full-disclosure - Exploiting an online store

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AA95E41CCEDC1D468B4039CB853CA729017A68B7@zeus.icshq.com>
Date: Thu Sep 15 06:01:20 2005
From: perrymonj at networkarmor.com (Josh Perrymon)
Subject: Exploiting an online store

I know that bad programming habits exist on some of the sites out there and still use Hidden fields to pass prices over.. Although not very common....    I found one this morning after sending the email...

My question is more on the theory I suppose...  What laws are out there to protect against this after-the-fact? Is it true that if the seller closes the deal by sending you the merchandise then they have no case and can't go back and charge you?

Seems there should be something out there providing protection is the system is automated... Even though there should be checks in place people do have small budgets and rush a lot of the smaller E-com stores out.

JP

	-----Original Message----- 
	From: Valdis.Kletnieks@...edu [mailto:Valdis.Kletnieks@...edu] 
	Sent: Wed 9/14/2005 7:35 PM 
	To: Gadi Evron 
	Cc: Josh Perrymon; full-disclosure@...ts.grok.org.uk 
	Subject: Re: [Full-disclosure] Exploiting an online store