Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moonpig.com Vulnerability – Exposes customer data

ifc0nfig.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Moonpig.com Vulnerability – Exposes customer data

#71

Post by [deleted] »

pbhjpbhj wrote: post #70
matthewmacleod wrote: post #64

Earlier quoted context omitted.

Or don't do it in the first place, because it's obviously wrong...

> because it's obviously wrong... // Are you trying to say it's morally wrong to read data made publicly available through a site's API? I think that's a stretch. Clearly there are very obviously malevolent things you could do with data acquired with such queries, but just iterating on a URL query string seems pretty far from an obvious moral wrong. Legally questionable, for sure. Morally forthright, doubtful. The wr…

[deleted]

Re: Moonpig.com Vulnerability – Exposes customer data

#72

Post by martin_ »

pbhjpbhj wrote: post #70
matthewmacleod wrote: post #64

Earlier quoted context omitted.

Or don't do it in the first place, because it's obviously wrong...

> because it's obviously wrong... // Are you trying to say it's morally wrong to read data made publicly available through a site's API? I think that's a stretch. Clearly there are very obviously malevolent things you could do with data acquired with such queries, but just iterating on a URL query string seems pretty far from an obvious moral wrong. Legally questionable, for sure. Morally forthright, doubtful. The wr…

Given the context is scraping, I'd argue enumerating a customer ID is pretty obviously wrong -- if that wasn't obvious enough, the response data is. And to accidentally, unknowingly harvest and store that data is much more of a stretch.

Re: Moonpig.com Vulnerability – Exposes customer data

#73

Post by knodi123 »

I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried."

I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job.

He later gloated that my store was much slower than his, since he downloaded our entire database as JS flat files and did absolutely everything client-side except payment processing and order fulfillment. I pointed out that my store didn't require 10 megabytes of download for the first page view, plus I had industry-standard security.

He was in even more trouble a couple of weeks after that, because some russian hackers pwned our server so bad that we had to drive to the colo and replace it with a new piece of hardware. I've got a dozen stories about this guy, he's a hoot.

Okay, last story, I promise; he's allergic to electronics power supplies, so he was the only employee who got to work from home (where he kept his CPU in a separate room from his keyboard and monitor).

Re: Moonpig.com Vulnerability – Exposes customer data

#74

Post by peteretep »

dabeeeenster wrote: post #6

Surely this is bad enough to warrant criminal prosecution? Not sure if that's even possible in the UK but it ought to be...Shameful to have sat on that for over a year. Shameful.

    > warrant criminal prosecution
Here's a not too dissimilar case:

https://ico.org.uk/action-weve-taken/enforcement/worldview-l...

Re: Moonpig.com Vulnerability – Exposes customer data

#75

Post by geographomics »

richardwhiuk wrote: post #44
meowface wrote: post #19

Earlier quoted context omitted.

First of all, the company could definitely be sued for negligence in the US. Not sure if they could in the UK. Second, there are not that many similarities between this research and weev's research. In this case, the researcher created 2 accounts which he had control over, then read data from both of the accounts despite not authenticating to either of them. He did not access any other customer's information (or at l…

Personally (and I know this is likely to be an unpopular sentiment on HN) I have very little sympathy for weev. He knowingly and deliberately attack a weakness he had found to scrape data, knowing that the access was unauthorized. I disagree that the data was in the public domain (although the Third Circuit disagrees) - just because something is accessible to the public doesn't mean it's in the public domain. Just be…

I agree, and feel that the EFF made quite the strategic error in supporting Auernheimer's appeal.

Re: Moonpig.com Vulnerability – Exposes customer data

#76

Post by bbcbasic »

knodi123 wrote: post #73

I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried." I took…

Ha ha. The real WTF is moving him to a job where security is even more critical.

Re: Moonpig.com Vulnerability – Exposes customer data

#77

Post by peteretep »

steakejjs wrote: post #10
dabeeeenster wrote: post #6

Surely this is bad enough to warrant criminal prosecution? Not sure if that's even possible in the UK but it ought to be...Shameful to have sat on that for over a year. Shameful.

If this were the USA it would certainly be bad enough to warrant prosecution of the researcher. I am not familiar with laws in the UK, however. Keep in mind the similarities between this research and weev's research. This type of blatant insecurity definitely should be punished and I wish more policy makers both cared, and made the effort to understand the terminology behind phrases like "No authentication", "Plainte…

    > If this were the USA it would certainly be bad enough to 
    > warrant prosecution of the researcher
Sounds like he didn't access any data he wasn't allowed to, if he read the data of test accounts. Not sure how you'd prosecute this in the UK.

Also you'd need to convince the CPS that it was in the public interest to prosecute, and they're not elected officials who need to appear Tough On Crime unlike the US. And even if both of those things happened, you'd then need to convince a magistrate that the case warranted a conviction.

Still, he should have gone to ICO first and foremost.

Re: Moonpig.com Vulnerability – Exposes customer data

#78

Post by peteretep »

iamtew wrote: post #48
justincormack wrote: post #24

Earlier quoted context omitted.

My guess is that the ICO wont fine them very much as it did not include full credit card numbers. However they might up it for failings in process, lots of remedial measures etc. They might not even have PCI compliance issues alas. The management will argue that they knew nothing, although that is becoming less of a defence now.

Doesn't matter, if they're a UK based company they fall under the EU GDPR and can receive a fine of 5% of their worldwide turnover for any loss of personal data, blanked out credit card numbers or not. http://en.wikipedia.org/wiki/General_Data_Protection_Regulat...

There are more egregious examples of data protection violation here, and the fines look pretty small:

https://ico.org.uk/action-weve-taken/enforcement/

Re: Moonpig.com Vulnerability – Exposes customer data

#79

Post by peteretep »

eth0izzle wrote: post #54
clobec wrote: post #52

Earlier quoted context omitted.

I still don't see why he had to do this? He has plenty of time to inform the ICO of this issue. He contacted moonpig then let the sit on this for a year. If he wants to be a disclosure hero, he could have at least told the ICO at the same time he told moonpig. The issue is 100% Moonpigs fault but he chose to disclose publicly rather than use the legal route set up to deal with these kinds of issues. The whole respons…

OP here and I agree with you. The ICO genuinely didn't even cross my mind and in hindsight I probably should of gone via that channel before publicly disclosing. Are there any set procedures to follow for this sort of thing?

https://ico.org.uk/concerns/handling/

Re: Moonpig.com Vulnerability – Exposes customer data

#80

Post by clobec »

Nexxxeh wrote: post #69
Nexxxeh wrote: post #63

Earlier quoted context omitted.

They had 17 months, and their Twitter account was still posting at 9pm this evening. If they gave two shits about our data (and it might include mine, it definitely includes my mum's), or if they were capable of a sensible helpful coherent response, they'd have done it 16.5 months ago.

In reply to the child post (of my other comment), because I can't do so directly due to nesting limited: >Have you read any of the above? >It's clear they didn't care, that's why I'm saying the ICO should have been informed. That would force them to give a shit. I had, at the time of writing my post, read all the comments on this story. I was commenting specifically on the parent's point about what time of day the st…

Why are you saying the fault lies with the vendor? Do you think nobody knows that? Do you think that's not obvious? Do you think that's what I was commenting about?

There's a difference between reading and comprehension.

Post reply on HN