A few weeks ago something happened that wouldn't change how a small company in Vienna thinks about security: My windshield cracked
I just had it changed less than 6 months ago and it cracked again. Since I didn't want to pay the 300€ again I googled for cheaper alternatives and found a small car parts seller in Vienna that had my windshield for just 98€
While I was browsing for my new windshield and other parts I saw that some images didn't load right so I checked the console in my browser and saw that my ad blocker just blocked some piwik (now matamo) tracking script from another domain.
Just to be sure I disabled the ad blocker and reloaded the site to see if anything changed.
Hmm.. interesting.. the site seems to have some error and the tracking script can't be loaded.
Or.. could it be..
Sooo.. I bought the domain netdiscoverer.eu and now this site (and it turns out a whole bunch of others) are loading scripts from my domain.
Now if somebody would be childish and would put these lines of code in a file called piwik.js the site would suddenly change.
document.body.style.backgroundColor = "red"
var imgs = document.getElementsByTagName("img");
for(var i=0, l=imgs.length;i<l;i++){
imgs[i].src = "http://3.bp.blogspot.com/-KL7d7LdSANg/Tm5VLQf9k4I/AAAAAAAAACo/cSV52JoD7vk/s1600/cat-wallpaper-34-713472.jpg";
};
alert("Please fix this site");And would look a bit different
But since I'm a responsible IT security person I didn't do that.
Back to the windshield
In order to buy the windshield I had to make a down payment via their website. They have a button "Paypal down payment" where customers have to click which sends them to a paypal.me site where they have to pay and put their phone number to be called back.
Oh boy anyone could have bought the netdiscoverer domain and redirected users to another site to pay. Glad I found it before anyone else did.
So I make the down payment, they call me back, I drive to their shop to pick it up and have a whole speech prepared about the importance of IT security and how to find good people to maintain websites, etc but reality got me off guard.
What did they say about this?
I talked to the mechanic, gave them the rest of the money, they gave me the windshield and then I asked who was in charge of their website. He said it was their "IT freak" but he wasn't around.
I asked if I could get the phone number of the person in charge or if he could get them on the phone for me because their website has a massive flaw but it's easy to fix.
"So you hacked us? No, I won't give you the number."
-Mechanic
He said he won't give me the number of their IT person so I left my card and said it's very urgent, they should call me ASAP.
I packed my windshield and drove off slightly annoyed in their reaction.
Half a month later I still didn't get that call and their site is still loading scripts form my servers. You thought the 8th word in my first sentence of this post was a typo? Nope, this country (Austria) doesn't have any kind of urgency when it comes to IT security. I have learned that a few times already.
Comment using SSH! Info
