Another Sears.com Security Hole Discovered
That Sears website exploit we posted about a couple of weeks ago was funny, mainly because it seemed more embarrassing for Sears than a true security risk. However, an independent security researcher had also discovered a more significant issue with the site—it allowed for an unlimited number of gift card verification attempts via an external script, so a criminal could use the site as a brute force method to identify valid gift cards for Sears and Kmart.
Alex Firmani alerted Sears about the gift card exploit before the XSS exploit we mentioned above ever made it to the blogosphere, but they ignored him and while they called him back to discuss the matter, they didn't fix the problem:
On first reporting this to a company representative, the response from Sears was polite but they didn't take it as a pressing issue requiring a 0-day fix. Even after last week when Sears was reported first on Reddit, then FoxNews, TMZ, and the Consumerist to have easily exploitable XSS security holes all over their web properties, three days went by and I could still verify as many gift cards as I liked. And this is the same Sears.com that is authorized by MasterCard and Visa to store consumer's credit card numbers in their database!
After I copied a short report of my findings to a few Executive VP emails at Sears Holdings, the next day, all online gift card verification scripts were taken offline.
There's some debate over at Reddit whether the gift card exploit could reasonably be used to a criminal's advantage, but what we're surprised about is how a company as big as Sears would leave themselves open like this—even after being privately alerted about the issue.
A DarkReading article on the exploit quotes WhiteHatSecurity CTO Jeremiah Grossman saying that this is probably a fairly common security flaw on e-commerce sites. Firmani makes a point of urging other retailers to practice better security hygiene:
Responsible website owners MUST implement security measures on the server-side to prevent continual tries at gift card verification. Sears.com used cookies and relied on browser and user honesty to report those cookies back if they had tried and failed with more than three gift card numbers. You can never, ever rely on client-side cookies as a method of security for anything. Optimally you should require a site user account before they can verify a gift card number so you could then lock out accounts and use your overall account security strategy as a method to prevent numerous verifications. And you should have a self-termination routine on the verification scripts so they shut off if too many requests are received.
"Fortune 50 retailer Sears.com fails the most basic of security tests" [WebSecurity] (Thanks to jeremiahg, keith55, and theharmonyguy)
"Flaw In Sears Website Left Database Open To Attack" [DR]
RELATED
"Sears Caught Selling 'Grills to Cook Babies' Thanks To Poorly Built Website"
(Photo: ximenatapia)
Post a comment
Comments:
They probably use Windows.
It's the Sears way, baby. Half-ass.
I believe that the Sear's death watch is being held at bay due to them owning Kmart which is enough to keep them going.
And enough other places tanked - kind of like a sick water buffalo hanging on because he has just enough to barely eat as a bunch of other water buffalo have already died...
A huge company such as sears can't possibly take every comment receieved to heart. I'm sure the individual who originally received the "FYI" was some person who only received 15 minutes of training, was tired, depressed AND on top of all that...hadn't had breakfast yet. I'm sure if they had breakfast the comment would have been escalated.
@GuinevereRucker: That has nothing to do with it, at all. I manage hundreds of Windows servers, many hosting websites. Wanna know how many get exploited? None.
If you know what you are doing, you can easily secure a windows machine, its just a matter of doing it, and most people dont. Just like *nix boxes can be exploited when not secured, as can Mac OS (which is a nix variant at the core).
@detox98: It also depends on how the info was presented. I have done security audits for companies, and unless you can give a real world example on how this could hurt them, and make it not only seem possible, but likely, most dont want to spend the money to fix it.
@xtc46 - thinksmarter on twitter: I know, I know... just kiddin :) I do find your quote funny though:
"If you know what you are doing, you can easily secure a windows machine, its just a matter of doing it..."
I use OS X, and I didn't have to be smart to make it secure... just so happens I *am* smart though :D
mmmmmmm client-side cookies