Most of these credit card validators have the ability to store items to a
logfile, which is often turned on in debugging and testing and never turned
off by the administrator...
Here are some other interesting things about vPOS and Site Server, for the
e-commerce-minded among us:
1. In addition to the debug log mentioned above, the actual Commerce Server
store also has the ability to write a very lengthy logfile, called
ordinitbf, which can be added into the global.asa of the store, and called
using a scriptor component. Again, not very useful unless an administrator
turns on logging and never turns it off.
Things included in this file include: all shopper info, all address info
(billing and shipping), credit card info, including name, exp, and
number... you get the idea.
2. the vPOS service cannot be started automatically. The encryption string
MUST be typed in at start-up. This sequence cannot be automated. Therefore,
if a server using vPOS is somehow compromised in the middle of the night,
and no administrator is there to restart the service, all transactions will
fail until the next time the administrator restarts the service.
3. In order for vPOS to work with Microsoft Site Server (Commerce Server
2.0), the Commerce Server version 1.0 component wrapper must be used. In
order to trick the v1 component wrapper into thinking that Site Server is
really Merchant Server 1.0, A LOT of registry entries must be made.
Some of these registry entries include the SQL passwords, the NT
administrator login passwords, etc. Fun for the whole family, and
everything in plaintext.
4. The merchant certificates are stored in the SQL database whose passwords
you just typed in plaintext into the registry.
Sigh.
-megan
Megan Alexander: Webmaster, etc.
Command Software Systems
(561)575.3200 x 170
http://www.commandcom.com
-----Original Message-----
From: Tim Scanlon [SMTP:tfs@CHARM.SEALSOFT.COM]
Sent: Saturday, November 08, 1997 12:35 AM
To: BUGTRAQ@NETSPACE.ORG
Subject: Re: Major security flaw in Cybercash 2.1.2
On Fri, 7 Nov 1997 , Anonymous said:
>In CyberCash's server, when the "DEBUG" flag is on, the contents of
>all credit card transactions are written to a log file (named
>"Debug.log" by default).
>
>The easiest workaround I've found is to simply delete the existing
>Debug.log file. In my experience with the Solaris release, the
>CyberCash software does not create this file at start time when the
>DEBUG flag is set to 0.
>
ln -s Debug.log /dev/null
Works easier than deleting over and over I'd hazard.
Tim
--- ________________________________________________________________ tfs@sealsoft.com (NeXTmail, MIME) Tim Scanlon tfs@epic.org (PGP key by req) crypto is good Seal Technologies Inc. I own my own words