Originally Posted by Just Alex (Post 18958530)

And why are they keeping CC numbers on their server? Aren't they supposed to keep those with their merchant?

Originally Posted by baddog (Post 18958534)

Anxiety guy, capable of leaping to the worst possible conclusion at a single bound. They would have name, type of card, security code, exp date and last 4 digits. Makes it a lot easier to brute force.

Originally Posted by Just Alex (Post 18958530)

And why are they keeping CC numbers on their server? Aren't they supposed to keep those with their merchant?

Originally Posted by raymor (Post 18958550)

baddog, props for full disclosure.




Or an a firewalled INTRANET machine with a trap door. Baddog, we may be able to assist your people with setting this up a in way that is both secure and convenient to use. One major trick is to FEDERATE the database to the CC module, except for the CC table. In that way, the billing module sees the whole database and the support module sees everything but the CC table. That is, the internal server can see the part of the database that's on the web server, but the public web server can't see the sensitive data, it's a one way door.

Your brief post also indicated at least one other specific vulnerability, with a specific fix that should be done. I won't post details here.

Sure there was a social engineering component, and there were a couple of architecture problems that turned that attack into something much more serious than it should have been. ONLY tickets should have been exposed by a successful attack, not login passwords, CC info, etc. You don't need to, and aren't supposed to by PCI, store ANY track information on a public web server.

Originally Posted by baddog (Post 18958573)

They aren't talking about phishing are they? Like they responded to one that screwed us all?

Originally Posted by baddog (Post 18958573)

They aren't talking about phishing are they? Like they responded to one that screwed us all?

Originally Posted by raymor (Post 18958595)

Spear phishing is a good example of social engineering, which generally means fooling humans. The most commonly used example is probably calling and pretending to be part of the same company, saying "this is Fred from the Omaha office". Typically the caller has an urgent problem that is a big deal for the boss. Perhaps the boss is about to give a big presentation and his laptop with the presentation on it just died, so he needs remote access to his desktop NOW.

Another example would be if I called your web hosting company pretending to be you. I would call at 2AM, when their boss isn't there, just the new guy working the shit shift. I'd claim (or cause) a server down and ask for a KVM to be put on it immediately. That KVM would let me boot into special rescue modes where passwords aren't required.

But yeah, phishing would be the most simplistic form of social engineering, social engineering for morons.

Originally Posted by directfiesta (Post 18958599)

password changed ... everything looked normal .

Originally Posted by baddog (Post 18958610)

That is precisely why some things will just not be done by phone. And if what Bareback posted is true; wow.

Originally Posted by baddog (Post 18958610)

Safety first. Wonder how the person was able to answer the security questions properly; must know him.

Originally Posted by baddog (Post 18958565)

You would probably be a good one to ask, what do they mean that it was done via social engineering?

Originally Posted by k0nr4d (Post 18958652)

Could have been somethign as simple as someone phoning pretending to be their webhost saying something is wrong with the server, the password they have on file doesn't work and they don't want to reset it if they can avoid it.

Originally Posted by baddog (Post 18958610)

That is precisely why some things will just not be done by phone. And if what Bareback posted is true; wow.



Safety first. Wonder how the person was able to answer the security questions properly; must know him.

Originally Posted by baddog (Post 18958565)

hat do they mean that it was done via social engineering?

Originally Posted by Adraco (Post 18958861)

Or if you need an access code to a locked part of the building, to open a door, easy peasy to just hang out by the digit pad and pretend to be on the phone walking up or down and then "just happen" to glare over when the access code is punched by someone.