Hack-proofing a website is hard enough. But the task becomes
gargantuan when you accidentally publish the administrator’s password
on one of your site’s most heavily trafficked pages.

Such a security gaffe may have enabled unauthorized visitors to log in
and access files undetected for more than six months on a server
operated by Carmichael Lynch, a public relations and advertising firm
with several big-name clients. The admin password was inadvertently
published on a page that contained online job postings.

Among the files potentially exposed to outsiders: internal documents,
including customer databases owned by two of the company’s biggest
clients, Porsche and American Standard.

Experts said the incident is the latest example of how shoddy security
can undermine companies’ privacy promises.

Carmichael Lynch removed the posting that contained the admin password
from its site last week. Contained in the help wanted ad, cached here,
were hyperlinks that included a user name and password that human
resources employees used to upload job listings.

Before the problem was corrected, any Internet user could have
accessed files on Carmichael Lynch’s server simply by modifying the
address in the link.

Carmichael Lynch spokeswoman Sara Mulder said the company has no
evidence that unauthorized visitors took advantage of the security
lapse.

Mulder said the firm’s HR team was using Microsoft’s FrontPage Web
publishing software to post job listings, and the program embedded
“unwanted code, creating that loophole.”

An Internet user who asked not to be identified said he discovered the
problem last June and notified Carmichael Lynch. The user said he
decided to go public with the information after the PR company failed
to plug the hole.

Mulder confirmed that Carmichael Lynch learned last June that its
job-posting process contained a security flaw, but she said the
company thought at the time that it had resolved the problem.

Among the files accessible on the server last week was a 13.5-MB
database containing names, addresses, vehicle information and other
data on nearly 75,000 luxury car and SUV owners.

According to Mulder, Porsche owned the database, which was dated Oct.
20, 2002. But the file’s Properties tab indicated the database was
created by Acxiom, a provider of customer-information tools and
services.

Officials from Porsche Cars North America and Acxiom had no immediate
comment on the incident.

Carmichael Lynch’s security flub also exposed a 7-MB spreadsheet that
contained contact information, including e-mail addresses and
registration passwords, for nearly 12,000 people who had registered
with the American Standard website between April 30 and Sept. 10,
2002.

A pop-up window greets first-time visitors to the plumbing supply site
and encourages them to register for access to “site extras” such as a
“wish list” and a preferred dealer locator.

It was not immediately clear why Carmichael Lynch was storing clients’
customer info databases on its public Web server. Such a practice is
dangerous but common among site administrators who are not “security
savvy,” said Harlan Carvey, a security engineer for a financial
services company.

Privacy policies posted on the websites of Porsche, American Standard
and Acxiom state that the companies take “reasonable precautions” to
protect customers’ personal information in their possession. Mulder
said she does not believe Carmichael Lynch has a privacy policy.

Mark Litchfield, co-founder of NGSConsulting, said privacy policies
are often not backed up by strong security practices. Instead, such
statements are merely “jargon” aimed at giving customers “a warm
feeling in parting with their credit card and other associated
sensitive material.”

Privacy expert Richard Smith agreed, and said Carmichael Lynch’s
security practices “don’t live up to the promises being made in their
clients’ privacy policies.”

To prevent such lapses in the future, Mulder said Carmichael Lynch has
“isolated all such data to ensure its security on limited-access
servers.”

Such data spills can be costly to corporations that fail to follow
standard practices for protecting customer data. Last August,
Ziff-Davis Publishing agreed to pay affected customers $500 each after
lax security exposed the personal data of thousands of subscribers.

–
ISN is currently hosted by Attrition.org

To unsubscribe email majordomoattrition.org with ‘unsubscribe isn’
in the BODY of the mail.

 …

THE curious thing about the new film “Catch Me if You Can” is how
contemporary it seems. Curious because this tale of Frank W. Abagnale
Jr. – in real life a teenage con artist who cashed millions in fake
checks while impersonating an airline pilot, a doctor and a prosecutor
– is set in the swinging 60’s.

