ELECTRONIC COMMERCE SOFTWARE

406
Chapter 9
that issued a particular cookie, the shopping software reads either the cookie from the customer’s
computer or the database record from the merchant’s server.
If a shopper’s browser does not allow storage of cookies, sites can use another way to
preserve shopping cart information from one browser session to another. Some electronic
commerce software packages, such as ShopSite, do this by automatically assigning
a shopper a temporary number. The number is added to the end of the shopper’s URL and
persists as he or she navigates from one Web site to another. When the customer returns, the
URL still contains the bits of information about his or her shopping cart. When the customer
closes the browser, the temporary number is discarded and thus cannot be reused,
even if the customer later reopens the browser and returns to the same Web site.
LEARNING FROM FAILURES
PDG Software
PDG Software is a company based in Tucker, Georgia, that sells electronic commerce software
to companies that operate small and midsize electronic commerce Web sites. PDG
sells shopping cart software, auction software, shopping mall software, and a number of
other packages. Although it sells some of its software directly to the companies that use
it, most of its sales are through resellers—firms that use PDG software as part of Web sites
that they design, build, and deliver to customers as complete units.
In April 2001, an attacker discovered a vulnerability in the PDG software that allowed
an intruder to enter the shopping cart and open the file that contained customer names,
contact information, and credit card numbers. PDG developed a patch that would repair
the software the same day it found out about the intrusions. PDG posted the patch on its
Web site so that companies using the software could download and install the patch. Both
PDG and the FBI issued press releases immediately to warn users of the problem with the
shopping cart software and encourage them to obtain the patch. Unfortunately, the users
of the software that had purchased it as part of a complete electronic commerce Web
site were, in many cases, unaware that their sites included the PDG shopping cart software.
Because it took so long—several months, in some cases—to find and contact the companies
using the software, online offenders had an excellent opportunity to exploit this
vulnerability and collect thousands of credit card numbers. In most cases such as this, the
difficulty of finding the sites that are running the vulnerable software helps slow down the
attackers. Unfortunately, in this case, the intruder who discovered the opening also
found that entering a specific word in a search engine’s search expression would instantly
return a list of the thousands of sites running the PDG software.
Most of the Web sites found out about the problem when their customers called them,
suspicious because their credit card information had been compromised. The lesson from
this failure is that companies that operate electronic commerce Web sites must know
the source of the software used in creating and maintaining their sites and must monitor
news about the security of that software.