Zona Alarm Secure Website is not Secure!

Paul_Varjak

I was ALARMED (excuse the pun) that I can view customer orders, their names, addresses, date of order and even the licence keys to use the product on the Zone Alarm website (www.zonelabs.com).

If Zone Alarm cannot protect their own computers how can they possibly protect yours? (Zone Alarm sell firewalls and anti virus software)

MadCowMan

Thats quite a statement to make !

Care to back it up with links to respected security sites / Bug Traq lists ?

Paul_Varjak

MadCowMan wrote:

Thats quite a statement to make !

Care to back it up with links to respected security sites / Bug Traq lists ?

MadCowMan: I realise it is is a bold claim. I have not looked on any security websites - I just discovered the problem for myself on the ZoneLabs website in the last hour!

If anyone wants to send me their order number (by PM) I can PM them back and tell them their name, address, what they ordered and even their licence keys!

What I can tell you is that all I had to do was view my own order details and then simply change the order number in the URL and I could view other peoples' orders as well! - Very simple stuff!

John_Gray

If anyone wants to send me their order number (by PM) I can PM them back and tell them their name, address, what they ordered and even their licence keys!

Why would people want to know what they know already? That information would come as no surprise to them.

One presumes that you have long since informed ZoneLabs of this matter...

John

MadCowMan

Sounds like some sloppy coding to me ( in the same way that you can view which thread you are view on here by changing the number in the URL.

for example https://www.somewebsite.com/showinvoice?invoice=12345 would just parse the invoice number into a SQL stored procedure to retriev your invoice details.

seems like there should be a second step that should only allow you to retreive the information to which you are entitled to ( ie the invoice that corresponds to your login on the site ( which may be controlled by a parametered view or subquery )

If it really is the case , then I would advise you contact Zonelabs immediatly to advise them.

Paul_Varjak

John_Gray wrote:

Why would people want to know what they know already? That information would come as no surprise to them.John

The Point is if I know who they are and what they bought - that clearly proves there is a security flaw!

John_Gray wrote:

One presumes that you have long since informed ZoneLabs of this matter... John

I rang ZoneLabs as soon as I discovered the problem but they are on Pacific Standard Time and not yet at work it seems! I have since e-mailed them about the problem and posted details on their forum too!

MadCowMan

Lets hope they resolve the issue in a timely fashion. Its not the first site thats not this , and I doubt it'll be the last.

Paul_Varjak

MadCowMan wrote:

Lets hope they resolve the issue in a timely fashion. Its not the first site thats not this , and I doubt it'll be the last.

Of course most companies are not in the 'security business'! Zone Labs even sells software to protect your identity - but if you buy that product, Zone Labs makes your name and address available on their website!

I have now managed to contact Zone Labs by phone but they could find no-one to speak to me because everyone is in a meeting!

Paul_Varjak

I have tried to speak to Zone Labs again but they will not action anything unless I tell them my e-mail address (which is also username on Zone Labs website) and my password!

I was happy to give my e-mail address but I made it clear that I would not give them my password. At that point they said they could not action my complaint! Nothing I could say could convince them otherwise!

albertross_2

There was a security consultant that got prosecuted under the computer misuse act (I think), for doing something similar to you, so I'd be careful.. you know what the Americans are like .. they like to keep their legal profession in business.

Paul_Varjak

albertross wrote:

There was a security consultant that got prosecuted under the computer misuse act (I think), for doing something similar to you, so I'd be careful.. you know what the Americans are like .. they like to keep their legal profession in business.

And Zone Labs may will be in breach of privacy laws (eg Data Protection Act)