Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Registrar's database said to have exposed data

Error may have existed on domain name site for up to four months

April 7, 2006 12:00 PM ET

IDG News Service - A database problem with a U.S. domain name registrar exposed sensitive financial and personal information related to thousands of domain name registrations, a Dutch company said Friday.

New York-based DiscountDomainRegistry.com fixed the problem shortly after being notified yesterday, said Nico Vandendries, CEO of Strongwood, a private investigation company based in the Netherlands.

DiscountDomainRegistry.com CEO Alex Brecher said in an e-mail to the IDG News Service that the company is 100% positive customer data was not compromised. The "alleged vulnerability," he wrote, was patched within minutes after the company was contacted by Strongwood.

"We're in the midst of investigating these allegations, and we cannot provide detailed information at this time," Brecher wrote.

Erik Ekkelenkamp, a systems project engineer at Strongwood, was researching .eu domain names when he clicked a link within DiscountDomainRegistry's site. The link led to an error involving execution rights on a MySQL directory. MySQL is a widely used open-source database program.

A script plus other programming usually unseen was visible that allowed for a connection to the database, which contained credit card numbers, usernames, passwords and other information, Vandendries said.

A DiscountDomainRegistry.com official wasn't initially convinced there was a problem, Vandendries said.

"At first, they didn't believe us until we presented him with his own password," Vandendries said. "And then he knew we were in."

On its Web site, DiscountDomainRegistry.com, founded in 1998, says it registers domain names for $14.99 per year, including those of Fortune 500 companies.

So far, it's believed that no one has exploited the error, which may have existed for up to four months, Ekkelenkamp said. DiscountDomainRegistry.com had changed parts of its Web site recently, which may have resulted in the bug, he said.

The damage could have been severe, Vandendries said. The credit card data and personal information from DiscountDomainRegistry.com clients could have been sold, he said.

Further, access to usernames and passwords would have allowed an intruder to change the names and IP addresses associated with Web sites, a method used for so-called phishing scams, Vandendries said.

Phishing involves tricking users into visiting a Web site that appears legitimate but actually is a facade. The URL may look authentic but connects to an IP address with a bogus Web site. The fraudulent Web sites usually have forms for providing sensitive material, such as financial information, which is then directly sent to scammers.

Vandendries estimated it would take "little skill" with MySQL to exploit the bug. "If a bad guy found this leak and had access to the database ... then I'm sure it could have cost millions," he said.

Ekkelenkamp said he received a call last night from the owner of DiscountDomainRegistry.com, thanking him.


Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.

Jump to comments

Viruses

Additional Resources

EFD vs. HDD - What You Need to Know
WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
Gartner Research Report: Magic Quadrant for Application Delivery Controllers, 2009
WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
Eight Criteria for Server Load Balancing
WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.

White Papers & Webcasts

Death to PST Files
Download Now  

Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".

eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!  

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...


IT Jobs