3 ms·
If the hackers got to the ColdFusion source code then it is quite possible they decrypted credit card numbers. The passphrase may not be stored in the database
by abalone 14y ago
If the hackers got to the ColdFusion source code then it is quite possible they decrypted credit card numbers.
The passphrase may not be stored in the database but presumably the decryption key is kept in memory by the app server while running. Otherwise it wouldn't be able to charge anything. And if the hackers could modify the ColdFusion source code, they can get to anything the app server can, including the decryption key. ColdFusion uses an interpreted language so injecting code is possible with just filesystem access.
Linode says there's "no evidence" of decrypted card numbers but I think it's more a matter of no evidence.. yet. They also call salted hashes "useless" to hackers which betrays a rather unenlightened perspective on infosec.
- jaxbot 14y agoFrom what HTP said on IRC, the credit card numbers were decrypted within the application context, which would be consistent with what you said. But during the IRC conversation, HTP willingly gave out the last four digits of people's CC#s, but ignored any request for digits before that, which would be more consistent with what Linode is stating. It's all a very confusing world where nobody has a definite answer. Just 2 cents, don't act like I'm sharing a fact or anything
- nenolod 14y agoLast 4 is all you need to wreak some serious havoc though. Service cancellations and whatnot...
- abalone 14y agoThere's no inconsistency. Linode said "Credit card numbers in our database are stored in encrypted format... Along with the encrypted credit card, the last four digits are stored in clear text..."