RE: *MAJOR SECURITY BREACH AT CCBILL**

[<jlewis () lewis org>]

On Thu, 20 Dec 2001 robh () forestknoll com wrote:

> And they used telnet, ftp as well as ssh for doing that? The scary thing is
> that people have credit card facilities on a machine accessible by telnet.
> Obviously CCBILL's forte' is not security.

The way CCBILL works, sites that use it redirect customers to a CCBILL web
site for the actual credit card payment.  Then CCBILL updates the web
server's passwd file on the appropriate customer system.  AFAIK, this part
is done via CGI.

-- 
----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com