Below is an exchange I had with a market research company about the web survey software they were using. The message on the end just about covers it all. I left the link in to the page because the password had been changed as of today.
Sent: 16 May 2008 10:33 a.m.
Subject: PLEASE PLEASE PLEASE
----- Original Message ----
From: Perceptive <email@example.com>
Sent: Thursday, May 15, 2008 4:24:13 PM
Subject: RE: PLEASE PLEASE PLEASE
Can you please advise who you are and how you obtained information regarding
our site password?
Who I am doesn't even come close to matter unless you want to thank me for not trashing your site and possibly saving you from a lawsuit.
I did a search on Yahoo! for "ClassApps", the people that wrote the SelectSurvey software you use, and found that page. It was on the first page of the results too!
The default admin user name and password for the software is "admin", "admin". Anyone in the world could guess that. It just so happens I've used the software and know for a fact that the software ships that way. When I saw the familiar opening page I just thought I'd give it a try. I was shocked when it worked.
I can't believe that anyone with a functioning brain would leave production software with critical company information for your customers wide open like that. And you have balls to call your product SurveySafe?
What really sucks is that you have been collecting data using that software for years and it's been open the whole time. Anyone could have easily stolen the data and be using it against the people that are your customers.
Someone deserves a tongue thrashing. That would include the management that supervises the admin that didn't make sure that changing passwords was part of the process.
One other little bug: If you follow the link at the bottom of this page, and scroll to the bottom of the next page, there is a link to a demo survey. If you click that link another browser opens to start the survey. It fails once you try to go to the next page.
Just a note: We have been evaluating SelectSurvey software I really like what I've seen in it. The people from ClassApps have been very helpful too.
If you're a slave to your free associations, does it automatically become something else?