full-disclosure - Re: CCBILL.COM Internet billing service multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=NbS2eRrznGQcH7HM9c9zO=XHt2Ao84E5b1GAU@mail.gmail.com>
Date: Mon, 16 Aug 2010 20:06:47 -0400
From: Jeffrey Walton <noloader@...il.com>
To: Vulnerabilities <vuln@...ko-security.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: CCBILL.COM Internet billing service multiple
	vulnerabilities

> # 30/07/2010 - Vendor notified. / no response
> # 03/08/2010 - Vendor notified. / no response
> # 10/08/2010 - Vendor notified. / no response
Its unfortunate that the vendor did not respond. But in the US,
legislation is such that its more cost effective to suffer the breach
and then turn it over to PR rather than invest the time and money in
fixing/training/etc.

It seems that corporate America's purchasing of politicians (err, PAC
contributions) has been well worth the investment. Legislation is such
that victims and shareholders both suffer after a breach.

Jeffrey Walton

* Heartland Databreach Lawsuit Dismissed
   http://news.cnet.com/8301-27080_3-10413194-245.html

* Most claims dismissed in Hannaford data breach suit
   http://www.computerworld.com/s/article/9133075/Most_claims_dismissed_in_Hannaford_data_breach_suit

* Class Action Suit Over Aetna's Security Breach Is Dismissed
   http://www.law.com/jsp/article.jsp?id=1202446049469

* Starbucks Data Breach Class Action Dismissed
   https://www.washingtontechnology.org/community/forums/thread/673.aspx


On Mon, Aug 16, 2010 at 7:19 PM, Vulnerabilities
<vuln@...ko-security.com> wrote:
>  We want to warn you about security vulnerabilities in CCBILL.COM
> Internet billing service.
>
> CCBill is an Internet billing service. Established in 1998, the company
> provides third-party billing, or turn-key solutions, for e-Merchants
> requiring payments by way of credit card, debit card, or e-check,
> European Debit/Direct Pay, and telephone payment.
>
> Since Ccbill is a privately held company little is known about it's
> finances however it is estimated that more than a billion dollars per
> year in credit card charges are processed through Ccbill in the us and
> abroad.
>
> Time Table:
> # 20/07/2010 We have found multiple Blind SQL injections.
>
> # 30/07/2010 - Vendor notified. / no response
> # 03/08/2010 - Vendor notified. / no response
> # 10/08/2010 - Vendor notified. / no response
>
> CCBILL.COM vulnerability:
>
> Multiple blind SQL injections
>
> It's possible to get all customers FULL personal details, server admins
> etc...
>
> Also is possible to read any file from ccbill.com and write to this
> server too.
>
> JPG sample tables proof:
> http://www.ariko-security.com/images/ccbill_proof1.jpg
>
> Credit:
> # Discoverd By: MG / Ariko-Security 2010
> # http://advisories.ariko-security.com/august/audyt_bezpieczenstwa_719.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/