4

I have been thinking about buying a ready-made PHP script (i.e. a web application) that provides a specific functionality. Say, for example one of these sold by Agriya:

http://www.agriya.com/products

The concern I have about these is, how to evaluate the security of this type of script. Not only is there a concern about whether "lousy programming" may have introduced bugs but also if some back-door has been intentionally added by the vendor.

Mainly my concern is around payment safety, as the website would be accepting payments through either credit card or PayPal.

Is the only option to just "not buy it if I cannot trust the software vendor", or are there some things that can be done (specific questions to ask, things to check for, etc) to minimize the risks? Is it expensive to have this type of scripts checked by some third party?

Improve this question
2
  • 1
    Other than major ecommerce sites, most sites that accept credit cards or PayPal don't ever see the customer's confidential details. The site transfers the purchase details to PayPal, who then display an https paypal... page with your company name and details of the purchase. The customer enters payment details on that secure page. Once the payment is accepted (or rejected or cancelled) control is transferred back to your site. You get a transaction id and the money, but not the credit card #. Your bank account # is not in the script, it is in your contract with the payment provider.
    – Tom Robinson
    Dec 17, 2014 at 5:48
  • 1
    You could scan the code using RIPS (rips-scanner.sourceforge.net). I think my personal concern would be "What if I discover a bug / vulnerability, will they fix it without the need to pay for these fixes?"
    – Jeroen
    Dec 17, 2014 at 6:49

1 Answer 1

Reset to default
1

Unless the company tells you that they have been audited by some security company (and depending on the company that assessed it), you will never know until you take a look for yourself.

Trust is a complicate thing... It is hard to gain and very easy to be left along the way.

One think that you may do is talk to Agriya and tell them that you're interested in their products, but wary about the secure development practices employed by them. Ask them if they have made a thorough security assessment in the softwares and if the answer is "No", ask them what would they do if anyone finds bugs in it.

@jeroen-it-nerdbox raised an important issue. These things might cripple your business and a strong AND fast correction process is of vital importance for you and their customers.

About the price of a security assessment in the code, it depends on the company doing the audit. My department does not have ties with the commercial area of the company, so i cannot help you with that.

Improve this answer

You must log in to answer this question.