Groupon subsidiary leaks 300K logins, fixes fail, fails again

Digital discount site Groupon is well known in the USA, but operates through subsidiaries in other parts of the world. The company recently acquired Indian digital discount operator SoSasta, which operates a separate India-specific website under the SoSasta name.

If you're not familiar with the idea, you bid via the site to buy discounted items: mail-order underwear in St John's, Canada, for example; or a meal at the Hilton Hotel in New Delhi, India.

Once a minimum quota of bids is reached, all bidders get charged at the discounted price.

Of course, bidding via the site means that you need an account with the site, which means a username and password. That means the site needs an authentication system.

And that's where SoSasta fell down.

Earlier this week, Sydney security researcher Daniel Grzelak - the guy I wrote about last week who opened the handy password-breach-checking site shouldichangemypassword.com - was doing Google searches with a range of terms crafted to spot potential database leakage.

Read more: Naked security
QR:

Posted via email from Jasper-net