Steven Posted December 6, 2002 Share Posted December 6, 2002 Tower Records site exposes data By Declan McCullagh Staff Writer, CNET News.com December 5, 2002, 1:17 PM PT A security hole on Tower Records' Web site exposed data on millions of U.S. and U.K. customers until it was closed late Wednesday. The glitch allowed anyone to peruse Tower Records' Web site to view its database of customer orders dating from 1996 through this week, including home and e-mail addresses, phone numbers and what music or video products were purchased. More than 3 million such records were exposed. "It was a technical error, and when we discovered it we were fairly horrified and we fixed it in a matter of hours," a Tower representative said on Thursday. No credit card numbers appear to have been revealed, the company said. Stephanie Wilbanks of Jonesboro, Ark., had her personal information exposed after she ordered a CD as a gift from Tower Records this week. "I'm shocked and disappointed," Wilbanks said. "I will no longer do online business with Tower Records." But another affected customer, Ivor Colwill of Haywards Heath, England, said he wasn't as concerned. "I doubt it'll affect my shopping at Tower," Colwill said. "I honestly can't think of another site that covers so many of my musical needs in one spot or with the same quality of service. At worst, I'll telephone my orders to them." The security leak arose out of a programming error in a script called "orderStatus.asp." When customers requested information on their order via the Tower site, the script called up the record, displaying the order number as part of the URL of the resulting page. But the script allowed customers to type a different order number into the URL and call up a different record. In the change made Wednesday, Tower now requires customers to log in with their e-mail address and password before they can view information about their order. The programming error, which existed for an unknown length of time, appears to have conflicted with Tower Records' posted privacy policy, which says: "Your TowerRecords.com Account information is password-protected. You and only you have access to this information...TowerRecords.com takes steps to ensure that your information is treated securely..." Founded in 1960 in Sacramento, Calif., Tower Records operates about 200 retail stores and opened its online store in November 1996. http://news.com.com/2100-1017-976271.html?tag=fd_top Link to comment Share on other sites More sharing options...
Fotix Posted December 6, 2002 Share Posted December 6, 2002 Ouch. But I guess that's what happens when you keep excessive logs on people for your company. Is there really a need for this when making a purchase? If I was pestered when buying in a real store for info the way I am online, I would never shop there again. The security leak arose out of a programming error in a script called "orderStatus.asp." When customers requested information on their order via the Tower site, the script called up the record, displaying the order number as part of the URL of the resulting page. They're running a Windows server? Guess I should go check. Link to comment Share on other sites More sharing options...
Daniel F. Administrators Posted December 6, 2002 Administrators Share Posted December 6, 2002 ty posted Link to comment Share on other sites More sharing options...
Recommended Posts