Hacking IIS — how sweet it is
The Register, Aug 11 2001 12:11PM ET:
Hacking IIS — how sweet it is.
We’ve looked over a few recent credit-card database compromises brought to our attention by CardCops (formerly AdCops), an organization which tries to get the straight dope on e-commerce hacks directly from the blackhat community to better inform merchants of threats to their systems.
The most recent victims CardCops has seen are on-line perfumery StrawberryNet.com; computer retailer mWave.com; and a very large Texas ISP called Stic.net, which gave up many thousands of credit card details, along with the records of 500 businesses and their FTP logins. All of the victims are running IIS 4 or 5 over Win-NT or 2K.
Not surprisingly, Microsoft IIS is quite popular among carders, because its got lots and lots of holes, and because its often used by people who lack the technical know-how to bung them. It’s easy to use, which makes it particularly attractive for those who want to break into e-commerce on a shoestring, and particularly attractive as well for those who just want to break in.
[via Computer security news]
