Administrator password exposed in public URL for over six months
Incident Date: 2003
Incident Location: Minneapolis MN USA
An administrator account name and password for a Web site operated by Carmichael Lynch was inadvertently published within a hyperlink in a job listing Web advertisement. The company is a public relations and advertising firm with several big-name clients. The advertisement containing the password may have allowed unauthorized individuals to gain access to internal files for more than six months.
Among the internal documents exposed were customer databases owned by two clients, Porsche and American Standard. These included a 13.5MB database containing names, addresses, vehicle information, and other details on nearly 75,000 luxury car and SUV owners. The mistake also provided access to a spreadsheet containing contact information, email addresses, and registration passwords for nearly 12,000 people who had registered with the American Standard Web site.
An anonymous individual on the Internet said he discovered the problem in June of 2002 and notified Carmichael Lynch. He went public in January of 2003 with the exposed password finding because the company failed to fix the mistake.
Carmichael Lynch spokeswoman Sara Mulder said that the company has no evidence that unauthorized visitors took advantage of the leaked account and password. Human resources employees used the account name and password to upload job listings. She blamed the use of Microsoft’s FrontPage Web publishing software on embedding "unwanted code, creating that loophole." Mulder confirmed that Carmichael Lynch learned about the flaw in June of 2002, but said the company thought it had solved the problem.
Title: Help Wanted: Steal This Database
Author: Brian McWilliams
Publication: Wired Magazine
Publication Location: CA USA
Publication URL: http://www.wired.com/news/infostructure/0,1377,57066,00.html
Do you have additional information to contribute regarding this story? If so, please email email@example.com with the details and source.