Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moonpig.com Vulnerability – Exposes customer data

ifc0nfig.com

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Moonpig.com Vulnerability – Exposes customer data

#81

Post by dpwm »

mtmail wrote: post #68
dpwm wrote: post #57

Earlier quoted context omitted.

Photobox acquired Moonpig in 2011 [1]. In 2010, Photobox got called out for emailing passwords in plaintext[2], and were quick to take to twitter to say "It will never happen again."[3] At that point, it had only been happening for 4 years [4]. Coupled with the tone of the job advert already posted by others [5], it doesn't seem too hard to imagine a corporate culture where security is not a serious concern until thi…

The number of companies that send (and possibly store) plain text passwords is scary. I keep reporting them to http://plaintextoffenders.com/

I was about to ask why anyone would bother sending plain text passwords and store them encrypted. I then remembered a high-school friend's first (and largely unsupervised) job where IIRC he devised a ridiculous password encryption (not hashing) scheme in PHP (on shared hosting).

Unrelated horror unfolded a couple of years later when for some peculiar reason he had to move the site to a godaddy VPS. An unencrypted customer database sitting at /db.sql, fully accessible to the world. Apache had been configured to show directory indexes and, to take the site offline, /index.php had been removed. I think at the time I even needed to explain the possible consequences. I just remember being told that the database was restoring and it wouldn't take too much longer!

I think any remaining part of me that implicitly trusted interesting websites with personal data died that day.

Re: Moonpig.com Vulnerability – Exposes customer data

#82

Post by legrandkay »

clobec wrote: post #50
d23 wrote: post #43

Earlier quoted context omitted.

You're getting mad at the wrong person here, full stop. This is gross, inexcusable negligence and incompetence. I'm surprised this guy didn't wait more than a few months, given the severity of this problem. > whilst protecting customer data from any opportunistic bad actor Riiiight. Do you honestly think something this basic wouldn't be discovered by criminals soon, if not already?

> You're getting mad at the wrong person here, full stop. No I'm not. I;m not angry. I realise this is the fault of Moonpig >This is gross, inexcusable negligence and incompetence. I'm surprised this guy didn't wait more than a few months, given the severity of this problem. I agree >Riiiight. Do you honestly think something this basic wouldn't be discovered by criminals soon, if not already? We don't know if anyone…

You do know that this is the first time a lot of people that do not live in the UK are hearing of the ICO

Re: Moonpig.com Vulnerability – Exposes customer data

#83

Post by wiuiu »

knodi123 wrote: post #73

I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried." I took…

"I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job"

WOW. You are a terrible human being.

Re: Moonpig.com Vulnerability – Exposes customer data

#84

Post by brazzledazzle »

wiuiu wrote: post #83
knodi123 wrote: post #73

I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried." I took…

"I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job" WOW. You are a terrible human being.

I'd be willing to bet the customers would disagree. And he did give the guy a chance to change this ways.

Re: Moonpig.com Vulnerability – Exposes customer data

#85

Post by cloakandswagger »

richardwhiuk wrote: post #44
meowface wrote: post #19

Earlier quoted context omitted.

First of all, the company could definitely be sued for negligence in the US. Not sure if they could in the UK. Second, there are not that many similarities between this research and weev's research. In this case, the researcher created 2 accounts which he had control over, then read data from both of the accounts despite not authenticating to either of them. He did not access any other customer's information (or at l…

Personally (and I know this is likely to be an unpopular sentiment on HN) I have very little sympathy for weev. He knowingly and deliberately attack a weakness he had found to scrape data, knowing that the access was unauthorized. I disagree that the data was in the public domain (although the Third Circuit disagrees) - just because something is accessible to the public doesn't mean it's in the public domain. Just be…

>I think one part of improving cyber security is prosecuting people who deliberately and maliciously hack into other systems who do so for either monetary gain or fame.

This would do nothing except cast a chilling effect over the security community. Everyone would sit on exploits, too afraid of overzealous prosecutors to publish them or even reach out to the affected parties.

Unless, of course, you believe the US justice system to be the paragon of restraint and reasonableness.

Re: Moonpig.com Vulnerability – Exposes customer data

#86

Post by __david__ »

wiuiu wrote: post #83
knodi123 wrote: post #73

I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried." I took…

"I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job" WOW. You are a terrible human being.

> WOW. You are a terrible human being.

