April 03, 2001, 4:06 PM — Here’s a really silly problem that could be a major issue for your Web site: Hackers changing prices when they buy.
The way it works is pretty simple. You’re selling, say, a book for $14. The hacker saves the page that submits the purchase to the shopping cart and edits the price to, say, $1.40 in the saved page, and then uses a browser or HTML editor to publish the page to the URL that accepts the form.
The result for many sites is an erroneous shopping cart that can be processed as if it were real. Worse still, price alterations are often not caught when the basket is checked out -- indeed, the fraud may not be detected until the next audit!
So, make sure your Web ordering system checks prices as items are added to the shopping cart and then check them again on checkout.
Let me know if your Web site is immune to this problem, and if that’s because you’ve been caught by this hack. I promise not to tell anyone.
