Auction Software Security Evaluation For Exploits

[thehoodedcoder]

I got into a very particular conversation about max bids with SimpleAuctionSite and how they protect the auction houses from seeing or obtiaing the max bids. The answers I got back didn't leave me warm and fuzzy. They were standoff-ish even as I repeatedly said I would be interested in helping ensure that no one could exploit their software, should something come up.

I can understand the hesitation but I was not asking for much, only a high level explanation of how they do it and I could not even get that.

I liken the request to that of online poker sites publishing their shuffling algorthim. If you are proud of it, and its better than anyone elses, show it off and explain why its better, more safe and give some confidence behind it.

As a security analyst if someone uses their software I would be interested in evaluating that to determine if some one could unethically circumvent the system and obtain max bid information and then publishing the results of that and then HELP them get the problem fixed.

It would be helpful if I could simple see what is provided to the auction house for administration of their auction(what code might have exploits in it) and how the software is implimented into the companies website, so i can see what database exposure their is to data table they might not be allowed to see.

Additionally, something that no one else seems to mention (NOW KEEP IN MIND I AM NOT SAYING THAT THIS IS HAPPENING IN ANY CAPACITY), is that since companies such as this take a percentage of auctions, their is motive their to shill up their auction houses bids. Theoretically it is possible that this can occurr so it can not be excluded from the thought process.

I am not limiting myself to SimpleAuctionSite and im not singling them out although they do appear to be the biggest? or am i wrong about that?

I would be interested in evaluating any software an auction house uses. If you run auction software and would let me take a peek that would be appreciated. Contact me via email please.

Kevin