On Tuesday, Mathias Schindler VTO (full text search online).
A PowerPoint presentation linked from the VTO's homepage contained the password to the Beta site, and the site itself only protected its book pages with some JavaScript that disables the right mouse button (a non-protection, actually, which the browser allows to circumvent through a variety of simple means).
Mathias was able to download a complete copy of a current German bestselling book, which was quite delicate considering the company behind VTO supported a lawsuit against Google Book Search because Google allegedly didn't protect well against the downloading of book texts.
statement regarding Mathias' report - I won't comment on the specific arguments put forth, as I believe Mathias' extensive research continues to speak for itself:The security of data and texts in the "full text search online" system is guaranteed and of highest priority. This was announced by the MVB, opposing previous statements of the Book Report Express publication, which cited tests of a so-called watch blogger who said he found "security holes" in the system. "VTO delivers a maximum security service for publishers," director of MVB Ronald Schild says. Only the contents which have been provided to be made available freely will be accessible by users. (...)
Through a regrettable error, the internal user name and password were temporarily available as "authorized account." Using these credentials it was easy to find access to the VTO test system. The MVB already took action and exempted project coordinator Theodor Brggemann from his job. New passwords will be issued to the participating publishers.
During the test phase, the system contained a few texts which were intentionally provided without limitations for sample purposes. According to Schild, "This kind of access to texts is not possible when the VTO system runs in normal mode." Unlike these full texts from the test phase, the publisher will usually limit the scope of texts which made available.When faced with Mathias' report, MVB's Schild previously told no holds barred HTML injection vulnerability on the homepage of the MBV/ BoeV.
Del.icio.us | Digg | Reddit | Furl About the Author
Philipp Lenssen from Germany, author of Google Blogoscoped
No comments yet. Be the first to comment!