In those days few mortals had used a computer, and Internet wasn’t
even a word. But the young Frank Abagnale seems an eery prefiguration
of a very modern character: the hacker.

Like them, he discovered a vast and arcane system held together with
technology – in his case, the nation’s network of banks. He worked
tirelessly to understand its every facet, from the codes used by the
Federal Reserve system, to the special paper and ink and machines used
to make checks. And he exploited the system with a teenager’s
limitless energy – and limited morality.

Like many of today’s hackers, Mr. Abagnale – who is currently
unavailable for interviews, said a spokesman, having just completed a
publicity tour for the film – finally went legit. He crossed over from
committing crimes to solving them – first for the F.B.I., and these
days as a consultant to the industry he once defrauded. In this, too,
he was ahead of his time. In January 2000, the computer security firm
known as stake hired the seven members of L0pht Heavy Industries, a
hacking collective in Boston. Two years before, a member of L0pht
(pronounced loft) had bragged about the group’s skills to a Senate
committee, saying that any member could take down the Internet within
30 minutes.

Chris Wysopal, who attended that hearing as a L0pht member and is now
the director of research and development for stake, says that while
his firm doesn’t go out of its way to hire hackers, it values
“learning how the systems work through exploration.”

Kevin D. Mitnick, perhaps the nation’s best-known hacker, served five
years in prison on charges of computer and wire fraud and is currently
trying to reinvent himself as a business consultant. He has started a
company, Defensive Thinking Inc., and has written a book on computer
security, “The Art of Deception: Controlling the Human Element of
Security,” with William L. Simon.

Hackers have always been with us, said David J. Farber, who helped to
develop electronic telephone switching when he worked at Bell
Laboratories in the 1950’s and 60’s, and went on to pioneer many of
the technologies underlying today’s networked computers.

“There’s been a big history of – let’s call it hacking,” said Mr.
Farber, citing tricks like using magnets to guide slugs through Coke
machines, and getting free phone calls by turning the telephone
company’s own technologies against it. “I don’t remember doing
anything particularly onerous,” he said, and joked that his memory
might be clouded by the fact that “I don’t know what the statute of
limitations is.”

Broadly defined, he said, it is a fundamental urge to game the system.
“If you could find the records and dug back far enough, it was
probably going on in ancient Rome,” he said.

In that sense, the hacker really is a species of trickster. And as the
“cyberpunk” novelist Neal Stephenson wrote in “The Diamond Age,” the
trickster is universal, but varies in guise from culture to culture.

“The Indians of the American Southwest called him Coyote, those of the
Pacific Coast called him Raven,” Mr. Stephenson writes. “Europeans
called him Reynard the Fox. African-Americans called him Br’er Rabbit.
In 20-century literature he appears first as Bugs Bunny and then as
the Hacker.”

OF course, hackers may have another, less mythological reason for
embracing Mr. Abagnale as one of their own. In the movie, at least, he
is an infallibly successful seducer of women – a particular sort of
con at which the stereotypically male hacker is proverbially inept.

–
ISN is currently hosted by Attrition.org

To unsubscribe email majordomoattrition.org with ‘unsubscribe isn’
in the BODY of the mail.

 …

It is a great pleasure for us to introduce the Third World Conference
on Information Security Education, organized by IFIP Working Group
11.8 (IT Security Education) together with the Center for INFOSEC
Studies and Research (CISR) at the Naval Postgraduate School.

The conference will be held in Monterey, California 26-28 June 2003.

Take a few minutes to look around this web site – it contains all the
information you will need if you plan to attend the conference, or if
you want to submit a paper.

Register online!

http://cisr.nps.navy.mil/wise3/

We look forward to meet you at the conference!

–
ISN is currently hosted by Attrition.org

To unsubscribe email majordomoattrition.org with ‘unsubscribe isn’
in the BODY of the mail.…