Clickbank order details in plain view

https://www.google.com/search?q=site%3Aclkbank.com%2ForderDetail.htm

by Auserget • 13 years ago

111 76 13 years ago

aroch2• 13 years ago

Direct search link: https://www.google.com/search?q=site%3Aclkbank.com%2ForderDe...

Well, this is pretty egregious and makes me rather happy I don't use them. From the looks of things you can also change the email associated with an order and send yourself the info all over again. This means for some things, like online services or say application licenses, you can resend the info to yourself and probably steal the actual customers product.

Additionally, I'm willing to bet quite a few of these people have used the listed email and last 4 for other things online and/or for verification of identify places.

Also, how is this PCI compliant?

freehunter2• 13 years ago

There's no payment card information besides what's acceptable to show (last four and card type). Full name and email address is PII, but not necessarily in breech of PCI. I don't believe SOX has anything specifically mentioning full name and email PII either. If that's the case, the only thing that would make it a PCI or SOX violation is if the company says in their data privacy policy that they will protect this PII. I work information security but I am not on my company's compliance team, so I'm familiar with PCI/SOX but not steeped in it. I believe the above is true, but I'm not an auditor.

As far as trying to gain a copy of the information in the email, it might be possible if you were willing to put your own email on record as being part of this data breech. It's also possible that the only thing contained in the email is purchase confirmation (aka, what is shown in the printable invoice).

pchap10k• 13 years ago

Cardholders name is PCI data. So in most cases the customer?s name and the cardholders name would fall under the auspices of PCIDSS. This is definitely a breach.

nexfina2• 13 years ago

Looks like some of these are showing a customer's physical address too. I sure hope that wouldn't be PCI compliant.

https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF... (Click on View Details under Tracking Number)

hbbio3• 13 years ago

You can also (re)download the super expensive scammy ebooks.

And there is a bit more details in the URL (ZIP code): http://hypnosiscertified.com/nlp/july152010.php?item=18&cbre...

rk05672• 13 years ago

True, I did one - "Mastering the skill of Blah Blah.."

JeremyMorgan2• 13 years ago

It's not all expensive scammy ebooks, but "most" is probably an accurate assumption. I've actually purchased some useful software from a company using clickbank, but for the most part it's a strange part-pyramid scam type of thing with ebooks that tell you how to make your own part-pyramid scam business.

joshstrange• 13 years ago

And you can edit the email address without being logged in

ambiate• 13 years ago

That was the first thing I tried too. I expected the window to popup and say something along the lines of "You need to be logged in...". Nope. Insta-update.

rhizome2• 13 years ago

Since the vaunted FAA Sec 702 orders are being used for cybersecurity as well as (if not more than) terrorism, look for the FBI at your door with CFAA charges soon.

lominming• 13 years ago

The problem was that some average developer was lazy and do whatever that worked, with no concern about potential security implications.

Percein4• 13 years ago

It looks like their customer service ticketing system is wide open too:

http://www.google.com/search?q=www.clkbank.com/viewTicket.ht...

frogpelt• 13 years ago

First relevant result refers to the fact that customer's info is available for public viewing.

https://www.clkbank.com/viewTicket.htm?key=01.2C096591B7E11E...

systematical• 13 years ago

No, not lazy. Being lazy would have been doing a simple session check and then redirecting to a login page if the session user id did not match the user id in the order. The developer had no idea what he/she was doing. Brutal.

karolist• 13 years ago

You have me listening. What would be the correct course of action while not lazy and knowing what you're doing? I know that "knowing what you're doing" and this question doesn't go together, but still anything better than a check/redirect?

freehunter2• 13 years ago

I hate LMGTFY. It's slow and condescending, especially for something like this where slow and condescending don't add anything. Is it not possible to just submit a Google search link? Or use a text-only post?

Percein4• 13 years ago

Yeah--I think HN blocks Google URLs from being submitted.

swang2• 13 years ago

Looks like a mod has changed it.

moneyrich2• 13 years ago

WTF is a .htm file, I'm feeling all nostalgic, I haven't seen one of those in a decade. I wonder what version of CGI those developers are using.

Seriously though, wow! that's really awful.

keltex• 13 years ago

At least they could have added a meta robots noindex to the page. That would have kept it out of search although not eliminated the security hole.

hbbio3• 13 years ago

The founder sure knows about technology:

"As a research scientist for the NSA, Dr. Tim Barber was..."

Percein4• 13 years ago

I wonder if their new CFO that started today wants to take back what he said about ClickBank's "strong digital platform."

http://www.prweb.com/releases/2013/6/prweb10846812.htm

diroussel• 13 years ago

I had a look at a few of them, and they are mostly scam payments. Like $30 membership for a website where you "get paid to answer surveys".

pomber• 13 years ago

But it has a TRUSTe online privacy certification...

pdog• 13 years ago

Wow. People pay a lot of money for snake oil.

Domenic_S• 13 years ago

I smell a startup!! Quick, to Sand Hill road!

robryan2• 13 years ago

Hard work getting people to pay money for junk, that's why you outsource it to thousands of affiliates on clickbank.

rk05672• 13 years ago

this is horrible! I can even download ebooks (probably there is "Download Now" button for digital products) from certain orders :(

codegeek• 13 years ago

Hope no one is clicking on the "Resend Receipt Email" button. Imagine a customer receiving the receipt email for something they bought 3 years ago..

swang2• 13 years ago

What exactly is Clickbank? It looks like a platform to help people resell their knowledge?

rhizome2• 13 years ago

That's a charitable interpretation, but sure.

