Re: Storing CCN's Again...
| From: | Jochem Maas | Date: | Tue, 08 Feb 2005 10:05:48 +0000 |
| Subject: | Re: Storing CCN's Again... | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-208241@lists.php.net to get a copy of this message | ||
Marek Kilimajer wrote:
Greg Donald wrote:This was aimed at me. I personally wouldn't touch a CCN with a barge pole, I did say it was 'best' not to accept them at all, although accepting them and immediately passing them on via an SSL link (e.g. with cURL) is probably 'good enough' - at least, apparently, 10,000s of merchant seem to think so.On Mon, 07 Feb 2005 22:25:46 -0500, trlists@clayst.com <trlists@clayst.com> wrote:I think this is an extraordinary (and unjustified) level of paranoia.
nice bit of magic tho, Greg :-)cat /dev/mem | strings | egrep "^[0-9]+$"
getting root is often quite trivial for anyone with a fair bit of knowledge & determination, mostly because for alot of vulnerabilities there are 'make'n'run' exploits which any numpty can use. besides which anyone ever here of 'an inside job' - i.e. when the CCNs go wandering from your DB/encrypted zipfile/index.html, its the sysadmin who you should be looking at first (e.g. its often alot easier to bribe a sysadmin than it is to hack into a server).cat: /dev/mem: Permission denied :) You need root access. If anyone gains root on your providers server, he has simpler ways to find the CCNs