• Unauthenticated user (unregistered)

    Hey look! Anyone at all can comment on this post without registering!

    Perhaps I should set up a cURL script to post a 'frist' commen... ah drat. Captcha: erat. "I don't erat this security configuration"

  • ZoomST (unregistered)
    Story:
    On the other end was one of the clients' site administrators, and she was not calling to congratulate him on getting their site taken off the host's blacklist.
    Have you tried turning it off and on again?
  • WTF (unregistered)

    TRWTF is calling adding a htaccess file "hardening"

  • agbeladem (unregistered) in reply to WTF

    It DOES make me hard.

  • That admin guy (unregistered) in reply to WTF
    WTF:
    TRWTF is calling adding a htaccess file "hardening"

    Could be worse, they could have used the system's user database to store users. Anyone who had created an account on the website was able to ssh into the web server and get a shell.

  • freneticFerret (unregistered) in reply to That admin guy
    That admin guy:
    WTF:
    TRWTF is calling adding a htaccess file "hardening"

    Could be worse, they could have used the system's user database to store users. Anyone who had created an account on the website was able to ssh into the web server and get a shell.

    Isnt that how SingleSign On works?

  • Iggy (unregistered)

    error 401; access to comments denied

  • That admin guy (unregistered) in reply to freneticFerret
    freneticFerret:
    That admin guy:
    WTF:
    TRWTF is calling adding a htaccess file "hardening"

    Could be worse, they could have used the system's user database to store users. Anyone who had created an account on the website was able to ssh into the web server and get a shell.

    Isnt that how SingleSign On works?

    If the accounts were stored in a shared database, yes, but these were stored in /etc/passwd and that file was in turn rsync'd to the other web servers. Accounts were eventually moved to an LDAP server specifically set up for the web servers and implemented some kerberos-like features to implement SSO.

  • faoileag (unregistered) in reply to WTF
    WTF:
    TRWTF is calling adding a htaccess file "hardening"
    TRWTF is not noticing that moving a htaccess file up a few directory levels is hardening.

    Apart from that - what's wrong with htaccess? It's working, I do not recall any news that the system has been compromised, and if you use it your chances to accidentally implement a broken authorization system yourself are greatly reduced :-)

    Ok,it's ugly, but hey. Beauty lies in the eye of the beholder.

  • faoileag (unregistered)

    As a who-dunnit the story is a bit weak. I suspected the moved htaccess file as soon as I read "no one could register for events through the Drupal calendar".

  • Tink (unregistered)

    I frist read it as "talented legacy". Then I realised my mistake...

    CAPTCHA: duis: duis not reading correctly tonight.

  • (cs) in reply to Unauthenticated user

    Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing?

    Addendum (2014-04-30 08:22): Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing (yet still feeling smug about his technical prowess)?

  • foo AKA fooo (unregistered) in reply to faoileag
    faoileag:
    As a who-dunnit the story is a bit weak. I suspected the first part of the story as soon as I read the second part of the story.
    ORLY? Your a genius.
  • (cs) in reply to faoileag
    faoileag:
    Apart from that - what's wrong with htaccess? It's working, I do not recall any news that the system has been compromised, and if you use it your chances to accidentally implement a broken authorization system yourself are greatly reduced :-)

    This is.

    ...Although granted, it wouldn't surprised me if this story involved shared hosting.

  • foo AKA fooo (unregistered) in reply to OzPeter
    OzPeter:
    Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing?

    Addendum (2014-04-30 08:22): Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing (yet still feeling smug about his technical prowess)?

    If by "it" you mean TRWTF I'm also wondering. Problem fixed, the client even thanking him, what is this, The Daily Quite A Success?
  • Chris Allen-Poole (unregistered)

    TRWTF is Drupal.

  • faoileag (unregistered) in reply to kilroo
    kilroo:
    faoileag:
    what's wrong with htaccess?
    This is.
    Point taken.

    That's what I like about the comments section of TDWTF - chances are high that if you put something up for discussion you get some meaningful replies.

