FraudRecord Public Dumps User / Customer Info

[DomainBop]

This is honestly, scary......

Are you saying you had a php file that would just execute a whole email event by simply browsing to the link?

Reminds me of the GVH password reset incident last year when people received dozens of reset emails...

The fact that information could leak by you forgetting to upload a blank index.html is strongly indicative of you being unprofessional in your approach to development

If the email program could be triggered by someone visiting the URL then an index.html file wouldn't be adequate protection.  The directory should have been password protected or IP access restricted.

The lack of an index.html file isn't the only problem with that website.  SSL Labs gives it a big fat C rating.  How many months ago was the Poodle vulnerability disclosed and Harzem still hasn't bothered to fix it?  It takes 2 effin' seconds to disable SSL 3 and another 2 seconds to fix the other SSL problems, even Jonny's 10 year old sister could do it so what is the excuse?

trying to deflect the blame is unprofessional.

That is to be expected because a consumer reporting service that isn't even run by a registered company is the definition of unprofessional and reeks of Ringling Brothers.

http://www.youtube.com/watch?v=YLsPnf3cKR0

 

[lbft]

That is to be expected because a consumer reporting service that isn't even run by a registered company is the definition of unprofessional and reeks of Ringling Brothers.

It fills a niche - the fact that it is far from perfect and yet still massively popular in a particular market segment is indicative of the need for something.

 

[drmike]

It fills a niche - the fact that it is far from perfect and yet still massively popular in a particular market segment is indicative of the need for something.

Sadly there are adult ran companies in there, folks I do respect.

There is a niche, but as-is, prior issues plus current = trouble in paradise.

There are lots of sayings about you get what you pay for with free.    If the service is viable, then make it a business, get professionals doing things, stop monkeying around with lowend mentality on the stuff, audit things truly, incorporate, clean up the standard docs, etc.

I am not even going to say, meh, but that site can't cost much to run.  Whole thing is prettied up and all, works...  People behind it should run it like the business it should be.  Fnck the advertising.  Second time at this and got slapped.  Make it meh $1-3 a month --- even the cheapest lowend company can afford that.  Enough cash to actually do real things with instead of running disinvestment fundraising scams with the email spams.

The SSL certificate I saw earlier and let it slide.  But that money I just created above, that could pay for some admin hours monthly, for someone that might give a crap about running things sanely, safely and with regard to privacy.

Spend some of that cash on EU privacy researcher / legal and get the site compliant.   One trip out on the wrong person and legal takedown really likely.

 

[Aldryic C'boas]

It fills a niche - the fact that it is far from perfect and yet still massively popular in a particular market segment is indicative of the need for something.

Sure, it indicates the need for some `providers` to actually learn how to be a proper company, and not just apply some crappy third party software to handle things they don't know how to do.  I remember a few years back everyone gave us crap because of how strict I was on anti-fraud.. but now that there's a Solus to do it for them, they're all finally trying to catch up

Seriously folks - start learning WHAT makes an order fraudulent, stop selling to any random signup to make a buck, and you won't have these problems in the first place.

 

[Jasson.Pass]

I've heard having people fax in forms of ID and credit cards cuts down on fraud like crazy

 

[rds100]

I've heard having people fax in forms of ID and credit cards cuts down on fraud like crazy

Probably. It also cuts down your customer base by 99%. Really, buying a simple hosting product should not be THAT hard in the 21st century.

 

[mitgib]

Sure, it indicates the need for some `providers` to actually learn how to be a proper company, and not just apply some crappy third party software to handle things they don't know how to do.  I remember a few years back everyone gave us crap because of how strict I was on anti-fraud.. but now that there's a Solus to do it for them, they're all finally trying to catch up

Seriously folks - start learning WHAT makes an order fraudulent, stop selling to any random signup to make a buck, and you won't have these problems in the first place.

How does solus cause or cut down on fraud?  I'm scratching my head on that one, I know you probably mean something else, but I'm not seeing it.

 

[Aldryic C'boas]

How does solus cause or cut down on fraud?  I'm scratching my head on that one, I know you probably mean something else, but I'm not seeing it.

Oh, aye, I was making a reference at FR being along the same lack of quality as Solus.

 

[MattKC]

I've heard having people fax in forms of ID and credit cards cuts down on fraud like crazy

Until a company like GVH dumps their copies of these into an open directory available to all (which GVH did and has still not reported to the necessary agencies nor directly contacted the people they just caused identity theft risk to). Of course they also use fraud record to get revenge against people they don't like by making false/misleading submissions. Another area fr needs to address, scam/fraudulent companies using their service and making false reports.

