Santa Clara, Calif. - March 3, 2000 - Perfecto Technologies, the leading developer of Web Application Security Management software, today released its latest Black Watch Labs advisory which reveals how a common email system, mail.com, is vulnerable to Web application-level hacking. The mail application employs a weak security scheme. It assigns session-IDs ("tokens") for logged-in users which allow reading of arbitrary users' messages and private information, if enough effort is invested.

Two underlying free web mail applications from mail.com have been identified, however, this vulnerability pertains to only one of them. Services that use the other application are not vulnerable as far as we know. The free web mail offered to users directly by mail.com is not vulnerable. Identifying the vulnerable application can be done by checking whether the suspected application is willing to serve clients that disallow cookies (only the vulnerable application does that), and that once the user logged-in, the URLs have the "iNAME=..." trailer. If such is the case, the attack method described above is applicable. The vendor has been notified of this vulnerability and there is no patch available at this time. For technical details of this problem, please visit https://www.perfectotech.com/blackwatch/.

About Black Watch Labs (www.perfectotech.com/blackwatch/)
Black Watch Labs is a research group operated by Perfecto Technologies Inc., the leader in Web Application Security Management. Black Watch Labs was established in order to further the knowledge of the Internet community in the arena of Web application security management. Black Watch Labs publishes security advisories regularly, which are maintained at https://www.perfectotech.com/blackwatch/, and are also posted to relevant security lists and Web sites. Black Watch Labs also operates a Web application security mailing list, which can be subscribed to at https://www.perfectotech.com/blackwatch/. For more info about Black Watch Labs and Web Application Security Management, please call (408) 855-9500 or email [email protected].

About Perfecto Technologies
Founded in 1997 and headquartered in Santa Clara, Calif., Perfecto Technologies pioneered the market for Web application security management software. AppShield, Perfecto's initial product offering, is the first to provide extreme security for customer-facing applications in dynamic eBusiness environments. Customers include companies in the e-commerce, financial services, and high-tech industries. Privately held, Perfecto is funded by blue-chip venture capital firms and industry leaders, including Goldman Sachs, Intel Corporation, Sequoia Capital, The Sprout Group and Walden Israel. More information about Perfecto Technologies may be obtained by visiting the Company's web site at www.perfectotech.com or by calling the Company directly at (408) 855-9500.

For Immediate Release
Contact:

Kevin Pedraja
Sterling Communications
(408) 441-4100
[email protected]