13
votes

Three years ago I did a security audit for a large ecommerce website. When the audit was performed, I found several severe security issues that allow for access to data that should not be accessible after a transaction is completed. On this site there are several major risks. First, you can see orders coming through the system real time; all transactions are processed manually by this company. If you view a transaction you can see name, address and shipping destination. I see two abuse points here, 1 – you can simply edit the ship to address and have the shipment sent to yourself, and 2 – you can call the user right as the order was placed and do a “phone confirmation” to gain access simply to the credit card info with basic social engineering.

You can also, with a little more work, dump the CC info and order ID numbers and then simply match up the order ID and user info.

This is all by using exposed functions on their site and modifying a couple values. Yes, I'm being vague for a reason.

The marketing director at this company was warned about these risks three years ago and has done nothing to correct them. I don’t doubt that if I can find this others can. This site does 88K transactions per year and has all orders ever processed still in data and accessible.

So the ethical question… what do I do? My company doesn’t care… so I can’t get help there. If I contact the marketing guy he will just continue to cover his ass and the asses of their incompetent internal development team (cold fusion). Do I contact someone higher up? Do I go around my company? Do I just mine the data and sell it to a competitor minus the CC info? What do I do knowing this? It's nagging at me and I can't let it go. This is only one of many sites I know of, but the ease of access and high traffic makes me ponder a lot on this.

2
  • The marketing director at this company was warned about these risks three years ago er... doesn't this company have a CTO or CIO that this should be reported to? The Director of Marketing shouldn't be the one responsible for IT.
    – Powerlord
    Sep 29, 2009 at 20:01
  • This question is off-topic under current topicality rules. Jan 22, 2015 at 23:15

11 Answers 11

15
votes

There was a time where I would suggest taking heroic measures to resolve the situation. I've since learned better -- you cannot force someone to act in their own best interest. Doing so often has unintended consequences for you that are likely to be unpleasant.

Think about it... you've

  • Informed the company via your audit report
  • Informed your management

So if you go and call the CEO at home, you've now done an end-run around your management and created a situation where the internal folks who are doing the CYA thing are going to make you the villain. The CEO will listen to his incompetent staff more than a random consultant who did an audit 3 years ago.

My advice: go have a beer or whatever you like to do and never visit the website again.

3
  • 9
    +1 "cannot force someone to act in their own best interest".
    – pjc50
    Sep 29, 2009 at 14:07
  • But it's not their best interest, or only indirectly. It's the best interest of their customers.
    – wfaulk
    Sep 29, 2009 at 18:03
  • @wfaulk: That may be true, but its also not the business of a consultant who was brought in years ago. Unfortunately, the world is full of people who are inept, ignorant or bad actors. We don't have an individual responsibility to resolve every problem -- IT professionals are not superheroes. Sep 30, 2009 at 19:07
8
votes

First - you don't sell what you know, that's certainly unethical, and may be illegal :)

My second advice would be to go to Marketing Guy's boss, all the way up to the CEO of that company. If you work for an auditing group, they don't care what a company does with the information, just that they got to sell the service in the first place.

Third, if it's really this big a deal, you may be able to start an anonymous (or non-anonymous) marketing/boycotting campaign regarding the insecurity of the site, without actually compromising them.

But better than asking a bunch of sysadmins would be to talk to a reputable lawyer :)

1
7
votes

You were hired to perform an audit, so your duty is to the client to inform them of the results of the audit. What they do with it is their business. They have decided the risks versus the cost of change. Not you. If they have a massive security issue and you get a subpoena, you get to testify about the audit results (3 years ago). That's it as far as your obligations.

I've got news for you. The vast majority of companies handle customer data in an insecure fashion, at some level or another. How many DBA's have complete access to all customer data? Very few companies run Oracle Vault.

"Do I just mine the data and sell it to a competitor minus the CC info?"

Only if you want to go to jail.

1
  • 2
    This is exactly right. Every company will do a cost-benefit analysis on any issue that is presented, and sometimes they do choose to sweep issues under the rug and hope they go unnoticed. You've done your part. Sep 29, 2009 at 21:28
6
votes

You may be on really thin ice if you disclose anything. You may get into real trouble for that.

There is a reason for companies having rigorous agreements between each other when pentesting is contracted. The pentesting company need all the protection they can get. Disclosing information you should not can and will get you sued or prosecuted.

Lets say you go to the marketing guy's boss. The boss clamps down on the marketing guy. The marketing guy begins to cover his ass. He may persuade the boss that in order for you to have this information you must have done something illegal, or similar. Even if you will eventually win, you might be in court for a long time.

If they don't want to take it seriously at first approach, pressuring them to taking it seriously will most likely get you into trouble.

For your sake drop it.

EDIT: Furthermore, if the original agreement for the security audit includes specific people you only may inform, informing other in the same company, not included in the agreement, might get you into trouble.

