Major security flaw on a web site

[logical muse]

The OP already established the site's operators are complete idiots.

It's worse than you can possibly imagine.

If you want to read about the whole sorry saga, here are some links:

Singles_org_gets_hacked

the-hacking-of-http-db-singles-org
the-hacking-of-db-singles-org-continued
db-singles-org-the-saga-continues
singles-org-fesses-up-sort-of

Please note that they didn't really "fess up".

computerworld.com.au/article/278298


eta: And it's still not fixed!

 

[Dan O.]

If someone were going to create a site for the purpose of stealing personal information, it would be best to design it to be hackable so they could claim that it obviously must have been the hackers that stole the data.

 

[GreNME]

Please note that they didn't really "fess up".

computerworld.com.au/article/278298


eta: And it's still not fixed!

Send an e-mail to Computerworld, or take the story to InfoWeek, Network World, TechTarget, Net-Security.org, or a number of other places, stating that you've attempted to contact the site owners and you've sent a message off to CERT, and point them to the instance in Feb. when the problem was taken advantage of in the first place. If you want to help the people who may be taken advantage of, do what you can to have the vulnerability highlighted and made public through a 'reputable' source. Some states have laws that will place the onus and responsibility on the owner of the site/server if anything does happen, which will be a much greater use of leverage than sending the admins of the site a simple e-mail.

 

[logical muse]

Send an e-mail to Computerworld, or take the story to InfoWeek, Network World, TechTarget, Net-Security.org, or a number of other places, stating that you've attempted to contact the site owners and you've sent a message off to CERT, and point them to the instance in Feb. when the problem was taken advantage of in the first place. If you want to help the people who may be taken advantage of, do what you can to have the vulnerability highlighted and made public through a 'reputable' source. Some states have laws that will place the onus and responsibility on the owner of the site/server if anything does happen, which will be a much greater use of leverage than sending the admins of the site a simple e-mail.

I've contacted CERT and secunia.

I've emailed:
[email protected]
and other associated email address that I've found:
[email protected]
[email protected]
[email protected]
[email protected]

Some of those email addresses just bounce. In particular, and worryingly so for members of singles.org, the only email address given to them as the contact address for the site, [email protected], bounces.

As you can see from the computerworld article I linked to, the media was made aware of this problem back in February. They may not be following it up though.

I'll contact those sites you mentioned.

 

[logical muse]

If someone were going to create a site for the purpose of stealing personal information, it would be best to design it to be hackable so they could claim that it obviously must have been the hackers that stole the data.

I could be wrong, but I think you're giving them a bit too much credit.

 

[logical muse]

Send an e-mail to Computerworld, or take the story to InfoWeek, Network World, TechTarget, Net-Security.org

Done.