Lessons in website security anti-patterns by Tesco • Hacker News Board

Re: Lessons in website security anti-patterns by Tesco

#31

Post by omh » Mon, Jul 30, 2012, 10:50 AM UTC

Smerity wrote: post #15

mtrimpe wrote: post #13

Earlier quoted context omitted.

If only Google Chrome would start warning users on signup that their password would be stored in plain text.

Google Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.

Poor security is just as dangerous as these, the only thing missing is the malicious intent.

Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site.

Unless/until Tesco have their databases hacked or stolen there is no risk at all.

Re: Lessons in website security anti-patterns by Tesco

#32

Post by omh » Mon, Jul 30, 2012, 10:52 AM UTC

codeka wrote: post #21

bencoder wrote: post #8

I discovered this a couple of years ago and emailed and got an unsatisfactory response: http://pastebin.com/C745weQ2 Hopefully this new attention will have them change the policy.

So they actually say the passwords are not encrypted in that email, which is quite different to what they say on twitter. I wonder if they're using a reversible encryption now, or (perhaps more likely) they just don't know what they use.

They have a maximum length requirement. That's a red flag which suggests they are just storing it plaintext.

Re: Lessons in website security anti-patterns by Tesco

#33

Post by AncientPC » Mon, Jul 30, 2012, 10:58 AM UTC

It's fun to bash on the most recent security naiveté, but can someone explain why GNU Mailman still emails users' passwords after subscribing?

Mailman warns users that passwords will be mailed plaintext, but why mail passwords to begin with?

Re: Lessons in website security anti-patterns by Tesco

#34

Post by DanBC » Mon, Jul 30, 2012, 11:01 AM UTC

SideburnsOfDoom wrote: post #24

Tesco are fundamentally in the business of selling meat and potatoes to everyone in the UK, not of making highly-secure websites. This does not excuse this lapse, but it may help us understand why if a computer system seems to work fine, they have little motivation to replace, upgrade or fix it, even if it is running on an old version of the platform.

Tesco are third or second largest retailers in the world (measuring by revenues or profits); they led the world in online sales for years; they were early entrants into online sales (being, I think, involved in the first ever online sale); they offer some financial services.

They have the money to pay for expertise to do better.

It is a shame that "it hasn't failed yet" is seen by them as an excuse to keep a broken system in place.

Re: Lessons in website security anti-patterns by Tesco

#35

Post by SideburnsOfDoom » Mon, Jul 30, 2012, 11:03 AM UTC

Smerity wrote: post #9

This is a hilarious, albeit depressing, view of the state of cyber security as seen by the general public. People, even those who are generally considered computer literate, don't have any understanding of web security. Due to this, Tesco won't hit any negative publicity outside of a tight knit circle of programmers. In fact, saying that everything is "stored securely" according to "industry standards" would reassure…

> There have been many calls in past exploit threads for a name and shame policy

There is an attempt at naming and shaming here: http://plaintextoffenders.com/

Re: Lessons in website security anti-patterns by Tesco

#36

Post by jrsimmons » Mon, Jul 30, 2012, 11:12 AM UTC

lengarvey wrote: post #20

chrisacky wrote: post #14

Hey Troy, Thought you might be somewhat interested in this one. Remeber the cool guys over at http://www.realestate.com.au/ Just to refresh your memory.. https://twitter.com/#!/realestate_au/status/2207319148043059... Anyway, "we are aware of this issue and are working on it". Click http://www.realestate.com.au/ then "Register". Then stand in utter amazement at their solution. ----------------------------------------…

In slight defense of that horrible password practice: You can't really do much with a realestate.com.au account unless you are an Agent (which is a separate account). There's no payment processing, or any way to add content to the site. The accounts there are basically just a way to save common realestate searches as far as I can tell.

Yeah, no.

All private user information is equally private. To arbitrarily suggest that certain data is less important is a dangerous road to walk down. We should be holding everyone to the same standards when it comes to security.

This is especially true with the high amount of password reuse that goes on.

Re: Lessons in website security anti-patterns by Tesco

#37

Post by scrumper » Mon, Jul 30, 2012, 11:22 AM UTC

Shocking stuff. Given the level of ignorance on display here, the size and political clout of Tescos and the detailed summary of possible attack vectors presented by Troy, is there a chance he could be fitted up for 'hacking' charges? What worried me was his trace.axd request: it's definitely using a computer system in a way it was not intended, which has caused problems for other security researchers in the UK in the past.

Just commenting quickly over breakfast but if I find the time later I'll try to look up the cases. (I remember something about a kid ending up in court for using relative paths to explore a web server (/content/../../ etc.)

Thank God there's still Waitrose.

Re: Lessons in website security anti-patterns by Tesco

#38

Post by Smerity » Mon, Jul 30, 2012, 11:26 AM UTC

omh wrote: post #31

Smerity wrote: post #15

Earlier quoted context omitted.

Google Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.

Poor security is just as dangerous as these, the only thing missing is the malicious intent. Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site. Unless/until Tesco have their databases hacked or stolen there is no risk at all.

Poor security references far more than just poor password storage, but even poor password security by itself becomes a serious issue incredibly quickly. Most people re-use passwords and most passwords are reset by email, meaning a leaked password and email address combo can quickly lead to massive damage.

Not all security exploits require a database to be hacked either. Even if a database is hacked, half the time we're finding out about this from third party sources well after the fact instead of the companies released press releases themselves.

These things happening silently is horrific[1]. Malware or phishing sites are relatively easy to spot and defend against -- but what about a compromised but legitimate website? If I find a security hole and pick a small but high quality selection of targets, how long will it take authorities (if ever) to piece together that they all were members of CornerStore Online?

[1]: We still have no idea when Twitter lost their 6.5 million password hashes -- they probably don't either... http://news.ycombinator.com/item?id=4074510

Re: Lessons in website security anti-patterns by Tesco

#39

Post by alsothings » Mon, Jul 30, 2012, 11:32 AM UTC

omh wrote: post #31

Smerity wrote: post #15

Earlier quoted context omitted.

Google Chrome and the Google search engine warn you if a website contains malware or is suspected of phishing. Poor security is just as dangerous as these, the only thing missing is the malicious intent. Unfortunately, Google would likely open themselves to lawsuits if they warned users away from or penalised websites due to poor security.

Poor security is just as dangerous as these, the only thing missing is the malicious intent. Really? This password storage isn't great, but using tesco.com is hardly the same as visiting a malware or phishing site. Unless/until Tesco have their databases hacked or stolen there is no risk at all.

Unless/until Tesco have their databases hacked or stolen there is no risk at all.

This is not the case. The most glaring reason why was pointed out in the posted article. It very clearly showed that Tesco failed to communicate logged-in state information (stored in a cookie) between the client and server over an encrypted line. This means your account is vulnerable to attack without the entire db being leaked.

Re: Lessons in website security anti-patterns by Tesco

#40

Post by jentulman » Mon, Jul 30, 2012, 11:47 AM UTC

This is an entirely baseless accusation, but I have my cynical hat on today. I'm wondering if the cost to provide the additional customer service that could be involved in helping people deal with stronger security (password reset email, reset pages and confirmations etc) has been weighed against the cost of upgrades and reparation for account breaches, and influenced the decisions here.