  • Rick (unregistered)

    I'm not sure why people are having trouble spotting TRWTF here. The original developers intentionally left the administration section unprotected to work around the fact that their curl call was failing authentication. They left themselves fully exposed because they couldn't figure out how to make their home-made Drupal module work. If I was on Slashdot a car analogy would be expected, so here goes:

    This is like finding that the radio you added to your car doesn't work with the ignition key removed, so to make it work you leave your car unlocked and running at all times.

  • Pants (unregistered)

    As a Drupal developer I find it annoying how sometimes Drupal gives administrators the tools to shoot themselves in the foot. The example in this article being the ability for anyone to create an account without admin approval.

    We have come across clients who INSIST that they be able to use something called a "Full HTML filter". This essentially allows the user to publish a page with any html structure they desire... including un-tokenized forms allowing for CSRF, malicious javascript, broken HTML structures that break the page, etc...

    Now we just disable that particular filter and tell them it doesn't exist.

  • mara (unregistered)

    The real WTF is that the admin thanked him. but that may just have been wishful anonymisation.

  • (cs) in reply to Chris Allen-Poole
    Chris Allen-Poole:
    TRWTF is Drupal.

    i am failing to understand the motive behind this comment. what is wrong with Drupal? So many sites including Telugu newspaper sites are also using it.

  • (cs) in reply to Rick
    Rick:
    I'm not sure why people are having trouble spotting TRWTF here. The original developers intentionally left the administration section unprotected to work around the fact that their curl call was failing authentication. They left themselves fully exposed because they couldn't figure out how to make their home-made Drupal module work. If I was on Slashdot a car analogy would be expected, so here goes:

    This is like finding that the radio you added to your car doesn't work with the ignition key removed, so to make it work you leave your car unlocked and running at all times.

    In very cold places like Siberai, you have to do that.

  • (cs)

    Curl! The nightmares!

    That diabolically tool designed to do everything from HTTP-downloads to encrypted FTP-uploads over firewalls with SOCKS5-authentification to transferring rings into mount doom in Mordor via RFC1149 carrier pigeon protocol.

    The endless list of options - sorted alphabetically by their shortest commandline option, making it impossible to find the option at the place where you expect it:

           --pubkey <key>
              (SSH) Public key file name. Allows you to provide your public key in this separate file.

              If this option is used several times, the last one will be used.

       -P/--ftp-port 
    
              (FTP) Reverses the default initiator/listener roles when connecting with FTP. This  switch  makes  curl
              use  active  mode.  In  practice,  curl then tells the server to connect back to the client's specified
              address and port, while passive mode asks the server to setup an IP address and port for it to  connect
              to. 
...

    Looking for options related to FTP-transfers? Of course don't forget looking in the P-section!

  • Bob (unregistered) in reply to Rick
    Rick:
    This is like finding that the radio you added to your car doesn't work with the ignition key removed, so to make it work you leave your car unlocked and running at all times.
    Good, but omits the detail where they'd written their own CMS too. So it's more like leaving the car running and the window down so that they can hear the radio while sitting in their adjacent home-made go-cart.
  • Rick (unregistered) in reply to Nagesh
    Nagesh:
    Rick:
    I'm not sure why people are having trouble spotting TRWTF here. The original developers intentionally left the administration section unprotected to work around the fact that their curl call was failing authentication. They left themselves fully exposed because they couldn't figure out how to make their home-made Drupal module work. If I was on Slashdot a car analogy would be expected, so here goes:

    This is like finding that the radio you added to your car doesn't work with the ignition key removed, so to make it work you leave your car unlocked and running at all times.

    In very cold places like Siberai, you have to do that.

    That Siberia as a region is so cold is a common myth (you can check Wikipedia for a monthly temperature chart.) My mom spent most of February in Siberia about five years ago. She said it's no different than Iqaluit or the Northwest Territories here in Canada, and was only a little colder than Ottawa (where we're from.) Typical Ottawa winters have overnight lows around -30C to -35C, with the windchill reaching -45C to -50C. Any car parked outside has a block heater that you plug in, which keeps the engine block warm enough to start. Gas has antifreeze added to keep it fluid to -65C, and you can do the same with the oil if necessary (I just use a thinner grade.) We also use remote car starters - that starts the car's engine without unlocking it or requiring a key in the ignition. So while it's true the engine is running, the doors, steering wheel and gear shift are all still locked.

    To be honest, TRWTF is living in a climate like this...

