Three years ago I did a security audit for a large ecommerce website. When the audit was performed, I found several severe security issues that allow for access to data that should not be accessible after a transaction is completed. On this site there are several major risks. First, you can see orders coming through the system real time; all transactions are processed manually by this company. If you view a transaction you can see name, address and shipping destination. I see two abuse points here, 1 – you can simply edit the ship to address and have the shipment sent to yourself, and 2 – you can call the user right as the order was placed and do a “phone confirmation” to gain access simply to the credit card info with basic social engineering.
You can also, with a little more work, dump the CC info and order ID numbers and then simply match up the order ID and user info.
This is all by using exposed functions on their site and modifying a couple values. Yes, I'm being vague for a reason.
The marketing director at this company was warned about these risks three years ago and has done nothing to correct them. I don’t doubt that if I can find this others can. This site does 88K transactions per year and has all orders ever processed still in data and accessible.
So the ethical question… what do I do? My company doesn’t care… so I can’t get help there. If I contact the marketing guy he will just continue to cover his ass and the asses of their incompetent internal development team (cold fusion). Do I contact someone higher up? Do I go around my company? Do I just mine the data and sell it to a competitor minus the CC info? What do I do knowing this? It's nagging at me and I can't let it go. This is only one of many sites I know of, but the ease of access and high traffic makes me ponder a lot on this.
The marketing director at this company was warned about these risks three years ago
er... doesn't this company have a CTO or CIO that this should be reported to? The Director of Marketing shouldn't be the one responsible for IT.