 

[PortCTL]

It's quite unfortunate that it wasn't properly secured. If anyone can simply access the file and send mass spam emails, you should consider adding something like authorization tokens, or better yet, take it out of the accessable web directories, and just execute it using php in the command line.

 

[robbyhicks]

Maxmind helps, but having a reputation directory for hosts to subscribe to with fraudulent emails would definitely be helpful. If an order gets flagged, it's pretty common practice to ask for a copy of government issued photo ID.

 

[WSWD]

Curious what @Profuse-Jim has to say about all this.  Surely he approved his services being spammed?

 

[hxQ&S8ZaVn9e]

Is there any alternative to FraudRecord being used?

 

[PortCTL]

Is there any alternative to FraudRecord being used?

Typically people use MaxMind, I am not trying to self advertise, but am building something to help prevent fraud in my billing software.

 

[DomainBop]

Spend some of that cash on EU privacy researcher / legal and get the site compliant.   One trip out on the wrong person and legal takedown really likely.

This is from a May 2014 EU opinion on anonymization techniques like hashes.  The determinant of whether the anonymized data (in the case of Fraud Record, the "hash" that is stored in the database) is considered personally identifiable information is the following:

(i) is it still possible to single out an individual,

(ii)is it still possible to link records relating to an individual, and

(iii) can information be inferred concerning an individual?

The answer to all 3 of those questions is a definitive yes where FraudRecord is concerned because all anyone has to do is a plain text search on the hashed data in the database and all 3 of those criteria are met.

TL;DR: EU hosts who transmit PII (the hashed data) to FR are most probably not compliant with EU data protection laws...especially the majority who fail to even state on their privacy policies that they transmit data to FR. .

ISO29001 says basically the same thing the EU opinion said: in order for anonymized data like a hash to be considered truly anonymous and not PII it must be anonymized in a way that it can't be traced back to a single individual (an example of true anonymized data would be aggregated traffic data that is collected from multiple people but can't be traced back to an individual).

anonymisation is also defined in international standards such as the ISO 29100 one being the “Process by which personally identifiable information (PII) is irreversibly altered in such a way that a PII principal can no longer be identified directly or indirectly, either by the PII controller alone or in collaboration with any other party” (ISO 29100:2011)

FraudRecord's use of hashes also fails the ISO29001 standard because the hashed data in the database is used to single out an individual and bring up a report on them whenever any Tom, Dork, or Harry runs a plain text search.

TRUSTe's opinion that hashes when used like FR uses them constitute PII is based on the same concepts as the EU opinion and ISO290001:2011 standard.

 

For tomorrow's lesson: why it is a violation of credit card industry rules to allow hosts to submit to FraudRecord (which isn't even a legal entity so legally they are submitting the customer's info to Harzem Y), and other to search on, the following two data fields:

ccname Name on credit card ccnumber Credit card number.

 

[drmike]

^ ---     WOW    ---^

 

[DomainBop]

^ ---     WOW    ---^

I think there's a definite need for a fraud screening service for the hosting industry but FraudRecord's implementation is very, very flawed and and as you said "One trip out on the wrong person and legal takedown really likely." 

There was a service similar to FR that also had a searchable database that many hosts used about 10 years ago called ChargebackBureau.org (the company and its database were in Panama to avoid the FTC's tentacles).  It eventually shut down after VISA/MC and the FTC leaned on it for various violations of card industry rules and US consumer protection laws.

http://www.sfgate.com/business/article/Dispute-charges-at-your-peril-2494770.php

https://www.google.com/search?q=chargeback+abuse+database&ie=utf-8&oe=utf-8#q=chargebackbureau.org+%2Bsite:webhostingtalk.com

 

[drmike]

There was a service similar to FR that also had a searchable database that many hosts used about 10 years ago called ChargebackBureau.org (the company and its database were in Panama to avoid the FTC's tentacles).  It eventually shut down after VISA/MC and the FTC leaned on it for various violations of card industry rules and US consumer protection laws.

I can't thank you enough for that gem!

"ChargeBack Bureau costs merchants $29.99 per quarter or $99.99 per year for full access to its database."

"The service claims to have more than 7,500 online merchants enrolled as members and more than 40,000 listings in its database."

[SIZE=13.63636302948px]Do the math:  $99.99/year x 7500 = $749k+[/SIZE]

[SIZE=13.63636302948px]Fraudrecord is something like 1k~ members  even at $20 per year = $20k income potential.[/SIZE]

[SIZE=13.63636302948px]All that aside, prior effort was same duck US regulators game.   They lost, same reasons.[/SIZE]

 

[rds100]

If there can be databases for credit rating / credit score and such, why there can't be other similar databases? What makes this one different from the database of bad debtors?

 

[William]

An expensive audit, primarily.