  • (cs) in reply to Rick
    Rick:
    That Siberia as a region is so cold is a common myth (you can check Wikipedia for a monthly temperature chart.) My mom spent most of February in Siberia about five years ago. She said it's no different than Iqaluit or the Northwest Territories here in Canada, and was only a little colder than Ottawa (where we're from.) Typical Ottawa winters have overnight lows around -30C to -35C, with the windchill reaching -45C to -50C.[…]

    To be honest, TRWTF is living in a climate like this...

    There are parts that are worse due to interesting local effects, but in general yes, it's the very act of living such climates that is TRWTF…

  • (cs) in reply to no laughing matter
    no laughing matter:
    Looking for options related to FTP-transfers? Of course don't forget looking in the P-section!

    Or look for the "/" key and then type "ftp". If that doesn't jump immediately to the section you want, press "n" until it does.

    If you are reading man pages through a web browser then locating the "find" command is left as an exercise for the reader.

  • Scourge of programmers. (unregistered) in reply to foo AKA fooo
    foo AKA fooo:
    faoileag:
    As a who-dunnit the story is a bit weak. I suspected the first part of the story as soon as I read the second part of the story.
    ORLY? Your a genius.

    you're

  • Scourge of programmers. (unregistered) in reply to Rick
    Rick:
    Nagesh:
    Rick:
    I'm not sure why people are having trouble spotting TRWTF here. The original developers intentionally left the administration section unprotected to work around the fact that their curl call was failing authentication. They left themselves fully exposed because they couldn't figure out how to make their home-made Drupal module work. If I was on Slashdot a car analogy would be expected, so here goes:

    This is like finding that the radio you added to your car doesn't work with the ignition key removed, so to make it work you leave your car unlocked and running at all times.

    In very cold places like Siberai, you have to do that.

    That Siberia as a region is so cold is a common myth (you can check Wikipedia for a monthly temperature chart.) My mom spent most of February in Siberia about five years ago. She said it's no different than Iqaluit or the Northwest Territories here in Canada, and was only a little colder than Ottawa (where we're from.) Typical Ottawa winters have overnight lows around -30C to -35C, with the windchill reaching -45C to -50C. Any car parked outside has a block heater that you plug in, which keeps the engine block warm enough to start. Gas has antifreeze added to keep it fluid to -65C, and you can do the same with the oil if necessary (I just use a thinner grade.) We also use remote car starters - that starts the car's engine without unlocking it or requiring a key in the ignition. So while it's true the engine is running, the doors, steering wheel and gear shift are all still locked.

    To be honest, TRWTF is living in a climate like this...

    So what exactly is stopping you people from moving to warmer climes?

  • Valued Service (unregistered) in reply to foo AKA fooo
    foo AKA fooo:
    OzPeter:
    Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing?

    Addendum (2014-04-30 08:22): Is it the original CMS team doing a hack to allow their code to work?

    or is it Eddie making a "fix" without understanding the consequences of what he was doing (yet still feeling smug about his technical prowess)?

    If by "it" you mean TRWTF I'm also wondering. Problem fixed, the client even thanking him, what is this, The Daily Quite A Success?

    TDWTF succinctly put.

    The site was not configured correctly so the cms could work correctly using the method of securing the site. So they changed which portion of the site was secured to avoid the cms error. This opened up the vulnerable portion of the site to anyone and their grandma. Enabling the public to use the site as their own content host. (As well as opening up the server to anything you could imagine).

    All to avoid correctly implementing the security of the site.

  • (cs) in reply to Scourge of programmers.
    Scourge of programmers.:
    foo AKA fooo:
    faoileag:
    As a who-dunnit the story is a bit weak. I suspected the first part of the story as soon as I read the second part of the story.
    ORLY? Your a genius.
    you're
    genious
  • foo AKA fooo (unregistered) in reply to Scourge of programmers.
    Scourge of programmers.:
    So what exactly is stopping you people from moving to warmer climes?
    Laziness? I hear many people are working towards moving warmer climates towards themselves instead.
  • foo AKA fooo (unregistered) in reply to Zylon
    Zylon:
    Scourge of programmers.:
    foo AKA fooo:
    faoileag:
    As a who-dunnit the story is a bit weak. I suspected the first part of the story as soon as I read the second part of the story.
    ORLY? Your a genius.
    you're
    genious
    OLRY!
  • foo AKA fooo (unregistered) in reply to no laughing matter
    no laughing matter:
    Curl! The nightmares!

