Database Journal: The Knowledge Center for Database Professionals

find a web host with:
CGI Access DB Support NT Servers UNIX Servers Telnet Access advanced search

internet.com Internet News Internet Investing Internet Technology Windows Internet Tech. Linux/Open Source Web Developer ECommerce/Marketing ISP Resources ASP Resources Wireless Internet Downloads Internet Resources Internet Lists International EarthWeb Career Resources Search internet.com Advertise Corporate Info Newsletters E-mail Offers

internet.commerce Be a Commerce Partner

Major SSL Security Hole?

What the Heck?

"Everyone knows" that SSL (Secure Sockets Layer) guarantees total security for electronic commerce on the Web. It provides foolproof encryption, a detailed "audit trail" between a user's browser and any applications running on either the browser or the server, and default notification to the user if there's any insecure "holes" in a page.

<SCRIPT LANGUAGE="JavaScript">
<!--

   var imgObj = new Image;
   var ltUrl = "http://www.rankthis.com/cgi-bin/trakker/js_trakker.cgi";
   imgObj.src = ltUrl + "?ref=" + document.referrer;

//-->
</SCRIPT>

• JavaScript Example
• Java Example
• Java Example with Image

According to Clark, a similar technique (passing information to a CGI program via GET-style encoding in the URL) could be used to lift data (including credit card numbers) from a secure form and deliver it to an outside, insecure server, along with environment variables. He says: "Amazing how fragile the whole SSL thing is, eh? Outside of the <applet> tag, it generates a warning...inside the <applet> tag, it doesn't...despite the fact in both cases there is communication with an insecure server."

We've tested this with Netscape 4.06 and IE 4.0 SP1 on Windows NT 4.0. We'd like to hear from Netscape and Microsoft as to whether they think this is of genuine concern or not. Personally, I may go back to sending checks via carrier pigeon.
-- David Fiedler

Refresh Daily
Join Editor-in-Chief David Fiedler and find truth, justice, and a clue or two.

[ Site Map ] ActiveX / VBscript Animated GIF Archive Browsers CGI / Perl Database Connectivity Design / Graphics E-Commerce HTML-Advanced: DHTML, CSS HTML / Site Authoring Tools Intranet/Groupware Java JavaScript Multimedia: Audio / Video / Streaming Technologies Opinions Refresh Daily: Editorial Column Security Servers & Server Tools Site Design / Graphics Site Management / Marketing / Log File Analysis Tutorials VRML / 3D XML