PDG Software is a company based in Tucker, Georgia , that sells electronic commerce software to companies that operate small and midsize electronic commerce Web sites. PDG sells shopping cart software, auction software, and a number of other packages. Although it sells some of its software directly to the companies that use it, most of its sales are through resellers-firms that use PDG software as part of Web sites that they design, build, and delivered to customers as complete units.
An attacker discovered a vulnerability in the PDG software that would allow intruders to gain access to PDG shopping cart software installed on a retailer’s Web site so that companies using the software could download and install the patch. Both PDG and the FBI issued press releases immediately to warm users of the problem with the shopping cart software and encourage them to obtain the patch. Unfortunately, many users of PDG shopping cart software had purchased it as part of a complete electronic commerce Web site. These users were, in many cases, unaware that they were running the PDG shopping cart software.
Because it took so long-several months, in some cases-to find and contact the companies using the software, online offenders were able to exploit this vulnerability and collect thousands of credit card numbers. In most cases such as this, the difficulty of finding the sites that are running the vulnerable software helps slow down the attackers. Unfortunately, in this case, the intruder who discovered the opening also found that entering a specific word in a search engine’s search expression would instantly return a list of the thousands of sites running the PDG software.
Most of the Web sites found out about the problem when their customers called them, suspicious because their credit card information had been compromised. The lesson from this failure is that companies that operate electronic commerce Web sites must know the source of the software used in creating and maintaining their sites and must monitor news about the security of that software.