    That diabolically tool designed to do everything from HTTP-downloads to encrypted FTP-uploads over firewalls with SOCKS5-authentification to transferring rings into mount doom in Mordor via RFC1149 carrier pigeon protocol.

    Pah! Where's gool ol' "--butterfly" when you need it?

  • ¯\(°_o)/¯ I DUNNO LOL (unregistered)

    I prefer to call that decade the "Two Kays".

    After all, it seemed like every maker of annual sports games (except the Madden series) used "2Kn" (where n is the last digit of the year) in the name of their games. It's easy to pronounce and sounds a lot less stupid than "noughties", which sounds like something out of a Monty Python sketch.

    I'll leave the problem of what to call the decade of 2100-2109 to a future generation.

  • (cs) in reply to ¯\(°_o)/¯ I DUNNO LOL
    ¯\(°_o)/¯ I DUNNO LOL:
    I'll leave the problem of what to call the decade of 2100-2109 to a future generation.

    Good advice. I doubt that any of us yakking it up now will be concerned about this 'trivia'. Then again, you might want to write suggestions down on a piece of paper and hide it away for a grandkid to see.

    It was kinda like calculating leap years. I noted (last century) that it could be simplified to (Y % 4 == 0) for my lifetime and I wasn't going to worry about the extraneous permutations that Pope Gregory established back in the day.

    We now return you to the normal discussion of Frist and friends.

  • (cs)

    why hasn't anyone realized that TRWTF is PHP?

  • Carl (unregistered) in reply to Chris Allen-Poole
    Chris Allen-Poole:
    TRWTF is Drupal.
    Truer words have never been converted to binary.

    Just take a look at the database structure sometime. It will make you barf.

    Clearly, whoever designed the database barfed all over their design worksheet and then implemented what they saw, complete with the barf.

    My god, it's filled with barf!

    Plus, it allows people who think "web design" means picking the right color to appear slightly competent to those who are even more ignorant.

  • (cs)

    But it's sooooo much easier without all that authentication nonsense.

    Sigh.

    I had this coworker who set up servers for various purposes. I swear I heard him, at least once a week, explain to some luser that, "No. The server must have a password. I realize it's harder to access, but it must be password protected." Etc.

  • Anon (unregistered)

    Somebody alluded to this already, but TRWTF is Eddie making a significant change, and then not bothering to test any of the common use cases.

    Captcha: genitus. Eddie must consider himself quite the genitus.

  • (cs) in reply to Anon
    Anon:
    Somebody alluded to this already, but TRWTF is Eddie making a significant change, and then not bothering to test any of the common use cases.

    Captcha: genitus. Eddie must consider himself quite the genitus.

    "You told me that you wanted to block all of the spam bots, but you didn't say that you wanted to keep access for everyone else!"

  • (cs) in reply to Carl
    Carl:
    Just take a look at the database structure sometime.
    On a lark, I did look at an ERD for Drupal 5 (https://drupal.org/files/issues/Drupal5RC1_Database_0.png).
    Carl:
    Clearly, whoever designed the database barfed all over their design worksheet and then implemented what they saw, complete with the barf.
    I'm surprised someone can barf a mostly normalized schema with indexes. Presumably it's structured to serve the software's design goals. I couldn't ask for much more in a database.
    Carl:
    Plus, it allows people who think "web design" means picking the right color to appear slightly competent to those who are even more ignorant.
    A hallmark of good software is that ignorant users remain ignorant of just how much work the software is actually doing for them.
  • (cs) in reply to WTF
    WTF:
    TRWTF is calling adding a htaccess file "hardening"

    hard titty access

  • Tom (unregistered) in reply to DCRoss
    DCRoss:
    no laughing matter:
    Looking for options related to FTP-transfers? Of course don't forget looking in the P-section!

    Or look for the "/" key and then type "ftp". If that doesn't jump immediately to the section you want, press "n" until it does.

