He said that what he called Dalco's poorly configured Windows NT 3.5 server allowed his team to gain high-level administrator access to the unencrypted databases. He said on Thursday that he had since erased all of the data from his own machine without passing it on to anyone, but could not speak for the other two crackers involved. One security expert said that leaving so many invoices in plaintext on a machine connected to the Internet was almost an invitation to disaster. He said that a better procedure would be to process online orders and then immediatley erase them. But then what most companies do is they turn around and email it plaintext to themselves or store it in databases that, if someonce can get access to, are very vulnerable.
Big companies can do that but the little guy can get overwhlemed.
Another network administrator agreed that smaller e-commerce Web sites were more vulnerable to attack. While they are encrypting credit cards sent over the Net, they are not necessarily encrypting it on the server. They store it, someone gets in, and away they go.