The Daily WTF: Curious Perversions in Information Technology

2006-02-11 Reply Admin

Oh SURE it is.. .NET allows any abacus-toting moron to think they're a computer scientist.

Thanks, Microsoft!! *-)

Richard Nixon · 2006-02-11 Reply Admin

George Bezel:

You can't be serious. If so, you are a bigger hypocrite than I thought.

George, name-calling won't get you anywhere with me. Furthermore, I'd appreciate it if you kept your cursing private messages to yourself. I honestly don't understand why you thought it was okay to use such language in this forum which many access from work.

sincerely,
Richard Nixon

c-- · 2006-02-11 Reply Admin

Richard Nixon:
George Bezel:

You can't be serious. If so, you are a bigger hypocrite than I thought.

George, name-calling won't get you anywhere with me. Furthermore, I'd appreciate it if you kept your cursing private messages to yourself. I honestly don't understand why you thought it was okay to use such language in this forum which many access from work.

sincerely,
Richard Nixon

Oh, boo hoo.

Suddenly, Mr. Nixon is the lone voice of maturity and reason, standing up for what he believes in. I don't have to cover anyone who should be doing work in the first place. If it's OK with them to not do their job, I trust they can deal with whatever consequences arise.

I'll be glad to apologize to anyone who was seriously offended, but not to someone who does nothing but troll around looking for grammatical and spelling errors.

brazzy · 2006-02-12 Reply Admin

Anonymous:
One of the reasons I've never bothered to learn PHP is that I was at an introductory talk once, and the sample code had a password check which set a variable (let's call it 'auth') to 1.

"So, what if you put 'auth=1' on the end of the URL?"

The speaker tried it, and it worked... PHP helpfully mixes program-supplied and user-supplied variables.

It used to, by default. But they realized years ago how dangerous that was and changed the default behaviour:
http://de3.php.net/manual/en/security.globals.php

DrCode · 2006-02-13 Reply Admin

Anonymous:

But it's not a signature... You'll notice there is no short horizontal line above it.

I don't know of any nice way to put this. You have gone insane. Please report to the nearest asylum for commitment.

Tweenk · 2006-09-04 Reply Admin

Anonymous:
If there are security holes in the first examples new programmers see, it'll always be an uphill struggle from there on out...

When you write crap code, you get nonexistent security, and it doesn't matter what language are you using. Adding "$auth = false;" at the top or "else $auth = false;" after the conditional would fix everything. Checking a value of an uninitialized variable raises a warning, so if the guy cared enough to test what happens if he inputs a wrong password, he would see it. It really isn't that difficult to write secure PHP code, even with register_globals on. There are lots of functions to aid this (i.e. mysql_real_escape_string, pg_escape_string, addslashes, mysqli->prepare, etc.) and manual topics on this.

GeekMessage · 2006-09-04 Reply Admin

ferrengi:
I must be missing something here. How is LOGGED_ON=NO a security hole and how does changing it to LOGGED_ON=YES help?

It's an obfuscated (as in, less blatantly obvious) version of the classic admin=false.

If I understand the point of the original post correctly, anyone can make a donation anonymously (without logging on), but admins have to log on in order to see the credit card numbers of the donors, and process the received donations...

mnature · 2006-09-05 Reply Admin

Anonymous:
I think the real WTF here, is most obvious from the screen shot.

What kind of Web Developer would dream of using IE? That's just nuts! An outdated Mozilla build? ok, a Firefox 1.0 build? yeah, ok, even an Opera Install would have shown some apptitude for the task, but IE... yeah, only if you don't want to debug your applications, or build something Web 2.0.

That said just curious, for all the Developers on this forum, except for those doing IE-only .ActiveXXXNet stuff, what Browser do you use? Anyone already shaking their heads at the Beta2 of IE7 (oh man that's a LOOOOOONG way from a stable, public release)

Elf 17

I downloaded the beta of IE7. I was impressed. It took all of fifteen minutes before I deleted it from my computer.

I had a bet with myself that it wouldn't even run.

I use IE because all of the web-sites at work require it. Of course, I had to set security so high that the Disney site is about the only one that loads without warnings.

chrisg67 · 2006-09-11 Reply Admin

It's a good job he hadn't tried using POST requests as that would have hidden the LOGGED_ON=NO, and made the problem less visible. I have seen this used as a way of avoiding the admin=false problem.

It really doesn't take much more to break that one either.

Also seen a site where it stores your username as a cookie and uses that for authentication - so set your own cookie and off you go.

2007-05-24 Reply Admin

Your childish diatribes are ok at work i assume...

2008-01-20 Reply Admin

A Wizard A True Star:
I think I know where this guy is working now: http://www.inetonsite.com/onsite/default.asp?ADMIN=False

Changing ADMIN=False to ADMIN=True actually works, although administration mode does nothing useful other than just a "Exit Adminstration" function, most of the clients listed have no entries (and administration mode does not seem to let you add entries), some do and the ones that do, once you try to edit it does require a password, so it is still secure, although selecting them in non-administration mode does nothing useful either. They say it has pictures but in reality there are no pictures.

2008-11-14 Reply Admin

I worked at a company that had the same "technic" to provide security to webpages...

When i explained my worries about the security issues the answer i got was that the user would have to be a good hacker to figure this out. that solution worked for them in the past and they still continue to use this "technic"

COBOL_SECURITY

Leave a comment on “COBOL_SECURITY”