1
  • good points. Likewise, revealing that you are aware of the problems years later really opens you up to some uncomfortable questions if the discussion bubbles over into legal and business areas. It's unlikely that part of the agreement was that you'd keep "checking on them" for years to come.
    – damorg
    Sep 29, 2009 at 13:13
6
votes

So far as I see it you've done your job. You performed the audit and passed the results on to the relevant person in authority. My advice is to just back away from it, there's nothing more you can really do. Of course the dilemma is that innocent customers could be exposed to the ongoing security weaknesses, but it's not really your problem is it? You can't be taking responsibility for any part of it beyond the remit of your job.

6
votes

You certainly don't leak this information, and you certainly don't sell it to outsiders.

There is something here I don't understand ... three years ago? If you did an audit 3 years ago, how come this is still on your mind? Are you feeling that bad about it, or is the insecure company still contracting your company for security / audit services?

It's an important question, because if you've had no business with this company for 3 years now, then my clear advice is walk away. It would seem very strange if you re-appear after 3 years, and start criticizing. If it was 3 years ago, then you had you chance back then, and you didn't take it. Now walk away.

If your company is still doing business with the insecure company, then I'd propose to strong-arm your own boss into sending them a letter together. Your boss will not enjoy this; but for you its much better if the letter comes from you company rather than from yourself. Send it with courier to the marketing managers boss (CEO). Keep it polite, keep it vague and mostly covering your own companys a**, and allude to the marketing managers security decisions being so far outside accepted industry standards that you felt compelled to go over his head. Your objective isn't to tell everything, your objective is to cover your own companys a**, and to get the other CEO rattled enough to ask for a copy of your original report.

Going over the marketing managers head is the strongest move I can in any way recommend. And it's really quite strong, and unwanted. You were hired to provide an expert opinion on one aspect; not to run their business.

On a somewhat sad site note: It is not that uncommon to see unethical or just plain incompetent business people. Sometimes these may hire security auditors without intent of ever using the findings; with intent to only say they've been audited by well known security company X. This is of course sad and offensive -- but it is real, and you'll have to get used to it if you want to work in security auditing.

3
votes

On the other hand, you have to consider your liability for failing to inform the client adequately of the risks. You have to consider what kind of Errors and Omissions coverage your company carries. You say your company doesn't care, but I bet if they get sued by the client, brought about by a suit against them by one of their customers, it would get everyone's attention.

3
votes

3 years ago you did a job, for which you were presumably paid. If you took all the steps required of you in the performance of that job then your job is done. Over. Finished.

I have serious trouble understanding why you've had 3 years to do something about this and haven't. This doesn't sound to me like you're having ethical issues. In fact your very mention of possibly selling the information suggests to me that you may well have quite different motives. At the very least I find your position highly questionable.

As you've done nothing till now, if you do start taking any kind of action at all you may well be exposing yourself to possible legal action. Laws vary from place to place but where I am, if someone has fallen victim to data theft through the mechanisms you described and you only now take action you are in fact a knowing participant through your previous inaction. The only safe course for you personally is to drop it.

1
vote

If you're in the business of "security audits", mining the information and selling it is out of the question. Hell, the fact that you would even ask that question, has me wondering about your ethics and would certainly have me question whether or not you'd be right for my security team.

Having said that, you did your job. You were hired to do a security audit and you did. Was the company made aware of the findings in writing? As others have said, you can't force a company to close security loopholes. The ethical question is learn from this audit and move on.

1
vote

If you're concerned about doing your job properly, you've done your job. Just because no one acts on your recommendations doesn't reflect on you.

However, if you're legitimately concerned about their customers' being victims of identity or credit card theft, I'd say to contact the FTC complain department. (Assuming you're in the US. If not, your country probably has a similar government department.)

1
vote

I've done a few semesters in Ethics, and it's really a tough, tough question.

Asking here for a "What should I do" answer is never going to get you a "Correct" answer, all you will get are answers that either re-enforce or go against what your personal feelings on the issue are.

Also, all the answers you get here will be strongly influenced by peoples past actions or decisions, where they live, where they grew up, their local laws and customs. So even if they've been in the same situation you have been, their experience may well be completely different.

The short answer is: You need to do what YOU believe is right. Clearly you believe that inaction is not the right thing to do. If you didn't, you wouldn't be asking this.

I, personally, do not agree with everyone who says "Drop it" or "You've done your job". That seems to be a popular opinion whenever ethics has cropped up on ServerFault. And it's not a wrong answer, it's just not my answer.

1
  • The fundamental question here is one of boundaries. If your neighbor builds a fence that is on another neighbor's land, do you call code enforcement or the police? Sep 30, 2009 at 19:22

Not the answer you're looking for? Browse other questions tagged .