RPGnow hacked

HinterWelt · January 05, 2007, 09:34:14 PM

Quote from: StuartLogan and I were crazy emphatic about the importance of security when we setup comiXpress. We weren't going to store credit card data unless we could be 100% sure of the security -- so we decided to work through PayPal for all transactions including credit cards.

I'm pretty surprised at how sloppy and amateurish leaving Credit Card data unencrypted and searchable by Google is.

Almost makes me want to setup an alternative online business. :eek:

But first... I finish the game.

Actually, it was an exploit in OSCommerce that did it. The CC# were on a Brazilian hacker's site (presumably the one who did it).

And yes, Your Games Now is set up the same way. We leave the security to the experts. I am setting my own site up on the same principles.

Bill

Blackleaf · January 05, 2007, 09:41:13 PM

Quote from: HinterWeltActually, it was an exploit in OSCommerce that did it. The CC# were on a Brazilian hacker's site (presumably the one who did it).

We used OSCommerce as well (we used another program for another project, but OSC is much easier to work with) and while it does have the option to store CC info locally, we thought that was just asking for trouble... especially if you don't aggressively keep on top of patches.

HinterWelt · January 05, 2007, 10:07:31 PM

Quote from: StuartWe used OSCommerce as well (we used another program for another project, but OSC is much easier to work with) and while it does have the option to store CC info locally, we thought that was just asking for trouble... especially if you don't aggressively keep on top of patches.

Definitely. I normally work in the merchant e-commerce solutions and with data management and I don't think I have heard of any design that stored cc# on site except in the "We absolutely must but we don't like it" category.

Just way too much liability there.

Bill

Dr Rotwang! · January 05, 2007, 10:28:23 PM

Quote from: HinterWeltThe date you need to be most worried about is before August of 2006.

That's me.

QuoteThis only applies to people who used the "Store my CC#" on RPGNow or RPGShop.

That's not me.

Wil · January 05, 2007, 11:39:35 PM

They were using an open source ecommerce solution? That's bright...

I'm assuming it was some kind of SQL injection vulnerability, which are a lot more common than they really should be.

Hastur T. Fannon · January 07, 2007, 07:02:01 AM

Quote from: WilThey were using an open source ecommerce solution? That's bright...

It is if (and it's a big if) you keep on top of the patches. More eyeballs on the code and all that

Tyberious Funk · January 07, 2007, 10:35:06 PM

I've purchased from RPGNow in the past. Using a credit card, too.

My ex-girlfriend's credit card.

Mwah hah hah hah

I shouldn't laugh. I really, really shouldn't.

Lawbag · January 08, 2007, 05:55:19 AM

this will either blow over quickly, or be something much bigger

http://gmskarka.livejournal.com/251567.html?nc=9