Feeds

CyberPatrol censor-ware gives up credit details

Another fine mess

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

Web filtering and spyware outfit SurfControl has hit a PR snag since it bought the CyberPatrol child-salvation censorware from toy maker Mattel this Summer, following a recent BugTraq submission detailing laughable credit card protections for its customers.

The problem occurs when a customer attempts to register the product. "All registration info except the credit card number is sent in clear text, and the card number is obfuscated with a trivial substitution cipher," the alert says.

Registration is handled by the software rather than a proper SSL-encrypted Web interface. The software first verifies that the CC number is a valid Luhn number, meaning that doubling every other digit and then adding all the digits produces a sum divisible by ten. (Careful, carder-wannabes - we left out an important detail.)

If the CC number conforms to the Luhn algorithm, the software sends the customer's registration details to the company via HTTP using a POST request. The victim's name, address, e-mail, credit card expiry date and phone number are all sent in plain text.

The card number itself is protected by "an extraordinarily ineffective substitution cipher, equivalent to that which may be found in the games pages of many newspapers", the alert says.

A malicious third party could easily intercept this information by placing a sniffer upstream of the company's servers. With all the ancillary information in plain text, and the cipher breakable using nothing more sophisticated than a pad and pencil, the wind-up is a preposterously easy bug for carders and identity fraudsters to exploit.

Potential customers are advised not to register the product until the security hole has been bunged.

The company itself is admonished to get its act together and start using SSL. "You apparently lack cryptographic expertise on-site - accept this. Don't go out and attempt to merge in a commercial crypto tool kit or even OpenSSL - you don't have the time or the programming staff. Please, take advantage of the widespread deployment of SSL in the browser and have users register on line through an SSL-enabled form," the authors urge.

CyberPatrol has taken a severe battering since filing a federal lawsuit earlier this year, persecuting crypto buffs Eddy Jansson and Matthew Skala for distributing their 'cphack' cracking utility, which exposed the product's controversial list of banned URLs, while simultaneously making a mockery of the company's cryptographic know-how.

The company went so far as to demand server logs of the Web sites where the utility had been available, showing the IPs of people who had downloaded cphack, in an obvious bid to intimidate them.

With that little PR debacle blowing up in their faces, it's no wonder Mattel was in a hurry to dump CyberPatrol onto the far-less-queasy SurfControl, which, in addition to its censorware interests, has nerve enough to make spyware for businesses - and boast about it. ®

Internet Security Threat Report 2014

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
'Internet Freedom Panel' to keep web overlord ICANN out of Russian hands – new proposal
Come back with our internet! cries Republican drawing up bill
What a Mesa: Apple vows to re-use titsup GT sapphire glass plant
Commits to American manufacturing ... of secret tech
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.