MoviePass,www.порнография гимнастки украинки the cinema subscription service that's gone from "This is too good to be true" to "What is even going on I'm so tired" in a series of reinventions, has had another setback.
The company left thousands of customer card details, and tens of thousands of customers' credit card details, visible on a server that was not password protected, according to a security research firm.
The database, which a reporter from TechCrunch observed "growing in real time," contained more than 161 million records and counting, ranging from logging details generated in the course of a normal running day to unencrypted user details. Credit or debit card details were available, too, including card numbers, expiration dates, cardholder names, and billing addresses in plaintext.
MoviePass customer cards are basically MasterCard-issued debit cards; customers pay the monthly fee, and the service loads up the cards with the price of a movie ticket when a screening is booked, so subscribers can then buy them at the box office with the card.
(A MoviePass card could technically be used to make any debit purchase, users theorise, although it would get the account holder banned pretty swiftly.)
This Tweet is currently unavailable. It might be loading or has been removed.
The unprotected dataset was detected by systems developed by Dubai-based firm spiderSilk, and confirmed manually by the firm's security team before they notified MoviePass, which did not respond.
Security researcher Mossab Hussein told Mashable while his team can't tell for sure whether the database had been accessed by other parties, they estimate the number of credit cards that could be exposed in the dataset runs into the tens of thousands, in addition to around 50,000 MoviePass cards.
SEE ALSO: A new limited MoviePass offer comes close to the tantalizing original plan"Simple best practices should have prevented any of this from happening in the first place," Hussein said. "But we see a lot of companies not worrying as much as they should, when it comes to 'internal tools' and 'internal logging.' And they justify this by saying something along the lines [of] 'Oh, it's only for internal use and analysis.'"
Mashable has contacted MoviePass's parent company Helios + Matheson for comment on the exposure, including the reasons why the database was only taken offline after TechCrunch notified them of the issue and not when Hussein reached out over the weekend.
"We've seen companies that took 30 days to acknowledge a finding, and we've also seen companies that acknowledged and patched a finding within 60 minutes," Hussein said. "But our position has always been very strict about this topic. Companies panic and respond in seconds if their apps are down ... they should treat the safety of their customer data just the same."
Topics Cybersecurity
Building a Small Form Factor Gaming System with the Silverstone Sugo SG10 and Haswell Hardware
SCHOOL DAZE: How COVID Impacts Education — Prison Literacy Program Adapts During COVID Lockdowns
Nisei Week 2020
Statement from Little Tokyo Community Council
PlayerUnknown's Battlegrounds (PUBG) CPU Test
City Council OKs Expansion of Go For Broke Ground Lease
Shoot Ogawa Among Magicians on This Week’s ‘Masters of Illusion’
New Report Gives Breakdown, Details of Anti
NASA says Earth just had the hottest day ever recorded
Hinamatsuri: A Family Affair
Best Shark FlexStyle deal: Save $100 for a limited time via Best Buy Drops
Hinamatsuri: A Family Affair
Sheriff’s Department Under Fire After Remarks Sympathetic to Gunman
House Judiciary Subcommittee Hearing on Anti
What cracked the Milky Way's giant cosmic bone? Scientists think they know.
Atsuko Okatsuka’s ‘Ohayo’ on Aug. 30
AAPIs Urged to Report Hate Incidents
Seal Beach Police Investigating Threatening Letter Sent to Asian Woman
Nvidia's DLSS Second Take: Metro Exodus Investigation
Haruo Takehana Receives Commendation of Consul General
9 of the most horrifying talking animals in cinema, including 'Cats'Company says it can extract email addresses and passwords from locked iPhonesLyft incorrectly flags users with real names, like Dick, as offensive9 times somebody (seemingly) farted at a really bad time'Astronomy Club' on Netflix is a true holiday giftThe best video games to play with your family over the holidaysAnother Trump phone security failAll our burning questions after 'The Rise of Skywalker'This new EV has a 'California mode,' and it's as chill as it soundsHuawei to unveil new foldable phone, the Mate Xs, in February 2020 An iPad mini with a larger display might be coming and I'm very excited Everything coming to (and going from) Netflix in June 2020 Turns out 'Red Dead Redemption 2' is a perfect platform for work meetings Need a book rec? Here are 9 recent ones we loved Netflix starts to bring streaming quality back to normal Here are the best cheap headphones for working out and daily life Use these five free Google Meet features to get the best video calls 'Paddington' villain Hugh Grant eats humble marmalade for a good cause Thousands of medical device manuals uploaded to help with repair Student describes the ‘90s as 'the late 1900s' and now we all feel old
2.0717s , 8110.046875 kb
Copyright © 2025 Powered by 【www.порнография гимнастки украинки】Enter to watch online.MoviePass left customers' credit card numbers exposed on unprotected server,