Yes, heaven forbid someone qualified run their IT dept. What's he supposed to do? Sit around, idly hoping that someone else notices the incompetence?

I think OP made the right move. To me it sounds like the guy should have been fired rather than demoted.

Re: Moonpig.com Vulnerability – Exposes customer data

#87

Post by wiuiu »

__david__ wrote: post #86
wiuiu wrote: post #83

Earlier quoted context omitted.

"I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job" WOW. You are a terrible human being.

> WOW. You are a terrible human being. Yes, heaven forbid someone qualified run their IT dept. What's he supposed to do? Sit around, idly hoping that someone else notices the incompetence? I think OP made the right move. To me it sounds like the guy should have been fired rather than demoted.

really David ? Come on. How many times you made mistake ? Were you demoted and/or fired for mistake ? Now, let's not argue that you or all of us has not fucked up. In my 7 yrs. as engineer I have seen worse. However, that's not excuse to run to boss/CEO to demote someone and take over their job. Think about their family,kids before you do such act.

If you defend such behavior for taking over job/demotion I seriously think there lies greater problem in tech community.

Edit: HN is getting fucked up day by day. Any simple disagreement is greeted with downvotes. Carry on.

Re: Moonpig.com Vulnerability – Exposes customer data

#88

Post by networkguy »

rst wrote: post #66
helgrind wrote: post #60

Earlier quoted context omitted.

To be fair to them they were just infrastructure not backend. I'm sure their firewall works perfectly, the trouble is the legitimate traffic that's allowed to do anything it wants!

So they delegated security to a separate team, which only got to put "reinforced firewalls and IPS appliances" around an app which was still missing basic internal security checks. (And it's hard to see how firewalls could do the checks on their own, without access to the app's data stores or duplicating app logic -- either of which makes it no longer a firewall.) Unfortunately, it's all too easy to get this kind of…

They aren't a full stack security team though and it's not fair to be putting any fault on Conosco; they are enterprise IT consulting and support and that's clear enough from a look on their website.

To be basic, a firewall does stateful inspection of inbound and outbound TCP/IP packets and an IPS guards against vulnerabilities with signatures; neither of which understand the applications logic --- there is nothing in off the shelf hardware/software that will prevent a shitty app from giving up the keys to the kingdom.

The firewall might block inbound connections to port 22 and the IPS might detect a SQL injection attack and stop it, but if you have an API that just gives up data you're screwed and that's precisely what happened. A legitimate request for information was made on legitimate ports, using legitimate protocols and as far as the hardware defense is concerned, everything is as expected -- the problem is the application.

Re: Moonpig.com Vulnerability – Exposes customer data

#89

Post by cleverjake »

wiuiu wrote: post #87
__david__ wrote: post #86

Earlier quoted context omitted.

> WOW. You are a terrible human being. Yes, heaven forbid someone qualified run their IT dept. What's he supposed to do? Sit around, idly hoping that someone else notices the incompetence? I think OP made the right move. To me it sounds like the guy should have been fired rather than demoted.

really David ? Come on. How many times you made mistake ? Were you demoted and/or fired for mistake ? Now, let's not argue that you or all of us has not fucked up. In my 7 yrs. as engineer I have seen worse. However, that's not excuse to run to boss/CEO to demote someone and take over their job. Think about their family,kids before you do such act. If you defend such behavior for taking over job/demotion I seriously…

"you are a terrible human being" is not really a simple disagreement.

"That seems like a rude thing to do" would be.

What you said was a personal attack, and a quite rude one at that.

Re: Moonpig.com Vulnerability – Exposes customer data

#90

Post by dang »

cleverjake wrote: post #89
wiuiu wrote: post #87

Earlier quoted context omitted.

really David ? Come on. How many times you made mistake ? Were you demoted and/or fired for mistake ? Now, let's not argue that you or all of us has not fucked up. In my 7 yrs. as engineer I have seen worse. However, that's not excuse to run to boss/CEO to demote someone and take over their job. Think about their family,kids before you do such act. If you defend such behavior for taking over job/demotion I seriously…

"you are a terrible human being" is not really a simple disagreement. "That seems like a rude thing to do" would be. What you said was a personal attack, and a quite rude one at that.

> What you said was a personal attack, and a quite rude one at that.

That's correct, and no doubt the reason for the downvotes.

Post reply on HN