Online Business Card Designer in Flash

[onprintshop]

-- See my other posts on these crooks --

We've now hired another company and just discovered about 5 minutes ago that Radix not only added trackers to their code, but the information they are tracking would land them in very hot water if they were located in North America. For example, they receive complete customer information of every order -- and that means they get the total amount ordered (dollar amount), the email address of the customer, the phone number, the physical address, etc.

If that's not enough to scare you away from Radix ...

I will make this my mission to warn people.

The kind of information they are (were) tracking would make it impossible to become PCI compliant.

It makes me sick to think they have a year's worth of customer information from us, and I'll bet they are selling
those email addresses and perhaps other information, too.

So you get what you pay for, and in Radix' case, you get way more than you bargained, and so does your customer-base!

We are shocked to learn for first time that your client data is being transmitted to unauthorized people. We are keen to investigate and solve serious issue, but being anonymous review, we will need your website name, contact information and details of actual incidence. We understand the feeling of insecurity can be very frustrating.

Further, take opportunity to share Radix has been providing IT solutions to clients worldwide for 13 plus years, we attribute our growth and success to our highest level of integrity and honesty towards our clients. OnPrintshop is our flagship solution, we are supporting 300 plus clients for over 7 plus years, have integrated one of the most stable PDF engines to generate high resolution print ready files. We have been exhibiting at Drupa 2012 (Germany), Graph Expo 11/12 (Chicago, USA), CEBIT Germany (10/11/12), Cebit Australia 12, and our clients and partners have recognized us as highly user friendly, flexible and affordable solution.

Moreover, our solution is covered with Legal Agreement & which clearly covers protection of your data & assets. Our core competency is technology and as a company we have no motive to capture customer’s data / information specially when company is constantly evolving solution, putting up serious investments in development, branding & marketing to expand globally.

We strongly believe that we only grow when our clients grow.

 

[CanadianPrinter]

Oh brother, you use the reply to advertise your business.

We worked with so many of your coders over the course of trying to get your application to work, that there's no way you can convince us that management isn't aware of the data theft: your coders had to be working in cahoots with management.

I think that because your price-point is affordable, you use that to bait small businesses who are likely not tech-savvy, and then steal customer data to sell it to third party spammers.

Below is a snippet of the type of information that was being sent to Radix:

DetailsHTTP/1.0 200 OK
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Date: Fri, 28 Dec 2012 22:42:44 GMT
Content-Length: 8
Connection: close

VERIFIED

The following data was received from PayPal:

mc_gross: 186.18
protection_eligibility: Partially Eligible - INR Only
address_status: unconfirmed
payer_id: XXXXXX
tax: 0.00
address_street: XXXXXXXXXXXX
payment_date: 14:42:40 Dec 28, 2012 PST
payment_status: Completed
charset: windows-1252
address_zip: XXXXX
first_name: XXXXX
mc_fee: 5.70
address_country_code: CA
address_name: XXXXXXXXX
notify_version: 3.7
custom:
payer_status: unverified
business: XXXXX@XXXXX
address_country: Canada
address_city: Toronto
quantity: 1
verify_sign: XXXXXXXXXXXXXXXXXXXX
payer_email: XXXXX@XXXXX
txn_id: XXXXXX
payment_type: instant
last_name: XXXXXX
address_state: ON
receiver_email: XXXXXX@XXXXXX
payment_fee:
receiver_id: XXXXXX
txn_type: web_accept
item_name: XXXXXX
mc_currency: CAD
item_number: XXXXXXX
residence_country: CA
handling_amount: 0.00
transaction_subject: XXXXXXXX
payment_gross:
shipping: 0.00
ipn_track_id: XXXXXXX

We recently read that Radix and Ricoh Canada have inked a deal: that is darn frightening and we hope that Ricoh have their own IT department to cross-check Radix' coding to ensure you don't track customer data.

Print shops beware!

 

[onprintshop]

OnPrintShop solution has integration with variety of payment gateway api. Payment gateway send back notification to system (website) from where payment request was generated to update / mark orders as paid.

Each payment gateway has different integration system & we need to write code accordingly.

When webpage on your site receives notification about payment done in paypal we need to verify that response was generated by paypal for this purpose system(website) sends information back to payapl and
in return system(website) receive response with text included as VERIFIED.

Referred response is what system(website) received from paypal & pulled out from system log.

Above does not show that this information has been sent to Radix.

For authenticity you can check reference code for paypal payment integration which generates similar information as well http://probing.wikidot.com/using-paypal-ipn-with-kohana

Oh brother, you use the reply to advertise your business.

We worked with so many of your coders over the course of trying to get your application to work, that there's no way you can convince us that management isn't aware of the data theft: your coders had to be working in cahoots with management.

I think that because your price-point is affordable, you use that to bait small businesses who are likely not tech-savvy, and then steal customer data to sell it to third party spammers.

Below is a snippet of the type of information that was being sent to Radix:

DetailsHTTP/1.0 200 OK
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Date: Fri, 28 Dec 2012 22:42:44 GMT
Content-Length: 8
Connection: close

VERIFIED

The following data was received from PayPal:

mc_gross: 186.18
protection_eligibility: Partially Eligible - INR Only
address_status: unconfirmed
payer_id: XXXXXX
tax: 0.00
address_street: XXXXXXXXXXXX
payment_date: 14:42:40 Dec 28, 2012 PST
payment_status: Completed
charset: windows-1252
address_zip: XXXXX
first_name: XXXXX
mc_fee: 5.70
address_country_code: CA
address_name: XXXXXXXXX
notify_version: 3.7
custom:
payer_status: unverified
business: XXXXX@XXXXX
address_country: Canada
address_city: Toronto
quantity: 1
verify_sign: XXXXXXXXXXXXXXXXXXXX
payer_email: XXXXX@XXXXX
txn_id: XXXXXX
payment_type: instant
last_name: XXXXXX
address_state: ON
receiver_email: XXXXXX@XXXXXX
payment_fee:
receiver_id: XXXXXX
txn_type: web_accept
item_name: XXXXXX
mc_currency: CAD
item_number: XXXXXXX
residence_country: CA
handling_amount: 0.00
transaction_subject: XXXXXXXX
payment_gross:
shipping: 0.00
ipn_track_id: XXXXXXX

We recently read that Radix and Ricoh Canada have inked a deal: that is darn frightening and we hope that Ricoh have their own IT department to cross-check Radix' coding to ensure you don't track customer data.

Print shops beware!

 

[CanadianPrinter]

Then why do you need a copy of the customer data? In our investigation of the database, clearly Radix is getting a copy of all Paypal information and that includes the amount, together with the customer's name, customer's email address, customer's phone number, whether or not their payment is Eligible, and a whole slew of data likely unnecessary to be sent back to Radix directly.

You can attack me all you want, but you have yet to answer why you need a copy of customer data.

You may have 300 customers, but if I were a betting woman, I'd bet that none of them had to hire another developer --- so your secret would have been kept a secret for a very long time had I not needed to release Radix of your duties on my web site.