To protect the guilty I will avoid names...
I know of a site that last night went down. Sort of. For about 5 hours all requests to this asp.net site were producing a YSOD. The details that were spit out included the impersonation tag showing that the site was running under the Administrator account and included the password. This particular site takes personal details and credit card information for 10K+ people per year.
Lots of obvious problems here, this biggest of which that the credentials were exposed for 5 hours. The second of which, they have been running this web site with Admin credentials for who knows how long. Third they are spitting out YSOD screens to the public in an error situation.
If you were tasked to work with this client to help solve this problem, mitigate risk and determine the scope of the potential compromise what would you suggest doing? I am thinking of telling them they need to...
- hire an outside security consulting firm to perform a thorough audit of the server, request history and other elements to determine what level if any compromise occured.
- They should actually move to a different server
- Rebuild the code from the original source, not a copy of what was on the server
- consider notifying customers whose credit cards are at risk if evidence of tampering comes to light
The host has stated that they do not store credit card numbers but I contend if this many basic mistakes were made, you cannot really trust what they say. They may think they are not storing the card numbers but that doesn't mean they aren't doing so inadvertently.