdot Mirror
Critical Zen Cart Vulnerability Could Spell Black Friday Disaster For Shoppers (htbridge.com)
Mark Wilson writes: It's around this time of year, with Black Friday looming and Christmas just around the corner, that online sales boom. Today security firm High-Tech Bridge has issued a warning to retailers and shoppers about a critical vulnerability in the popular Zen Cart shopping management system. High-Tech Bridge has provided Zen Cart with full details of the security flaw which could allow remote attackers to infiltrate web servers and gain access to customer data. Servers running Zen Cart are also at risk of malware, meaning that hundreds of thousands of ecommerce sites pose a potential danger. Technical details of the vulnerability are not yet being made public, but having notified Zen Cart of the issue High-Tech Bridge says the date of full public disclosure is 16 December.
say something. don't ask, don't tell. bacon is bad. now what was that again?
Hack Friday ... amirite?
-- Brought to you by Carl's JR
High-Tech assholes want to make a name for themselves. I bet they've been sitting on this just waiting for this time of year.
My first thought too.
According to the original source (https://www.htbridge.com/advisory/HTB23282) the security issue affects versions 1.5.3 "and probably prior" (you gotta love the wording). When I looked at the Zen Cart site today v1.5.4 has been out for almost a year. Now someone else please take it from here...
And yet you continue to use the web...
Roast Turkey, of course.
Cryonics - Keep cool and carry on.
Zencart? How is a typical shopper supposed to know if the online retailer that they are using is using the Zencart system?
OK, I'll bite. What do you consider to be better than php?
I coded the payment system on our store's website in python CGI scripts. Keep it simple first. It helps that I'm a crypto security type engineer for a big techy company in my day job, so it's not a challenge to bake in defense in depth. It sucks when PCI-DSS scans ding you for insecure versions after their probe finds my honeypot.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I don't know about zen cart, but it's based on osCommerce which is a nasty piece of shit.
I tried to use it. Learn from my experience. Don't.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Too many assumptions here. Presumably the honeypot is full of false data delivering nonsense alerts to nowhere, and the owner is aware when it's compromised. That's what it's for. Of course, if you assume that hackers take over your entire data center at all 7 OSI layers, it really doesn't matter what defenses you have in place.
The honeypot is a simple way to identify an attack source. It's only one thing. As for any defense-in-depth structure, the failure of one thing doesn't compromise the whole. Preferably the failure of several things doesn't compromise the whole.
If you think there is anything to do with security in the PCI-DSS specs, you are sadly mistaken. They are a pile of poo.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I coded the payment system on our store's website in python CGI scripts.
You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.
I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.
Just cruising through this digital world at 33 1/3 rpm...
The Zen Cart code is a mess, and I'm not surprised that it has vulnerabilities.
XCart seems much better, but it's a monster codebase. It probably has some vulnerabilities too.
Just cruising through this digital world at 33 1/3 rpm...
I coded the payment system on our store's website in python CGI scripts.
You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.
I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.
I was answering the question as asked, not filling in the details to satisfy your curiosity.
The relevant bit is attack surface and the reduction thereof, by doing things outside the memory space of the web server and passing all data through a well controlled pipe. You might be able to write secure code in PHP. But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to, whereas CGI is. Old school, simple, separated.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Could somebody post the original article that this post summarizes? e.g. Where can we get further information?
But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to
And that was my point entirely.
Just cruising through this digital world at 33 1/3 rpm...
Because of this, or in spite of this, or regardless of this (choose one), I will not be doing any black Friday shopping. I choose not to commemorate the anniversary of the collapse of gold prices in the stock market.
If you are not allowed to question your government then the government has answered your question.
But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to
And that was my point entirely.
But not a contradiction of mine, which is how you cast it.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.