Slashdot Mirror
A Database of Thousands of Credit Cards Was Left Exposed on the Open Internet (zdnet.com)
A US online pet store has exposed the details of more than 110,400 credit cards used to make purchases through its website, researchers have found. From a report on ZDNet: In a stunning show of poor security, the Austin, TX-based company FuturePets.com exposed its entire customer database, including names, postal and email addresses, phone numbers, credit card information, and plain-text passwords. Several customers that we reached out to confirmed some of their information when it was provided by ZDNet, but did not want to be named. The database was exposed because of the company's own insecure server and use of "rsync," a common protocol used for synchronizing copies of files between two different computers, which wasn't protected with a username or password.
Most of us use rsync over SSH with key auth, which means something like RSA-2048 or 4096, or ED25519 (elliptic curve crypto, about the same security as AES-128). It is not even password-based.
So, no, it was not rsync use that left things open. It was just incompetence.
The article is shitty and doesn't even mention the database product(s) involved.
Does anybody know if it's MongoDB?
I ask because I remember Slashdot submissions like these:
and this latest incident sounds similar in many ways. But can anybody confirm if this is indeed the case? Is or is not MongoDB involved?
rsync is frequently and incorrectly used for backup. It's a miracle that the data didn't get mangled in transit. I've seen rsync corrupt data repeatedly in production "backup" systems. It's also an incredibly insecure protocol unless you use a SSH tunnel. Most people don't seem to bother with tunneling rsync via SSH either. There should be a big red warning sign when installing rsync for the first time on a system that you sign in blood that you won't ever use it for backups nor use it on the public Internet.
sounds very PCI-compliant. Who was their auditor? Mr Magoo?
ssh-copy-id wide open to the outside???
I can see some inside account using something like that to sync to an other system but that account should not be open unless they hacked in and got some passwords from an config file. Lot's of software needs DB login info in plain text there.
MacKeeper broke this story late November 2016 - https://mackeeper.com/blog/pos...
I think the DB was hacked and the thieves just left the door open when they split.
Even storing credit card data at all (instead of processor authorization tokens) is a huge red flag unless they want a mountain worth of additional compliance work.
And then they store it unencrytped....
Aren't there laws that require companies to protect customer data? There certainly should be.
Using ssh transport instead of the native rsync protocol, which is unencrypted, is the *right* way to do remote rsync with sensitive data. Much like tunneling http over tls is the right way to do http for sensitive data.
You can also do the rsync network protocol bare, using a rsync:// url. That's the wrong way for sensitive data, and the way this developer chose to do it.
It's happened so many times, lost count. How many times have credit cards been exposed to this kind of peril?
Unlike most protocols, rsync has a built-in checksum, actually many, many checksums, so it's much more reliable than just about any other protocol. It checksums every few kilobytes.
We backup many terabytes every day and we periodically verify the backups with Sha-2 hashes. I've never found corruption due to rsync. On the other hand, rsync *is* very flexible and there are many options. It's certainly possible to use a set of options that doesn't give you what you want.
Also, if you're backing up live systems, especially databases, using any method, you have to take care that the data doesn't change while your backing it up. That applies to any method of backup. For mysql, see man mysqldump, then back up the dumped files.
Well, thank goodness that's gone.
Have gnu, will travel.
Why these people continue to use Linux is beyond me. I mean year after year of hacked Linux servers doesn't tell you anything?
Go get a decent UNIX server you clods.
> Aren't there laws that require companies to protect customer data?
Yes, and there are laws requiring everyone to drive under 65 MPH. It seems that making a law doesn't actually mean people will do anything differently.
Order On-Line [sic] 24 / 7 Totally Secure!
Who hyphenates online? Hillbilly small business people, that's who. As for their "Totally Secure" online ordering, well let's just say that they're partying like its 1994 with that awful website. It's hideous actually. Who would even think about giving their credit card to these people? Morons, that's who.
Prosecute every online company heavily for ANT type of data breech, only then will they do a decent job of security.
The other day the company who "had the most secure email" was shown to be a sham and they claim it was secure because "none on the customers had been hacked". The guy should be jailed for a statement like that.
Also, if you use 3rd party software then that software should only be used if the dev team are currently working on the project and it is open for and accreted via a security organisation, this is to stop people using 3rd party php code etc from forums and code repositories.