Possible S&P Security Holes Reveal Risks of E-Commerce

Computerworld - Alleged security flaws in an online service offered by a unit of Standard & Poor's Financial Information Services highlight the risks companies sometimes face as they use the Web to connect with external partners.
Stephen Friedl, an independent security consultant in Tustin, Calif., last week reported security problems with S&P's Comstock service to Bugtraq, a security mailing list.
S&P Comstock is a subscription service that aggregates financial information from more than 140 sources and pumps it to Linux-based clients that sit at each subscriber location.
The problem is that a lack of adequate security controls on those boxes - and, more important, on one of the virtual private networks (VPN) they're hooked up to - makes it relatively easy for hackers to gain access to the networks of some other Comstock subscribers, said Friedl. An earlier report on the problem was posted on Bugtraq in March.
Freedom to Snoop
Such access would give intruders the freedom to snoop around other subscribers' systems and networks, Friedl said. He claimed that while conducting a security audit for a Comstock subscriber, he exploited the vulnerability and detected the networks of other subscribers to show how easy it was to do.
Not all S&P Comstock subscribers are vulnerable. The problem affects only those hooked up to a VPN belonging to San Jose-based Concentric Network Corp.
David Brukman, vice president of technology at S&P Comstock, last week acknowledged that the firm's Linux-based client-side processors could be relatively easy to hack into.
But since the systems are hooked to a secure VPN, "they are not designed to be as secure as devices that would be on a public network," Brukman said. He challenged Friedl's assertion that the holes in the VPN allowed hackers to access systems belonging to other subscribers.
"It is possible that at some point in the past, the consultant may have found some flaw in the network, but the latest audit indicates the network is secure," Brukman said. S&P is shoring up security on its client-side processors and following up with the network provider to ensure total security in the future, he added.
Concentric declined to comment on the matter.
Need for Protection
Incidents such as this highlight the need for companies to protect themselves not just against hackers, but also from the security lapses of business partners they are connected with over the Web, said Ryan Russell, manager of information systems at SecurityFocus.com. The San Mateo, Calif.-based firm moderates Bugtraq.
"The main problem is that you are extending the trust of yourenterprise to somebody else, who may have a very different idea of protection," Russell said. "Whether it is a link with a supplier, service provider or a business partner, you need to treat it as a hostile entity" from a security perspective.