Stupid security things

#1

Post by troyhunt » Fri, Apr 28, 2017, 10:31 AM UTC

Re: Stupid security things

#2

Post by Neliquat » Fri, Apr 28, 2017, 2:15 PM UTC

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

Re: Stupid security things

#3

Post by saulrh » Fri, Apr 28, 2017, 2:28 PM UTC

I've seen the "Express " vuln before, but with people's SSNs, DOBs, and bank account numbers, plus sequential numeric user IDs instead of emails. It's fixed now, thankfully, but, uh, yeah.

Re: Stupid security things

#4

Post by djtriptych » Fri, Apr 28, 2017, 2:32 PM UTC

That "What is the name of your grandmother's dog?" security question made me lol @ work.

This really makes me want to write a "Stupid security questions generator" website.

Re: Stupid security things

#5

Post by systems » Fri, Apr 28, 2017, 2:33 PM UTC

this is a bit hard to read with all the screenshots/images, headings , sub-section

i think the author is knowledgeable, but .. please make it more readable

Re: Stupid security things

#6

Post by nojvek » Fri, Apr 28, 2017, 2:33 PM UTC

Neliquat wrote: post #2

The number of webmasters who wanted me to set up ssl to 'secure' their site, while the backend emailed cc info in the clear to the orders dept is larger than I have digits, even the extra adolecent joke ones.

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

Re: Stupid security things

#7

Post by bungie4 » Fri, Apr 28, 2017, 2:34 PM UTC

Programmer (not me!) manually iterates over user file (passwords plain text natch). If he finds a matching username (format is enforced so dead easy to guess). He sets the auth cookie. THEN he goes looking for the password. You don't have to enter any password. At that point, just hit the back button a couple of times and refresh and BING! You can impersonate anybody on the system. Including the admin because guess what the admin's username is.

This guy is notorious for writing crap like this. But according to the powers that be, he's a 'god'.

The funnier bit? This site is RSA protected.

Re: Stupid security things

#8

Post by CM30 » Fri, Apr 28, 2017, 2:38 PM UTC

Some of this stuff is absolutely terrifying. I mean, using the last four digits of a mobile number as a password? Damn, it's a site where a leaked username list is literally a major data breach.

LOL at 'reducing virus noises' too.

Re: Stupid security things

#9

Post by gry » Fri, Apr 28, 2017, 2:43 PM UTC

…and more. https://twitter.com/PWTooStrong

Re: Stupid security things

#10

Post by bArray » Fri, Apr 28, 2017, 2:43 PM UTC

@troyhunt: Have you seen the latest leak by Atlassian?

I got an email on 4th April, 2017 that reads as follows:

    Hello,
    
    This weekend, our Security Intelligence Team detected an incident
    affecting HipChat.com that may have resulted in unauthorized
    access to user account information (including name, email address
    and hashed password). Atlassian ID is used to manage access to
    your HipChat.com account and other Atlassian services you use.
    The password is encryprted using bcrypt with a random salt. In
    our security investigation, we found no evidence of unauthorized
    access to financial and/or credit card information. We can also
    confirm that we have found no evidence of other Atlassian systems
    or products being affected.
    
    As an added precaution, we have reset your Atlassian ID which is
    used to access all Atlassian services, including HipChat. Please
    go to https://id.atlassian.com/login/resetpassword and enter your
    email address to trigger a password reset email for your Atlassian
    ID account. If you have been using your Atlassian ID password on
    other sites, services or online accounts, we recommend that you
    immediately change those passwords as well.
    
    Please refer to the HipChat Blog at http://blog.hipchat.com for
    additional information about this incident. We regret any
    disruption this may have caused and appreciate your immediate
    attention. If you have questions, please do not hesitate to
    contact HipChat Support via our support portal or by sending email
    directly to support@hipchat.com.
    
    – Ganesh Krishnan, Chief Security Officer

Nice of them to provide links to reset your password - anyone quick on their feet and with access to that database could have got people's passwords.

I think if you tweeted at them they would release an email list to you for updating the https://haveibeenpwned.com/ website. I imagine there's still a lot of people that are unaware that their details are out there and that their accounts are vulnerable.