TylerE• 13 years ago

Affiliate marketing scumware. Like how to Make $5000/month at home crap. (Spolier Alert: Sell pamplets on Clickbank)

dotmanish• 13 years ago

Apart from various ebooks and what not, it seems they also help people sell:

Backup software subscription: https://www.clkbank.com/orderDetail.htm?rcpt=4fb75aa1LPBHFEH...

and ...

Phone lookups (they work?): https://www.clkbank.com/orderDetail.htm?rcpt=514323c6WDJ2F3C...

DanBC2• 13 years ago

Phone lookups (they work?)

Perhaps not?

(https://www.clkbank.com/viewTicket.htm?key=01.BF205EF24EE6D9...)

Reason: I never received my product.

robryan2• 13 years ago

That is what the current marketing sells it as. Basically it is mainly a platform for leads based affiliate marketing with some sales stuff as well. So stuff like generate a credit card lead for $50/$100 down to get an email address for some mailing list for a $1.

psutor• 13 years ago

Does Google pull links from Gmail and attempt to index them? I am wondering how they knew to index these pages with random URLs (the "security through obscurity" employed by ClickBank and defended in the support ticket referenced in the comments here).

ShaunK• 13 years ago

I'm fairly certain they do, from experiences in the past where otherwise completely private (but unprotected) URLs have ended up indexed.

jontro• 13 years ago

If you're browsing with chrome or a browser with the google toolbar urls will be submitted to google automatically.

Esifer• 13 years ago

Clickbank is a joke! I remember year ago you could put in Google product name and "thank you" and you would find thank you page with direct download link.

EDIT: Someone even made CB product to protect thank you page: Fix My Thank You Page http://fixmythankyoupage.com/ only $97 LOL!

Sheepshow• 13 years ago

I guess Google really started taking advantage of "today's digital internet"

Adding "no follow" tags to your Robots.txt file is a smart step but it's simply not enough on today's digital internet.

hughw3• 13 years ago

On the old analog internet it worked great.

bobfunk2• 13 years ago

Heh, Power4Home System ordered by "I.hate.niggers@microsoft.com" ...

https://www.clkbank.com/orderDetail.htm?rcpt=504d78866YCRFEF...

mmanfrin2• 13 years ago

Why is this racist juvenility the top rated comment in this thread?

bobfunk2• 13 years ago

I don't think it's funny because it's racist, I think it's funny because it reveals what kind of embarrassing data a security hole like this brings out.

JeremyMorgan2• 13 years ago

We're all going to get rich!

rdouble4• 13 years ago

I interviewed for a hedge fund once where my job interview was to write a program that exploited a security flaw like this to make a real time model of what people were paying for diamonds.

meowface• 13 years ago

Did you get the job?

rdouble4• 13 years ago

No. It was a week long, paid interview. After a couple of days I decided not to come back. Mainly because the main project seemed illegal (which I'll admit held some criminal mastermind allure) and I had another job lined up in Japan. In retrospect, I wish I would have done it as the job in Japan was terrible and I've not come across a similar opportunity since.

flashinfremont• 13 years ago

Hi, this is Matt Hulett the CEO of ClickBank.

ClickBank was recently made aware of a situation in which customers were posting their information using social bookmarking sites, which are indexed by Google. As a result, ClickBank is taking steps to limit the information that a consumer can inadvertently share through such services. We take customer privacy very seriously and believe that all individuals share responsibility for maintaining the security of personal information that is posted online. At no time is customer payment information disclosed.

Lutinger4• 13 years ago

Thanks, Matt... But it's pretty evident from your customer support tickets that your customers were alerting you to this issue (and their privacy concerns) since at least 2011... But you've clearly done nothing to fix it since then.

It's hard to believe you take customer privacy very seriously when you've made evidence to the contrary so easily searchable in Google.

jevinskie• 13 years ago

How was customer payment information NOT disclosed?! It is on Google!! The URLs should be protected by authentication! It should be impossible for Google or anyone else to access it without a login. It does not matter that some customers shared it on social sites. Saying there is no problem if the social sharing doesn't occur is security through obscurity.

kalleboo• 13 years ago

I've been through this before. Online receipts identified with long, random URLs. Users posting them online with no regard for security. Requiring a login for purchase was deemed infeasible since it adds friction to the checkout process. The only thing keeping the online receipt from google was robots.txt.

Percein4• 13 years ago

"...believe that all individuals share responsibility for maintaining the security of personal information that is posted online."

You (CLICKBANK) posted this information online--not your customers. Are you seriously trying to blame them for the fact that your development team seems to have no concern for security and privacy?

ddebernardy• 13 years ago

I'm puzzled. How is taking customer privacy seriously compatible with leaving private information indexable, let alone accessible through unrestricted urls?

rtrocc• 13 years ago

Has anyone realized all of this has to do with clkbank.com NOT ClickBank.com

Looks like a fake site all together...

encoderer• 13 years ago

It's pretty common to have multiple domains, especially affiliate marketing websites. ClickBooth has clickboothlnk.com, NeverBlue has many random alphanumeric domains.

This certainly is Clickbank.com

Lutinger4• 13 years ago

All signs point to the fact that clkbank.com is ClickBank.com. The website, WHOIS as well as the fact that their CEO just chimed in.

hughw3• 13 years ago

No worries, it's certified by TRUSTe http://clicktoverify.truste.com/pvr.php?page=validate&url=ww...

edit: not that TRUSTe claims to test this sort of exposure, to my knowledge. But simply to contrast the feeling of trust a label like that gives you, against the reality.

hughw3• 13 years ago

Are we all violating the Computer Fraud and Abuse Act of 1986 by exploiting this weakness? By following a link?

NKCSS• 13 years ago

They took this part of the site down, but you can just open the google cache and all details are there...

Clickbank order details in plain view

Related Stories