Timeline for I just discovered major security flaws in my web store?
Current License: CC BY-SA 3.0
28 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 15, 2017 at 15:28 | history | edited | CommunityBot |
replaced http://meta.security.stackexchange.com/ with https://security.meta.stackexchange.com/
|
|
| Aug 1, 2014 at 23:48 | comment | added | jmiserez | For future reference: Very similar scenarios are described in Microsoft's research paper: "How to Shop for Free Online" from 2011. It has detailed information about the same type of attack, but in the context of using external payment processors, e.g. Paypal. | |
| Nov 14, 2013 at 2:07 | comment | added | Mark E. Haase | Furthermore, any system where the client tells the server how much it wants to pay is flawed by design. The client should tell the server what items it wants and in what quantities. The server should calculate the amount to charge the user and should send that information directly to the payment processor, not back to the user. | |
| Nov 14, 2013 at 2:05 | comment | added | Mark E. Haase | There seems to be some confusion about how SSL/TLS would factor into this. TLS only prevents tampering by a man-in-the-middle (and then only when properly configured and used), but it does not prevent tampering by the end user. The end user can easily modify their own SSL traffic by using something like Tamper Data or an SSL proxy (like mitmproxy). | |
| Oct 26, 2011 at 16:13 | history | edited | user2213 | CC BY-SA 3.0 |
Added qotw banner.
|
| Aug 4, 2011 at 6:20 | vote | accept | Moses | ||
| Jul 28, 2011 at 18:29 | comment | added | pbreitenbach | I'm confused. It's very rare to send that type of information in HTTP headers however whether it's sent in the header or body is mostly irrelevant. Secondly, it's usually the server that sends credit card information to the credit card processor so a buyer's browser never even has access to those communications. The server should control all of the communications and should never trust information provided by the client. | |
| Jul 28, 2011 at 15:21 | answer | added | timk | timeline score: -1 | |
| Jul 28, 2011 at 15:16 | answer | added | David Eison | timeline score: 5 | |
| Jul 28, 2011 at 14:33 | answer | added | midnightmonster | timeline score: 2 | |
| Jul 28, 2011 at 13:16 | answer | added | Charlie B | timeline score: 1 | |
| Jul 28, 2011 at 7:07 | answer | added | Rory McCune | timeline score: 5 | |
| Jul 27, 2011 at 18:32 | history | edited | Moses | CC BY-SA 3.0 |
added additional question
|
| Jul 27, 2011 at 18:11 | comment | added | Moses | One question that came up after reading your responses: is passing card details through HTTP headers insecure insomuch that malicious users can eavesdrop or intercept them? How practical (see: realistic) would it be to intercept this card information? The site is using https on all sensitive pages (though I have a feeling that doesn't mean much) | |
| Jul 27, 2011 at 17:40 | history | tweeted | twitter.com/#!/StackSecurity/status/96273867353501696 | ||
| Jul 27, 2011 at 16:09 | answer | added | Robert David Graham | timeline score: 7 | |
| Jul 27, 2011 at 11:03 | history | edited | user2213 |
Added some tags
|
|
| Jul 27, 2011 at 10:59 | history | migrated | from serverfault.com (revisions) | ||
| Jul 27, 2011 at 9:29 | answer | added | symcbean | timeline score: 11 | |
| Jul 27, 2011 at 9:04 | comment | added | womble | Have you considered a job in penetration testing? You seem to have the right mindset for it, and it pays a whole lot better than self-taught web dev. Given a bit of training, I think you'd probably be quite effective. | |
| Jul 27, 2011 at 7:47 | answer | added | chris | timeline score: 13 | |
| Jul 27, 2011 at 7:44 | comment | added | Tom O'Connor | I just re-read the Q. Your development team passes card details in HTTP headers? This solution is easy. Fire them. Hire someone who understands PCI-DSS compliance. Oh, and just use an off-the-shelf e-commerce platform next time. | |
| Jul 27, 2011 at 7:43 | comment | added | Tom O'Connor | Have you considered the long-term benefits of SSL encryption? I'll never use a webshop that doesn't have a SSL certificate protecting my card data. | |
| Jul 27, 2011 at 6:04 | comment | added | Bryan Agee | Bummer. Sorry to say it, but that cash is probably what I would call 'tuition.' | |
| Jul 27, 2011 at 6:01 | answer | added | Bryan Agee | timeline score: 37 | |
| Jul 27, 2011 at 5:59 | comment | added | Moses | @Bryan It was a custom site, developed entirely by them. | |
| Jul 27, 2011 at 5:55 | comment | added | Bryan Agee | Was this a custom-developed site from the ground up? Or are you using some kind of e-commerce subscription package? | |
| Jul 27, 2011 at 5:52 | history | asked | Moses | CC BY-SA 3.0 |