3 ms·

I'm not sure I'd give them the benefit of the doubt that it was security through obscurity. Maybe it was an incredible error where editing resources didn't have

I'm not sure I'd give them the benefit of the doubt that it was security through obscurity. Maybe it was an incredible error where editing resources didn't have any type of authorization and no authentication based on the article.

ams6110 15y ago
Back in 2000 I worked on a website that had a secret page where you could enter any SQL statement in a textarea and it would be executed and the results returned to the page. This was claimed to be necessary for "debugging" and "support" but the only protection was that the URL was not linked anywhere else on the site. I would not be so sure it's NOT security through obscurity. Whether it is or not, the Borders case is just another example of why it's no longer prudent to trust ANY online service with your personal data (though most of us would probably not think that signing up for a Borders Rewards card would create an online profile).
- pavel_lishin 15y ago
  Was it something like /admin/query.php ?
  - s00pcan 15y ago
    I used to use /admin2/ I don't think anyone ever found out, but the website was a hideous mess of a first attempt at using PHP/MySQL.
    - c1sc0 15y ago
      my favorite was /pepe (grandfather in french) for phpMyAdmin. I remember a few places where /pepe stayed alive for many years after I'd left. Sure, there was a password ... but what good is a password if no one is arround to apply security patches.
dotBen 15y ago
It's not security through security because I've discovered their SOAP end points that powered this front end, and from that discovered a ton of other Brierley clients that are vulnerable to similar issues. Now trying to work out how to make the disclosure to Brierley.
allwein 15y ago
Or it could have been a feature. Back in 2000, I worked on the ecommerce site of a major consumer electronics manufacturer. One of the "features" that was implemented was for people that had an account, but hadn't logged in and had decided to proceed through the normal checkout process. When you entered your email address, it did a lookup at the accounts database and if that email address already existed, it logged you in as that user. Credit Card numbers weren't viewable, but were stored on the account. Nobody understood why this was a bad idea until I ordered a digital camera to the head of internet marketing using his own account.

ams6110 15y ago

Back in 2000 I worked on a website that had a secret page where you could enter any SQL statement in a textarea and it would be executed and the results returned to the page. This was claimed to be necessary for "debugging" and "support" but the only protection was that the URL was not linked anywhere else on the site. I would not be so sure it's NOT security through obscurity. Whether it is or not, the Borders case is just another example of why it's no longer prudent to trust ANY online service with your personal data (though most of us would probably not think that signing up for a Borders Rewards card would create an online profile).

pavel_lishin 15y ago
Was it something like /admin/query.php ?
- s00pcan 15y ago
  I used to use /admin2/ I don't think anyone ever found out, but the website was a hideous mess of a first attempt at using PHP/MySQL.
  - c1sc0 15y ago
    my favorite was /pepe (grandfather in french) for phpMyAdmin. I remember a few places where /pepe stayed alive for many years after I'd left. Sure, there was a password ... but what good is a password if no one is arround to apply security patches.

dotBen 15y ago

It's not security through security because I've discovered their SOAP end points that powered this front end, and from that discovered a ton of other Brierley clients that are vulnerable to similar issues. Now trying to work out how to make the disclosure to Brierley.

allwein 15y ago

Or it could have been a feature. Back in 2000, I worked on the ecommerce site of a major consumer electronics manufacturer. One of the "features" that was implemented was for people that had an account, but hadn't logged in and had decided to proceed through the normal checkout process. When you entered your email address, it did a lookup at the accounts database and if that email address already existed, it logged you in as that user. Credit Card numbers weren't viewable, but were stored on the account. Nobody understood why this was a bad idea until I ordered a digital camera to the head of internet marketing using his own account.