[ insider_reports_insider ]
Houston Chronicle Clueless On User Privacy
David Utter
Staff Writer
2007-02-27
 Insider Reports RSS Feed
A publicly available area on the Houston Chronicle's website allowed visitors to easily view text and spreadsheet files containing names, addresses, phone numbers, and emails of contest entrants.
 | | Houston Chronicle Clueless On User Privacy |  |
What appears to be an improperly configured Apache web server allowed us to pull up a page on the Houston Chronicle site that the public should not be able to access.
The page contains dozens of spreadsheets and text files containing details on people who enter the newspaper's movie-related contests. Those documents are dated as far back as April 2006.
A selection of files we viewed contains the information listed above. One file, related to a Justin Timberlake contest for tickets to his March 4th show, has over 3,800 entries updated as recently as February 26th.
The presence of all these files isn't the only security issue for whoever the so-called webmaster is for the Chronicle's website. Their web server helpfully returns details about itself at the bottom of the page: Apache version, modules in place, and operating system.
That information could be of use to an attacker who is up to date on whatever current vulnerabilities exist for those technologies. In a humorous bit of irony, the Chronicle has a fraud page where they advise the reader "Always exercise extreme caution when asked to provide any personal information to unknown sources over the phone, fax or Internet."
Although the information about this can be found online, we are choosing not to publish the path to the page containing the contest entrant files here. Chronicle readers who have entered contests at the website since April 2006 may wish to express their feelings to the paper's ombudsman.
UPDATE: 24 hours later, the page has finally been removed from the Chronicle's website. We had forwarded the URL in question to their webmaster and ombudsman addresses, but did not receive a response about the issue.
---
Tag: Houston Chronicle
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
