Ask HN: Screen scraper's server is fully open
4 comments
Produce (if you don't already have one) a list of security measures companies that interact with your data must have in place. Send it to them, giving them a reasonable amount of time to implement the security (say, 2 weeks?)
If they fail to meet the security measures, block they're IP.
If your data is that sensitive and you don't want it to get into other companies hands, it's a reasonable request.
Just because they're a "big" company, doesn't mean IT is properly staffed. They may have 1 poor guy managing everything and it might have been a (albeit big) oversight.
If they fail to meet the security measures, block they're IP.
If your data is that sensitive and you don't want it to get into other companies hands, it's a reasonable request.
Just because they're a "big" company, doesn't mean IT is properly staffed. They may have 1 poor guy managing everything and it might have been a (albeit big) oversight.
I am not at all versed in anything you have mentioned, but i'd like to ask: is your team/company/property at risk in any way or are you purely a spectator?
At the moment, spectator. But if someone else who stumbles upon this server and has other motives, they could be able to dig further and gain access to DB files.
Then we would be at risk since I assume that's where they store our user credentials needed to login to our website backend and make updates. Although, that will be least of our worries since we can simply reset the username/passwords that have accessed out sites since we have activity logs.
Then we would be at risk since I assume that's where they store our user credentials needed to login to our website backend and make updates. Although, that will be least of our worries since we can simply reset the username/passwords that have accessed out sites since we have activity logs.
If there's a potential risk that someone could gain access to your system by breaching theirs then I would raise it with them immediately.
As they're accessing your system you can probably safely say you always do a security check on hosts connecting to your system to ensure there aren't problems. In this instance it showed that they have an open FTP server.
As they're accessing your system you can probably safely say you always do a security check on hosts connecting to your system to ensure there aren't problems. In this instance it showed that they have an open FTP server.
Because I like to look at logs fairly regularly, their new IP address gave me concern so I did a quick lookup and port scan. They happen to have open FTP access with anonymous login enabled.
What's worse is that their whole C: drive (Windows server) is viewable through the exposed FTP (apart from user directories) and from a quick glance, their application code which does the screen scraping is visible to anyone.
This code also includes config files (connection strings to DB, etc.) and of course the code which screen scrapes our site and many others.
What do we do? Contacting them and then being accused of server breach etc is not my idea of the foreseeable future and everything that comes with it.
There is an unfortunate tendency, especially here in the litigation happy US, to pursue the person who does the right thing by warning of possible security issues. I don't want to join that list.
In terms of their own security issues, this might be an issue and keeping quiet will protect our interests at least.
What would you do?