Author Topic: Credit Card Number Easily Visible with 2 Clicks  (Read 1133 times)

bmherard

  • Beginner
  • *
  • Posts: 1
Credit Card Number Easily Visible with 2 Clicks
« on: October 27, 2010, 04:57:21 am »
I recently placed a test cc order. When looking at the order details I saw for example... 1111111111111111**** (which represents the 1st 12 of the 16 cc numbers).

then if I click to get the view for printing is see... ************1111 (which represents the last 4 of the 16 cc numbers)

Put both together and it the complete cc number just there for the taking to any hack.

I have "Store Credit Card Information?" turned on so that I can manually process recurring transactions...but it doesn't seem like I should be able to see the full cc number with only two clicks.

Please, Please, Please...some offer some advice.

Joomla 1.5.21
VirtueMart 1.1.5

IntraX

  • Jr. Member
  • **
  • Posts: 87
Re: Credit Card Number Easily Visible with 2 Clicks
« Reply #1 on: October 27, 2010, 22:18:50 pm »
This option is (legally alone) not to be used without having a PCI compliant shop, so you should never use this function for the regular VM shop. In most countries it is even illegal to store or directly process credit card payments without PCI compliance. That means you should deactivate this store credt card data function.

Not every function in VirtueMart or any other software is ready to use or even legally 100% correct as-is and to be used right away in a live site without further work, adjustments, hacks or expansion of the function, if it is simply tax related stuff or this PCI compliance.

https://www.pcisecuritystandards.org/

About the PCI Data Security Standard (PCI DSS)

The PCI DSS, a set of comprehensive requirements for enhancing payment account data security, was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. Inc. International, to help facilitate the broad adoption of consistent data security measures on a global basis.

The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. This comprehensive standard is intended to help organizations proactively protect customer account data.

The PCI Security Standards Council will enhance the PCI DSS as needed to ensure that the standard includes any new or modified requirements necessary to mitigate emerging payment security risks, while continuing to foster wide-scale adoption.

Ongoing development of the standard will provide for feedback from the Advisory Board and other participating organizations. All key stakeholders are encouraged to provide input, during the creation and review of proposed additions or modifications to the PCI DSS.

The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized:

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know
Requirement 8: Assign a unique ID to each person with computer access
Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

To further the adoption of the PCI DSS, the PCI Security Standards Council defines credentials and qualifications for QSAs and ASVs. The PCI Security Standards Council also manages a global training and certification program for QSAs and ASVs, and will publish a directory of certified providers on this Web site.