Security

This morning I got a phone call from a phone number in Isreal. It was Tal, an engineer from Plimus. Tal wanted to know about the issues I had found and what solutions I had in mind. Tal also explained their plans for fixing all issues and all the issues that are involved with changing their API. I’ll be keeping an eye on Plimus to see how they are doing, but now I’m confident that someone at Plimus understands their security issues and they are working on fixing them. ...

It’s been a while since my last post about Plimus. I have contacted Plimus multiple times since and still haven’t got any response from someone with even a basic knowledge of security. They did however visit my blog and that gave me enough information to figure out that their customer support system stores passwords in plaintext. But what I want to write about is worse. Let me start by saying that what I am going to write about is not a bug, not an unpatched piece of software and not a subtle design flaw. It’s a feature. ...

In my last blogpost about Plimus I talked about the lack of SSL based security. At some point in time Plimus must have realized this and started looking for a solution. Of course, Plimus is a serious business and can’t afford to break backwards compatibility for their customers and so devised their ingenious “MD5hex encryption” technology. Let’s think back about the lack of proper use of SSL and the problems that this brings: ...

Plimus Inc. is a company that handles online payments for websites. The websites don’t have to deal with all kinds of credit card companies and banks. Just create a account at Plimus and let them handle all your payments. This means Plimus has access to sensitive customer information and they should take extremely good care to protect this information. However, I will try to explain how a few mistakes from Plimus may harm the security of your webshop and the security of your customers. ...

After a few weeks of frustrating email exchange with the Plimus security people I have decided to write this blogpost to warn existing and potential customers of Plimus. The apparent lack of technical knowledge on the side of Plimus and my previous experience in their response to bug reports has given me no hope that these issues will be addressed soon. I will not give out any details yet, but will try to give some tips to reduce the risk of exposure if you’re a Plimus customer. ...

De afgelopen dagen is Vodafone hevig in het nieuws geweest. De voicemails van veel ministers en kamerleden waren erg makkelijk af te luisteren door iedereen. Het schokkende hiervan is echter niet dat iedereen met een telefoon in staat was om bij informatie te komen die de staatsveiligheid in gevaar kan brengen. Nee! Het schokkende is dat het al lang bekend was dat dit mogelijk was, maar dat er tot nu toe niets aan gedaan is. ...