    If you are reading man pages through a web browser then locating the "find" command is left as an exercise for the reader.

    Exactly. Whenever you find yourself doing something tedious manually, stop a moment and reflect whether you have a computer available somewhere. If you do, ask yourself whether you've learned how to use it to automate tedious work, like wading through massive series of bytes looking for a certain combination. You should never be doing that yourself. Get a slave to do it for you. Get a computer. And a clue.

  • Carl (unregistered) in reply to Loose Bree
    Loose Bree:
    Carl:
    Just take a look at the database structure sometime.
    On a lark, I did look at an ERD for Drupal 5 (https://drupal.org/files/issues/Drupal5RC1_Database_0.png).
    Carl:
    Clearly, whoever designed the database barfed all over their design worksheet and then implemented what they saw, complete with the barf.
    I'm surprised someone can barf a mostly normalized schema with indexes. Presumably it's structured to serve the software's design goals. I couldn't ask for much more in a database.
    I could ask that it not use two whole tables for each attribute. Usually all the attributes that go together would simply be columns in a single table. But maybe that was how we did it back before we knew how to be cool.

    Oh and then there was the Drupal "developer" I overheard saying "We'll create a user table for each new user who comes to the site, and copy over their default settings from the generic user table." Yeah. Too bad that never took off. I was soooo looking forward to setting my browser not to take his cookies, putting reload-every on 5 seconds, and overflowing his disk the same day he went live.

  • Duke of New York (unregistered)

    If you find a business-critical system that is not properly secured

    • STOP
    • DON'T TOUCH IT!
    • Tell an adult.

    Definitely do not just lock it down on the spot. Someone could get hurt.

  • anonymous (unregistered) in reply to dkf
    dkf:
    Rick:
    That Siberia as a region is so cold is a common myth (you can check Wikipedia for a monthly temperature chart.) My mom spent most of February in Siberia about five years ago. She said it's no different than Iqaluit or the Northwest Territories here in Canada, and was only a little colder than Ottawa (where we're from.) Typical Ottawa winters have overnight lows around -30C to -35C, with the windchill reaching -45C to -50C.[…]

    To be honest, TRWTF is living in a climate like this...

    There are parts that are worse due to interesting local effects, but in general yes, it's the very act of living such climates that is TRWTF…
    So TRRWTF is making plans to move to this exact place, given that you live on a warm climate where even snow would be a damn rare event? Like I'm doing now?

    Well, I give you my reason... quality of life, security. Just that.

  • That admin guy (unregistered) in reply to Duke of New York
    Duke of New York:
    If you find a business-critical system that is not properly secured - STOP - DON'T TOUCH IT! - Tell an adult.

    Definitely do not just lock it down on the spot. Someone could get hurt.

    Exactly, if the company wanted to pres charges against whoever hacked the system, you just tampered with evidence. Plus you might have overlooked something and now you'll get blamed for any future compromises on the systems. It is best to just disconnect the machine from the network and await orders from your supervisor.

  • Duke of New York (unregistered) in reply to That admin guy
    That admin guy:
    Duke of New York:
    If you find a business-critical system that is not properly secured - STOP - DON'T TOUCH IT! - Tell an adult.

    Definitely do not just lock it down on the spot. Someone could get hurt.

    Exactly, if the company wanted to pres charges against whoever hacked the system, you just tampered with evidence. Plus you might have overlooked something and now you'll get blamed for any future compromises on the systems. It is best to just disconnect the machine from the network and await orders from your supervisor.

    Which part of "Don't touch it" did you not understand?

  • Friedrice The Great (unregistered) in reply to ¯\(°_o)/¯ I DUNNO LOL
    ¯\(°_o)/¯ I DUNNO LOL:
    I prefer to call that decade the "Two Kays".

    After all, it seemed like every maker of annual sports games (except the Madden series) used "2Kn" (where n is the last digit of the year) in the name of their games. It's easy to pronounce and sounds a lot less stupid than "noughties", which sounds like something out of a Monty Python sketch.

    I'll leave the problem of what to call the decade of 2100-2109 to a future generation.

    They might call it the "Drowned Decade," especially if they live in one of today's warm climates, like southern California or Polynesia.

Leave a comment on “cURLing Up With a Good Hook”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article