• a2800276 (unregistered) in reply to uncool

    Hey! how come you know my PIN?
       -tim

  • belugabob (unregistered) in reply to ptomblin

    ptomblin:
    At one job I had, we had a backdoor password that was the first three letters of the current day of the week, backwards.  We had to change it to '*' because the idiot field circus couldn't remember the original backdoor.  Or couldn't spell the days of the week, more likely.

    It would have been easier to remember if you'd made it the last three letters of the current day of the week, forwards.[:D]

  • CE (unregistered)
  • (cs) in reply to CE
    Anonymous:


    Warning: not safe for work (adult content)
  • (cs) in reply to travis

    "Oh, come on.  What are the odds someone would figure this out?  Big deal."

    Can I add another vote to the "big deal" pile? Looks like it might just be me and Sean though.

    Let's stick another server out there with this hole in it and see how long it takes to get abused. And how come no-one has asked how important the assets behind this are? Maybe it's a 386 with last week's lottery results on? Who gives?

  • fullstop (unregistered) in reply to Dum dum dum....
    Anonymous:
    Anonymous:
    <insert-large-corporation-name-here>

    Interestingly enough, "12345".equals(new Integer(12345)); will return false.
    In java at least.
    </insert-large-corporation-name-here>


    I don't see why that's interesting. Why would a String be equal to an Integer that happens to have the value of numbers in the String? And if you expect it to be the same, why use a base 10 decimal, and not, say Hex? "12A45"... etc, etc.


    Well, I figured that if the object types were not the same, it would do a toString() first to compare them.

    I looked at the Java source, and Integer can only equal other Integers.  Any other object will return false.  A BigInteger, Double or Float can not be equal.  Not even if they are 0!  They are all numbers (minus the string example), but they can not be equal to each other.


    I understand the whole numerical precision thing, and maybe they should not be comparable.. but there is something about the java primitive wrappers that bug me.



  • george doesn't comprehend (unregistered) in reply to George

    *** quote *** Any dictionary hacker who doesnt try "god","backdoor","root" and "admin" as possible usernames deserves a WTF of their own *** quote ***

    Careful george, your lack of understanding is showing.

    'backdoor' is not a username in this case. Dictionary attacks are not the problem here as someone already tried to explain to you.

  • (cs) in reply to DisturbedSaint

    Alex,

    Care to provide a link to this guy's "last place"?  I'd like to...um...take a look at their website....

    -ds

    Now THAT IS funny!

  • (cs) in reply to Strydyr

    What about

    www.domain.com?paula=BRILLANT

     

    [Y]

  • (cs) in reply to kipthegreat

    Go man!

    I am with you!

    But, let's not forget the wonderful GOOD that has come from those years and years of Government lies.

    I mean, we would not have Velcro if it was not discovered among the wreckage at Roswell!!!!

     

    <tongue in cheek>

  • (cs) in reply to CE
    Anonymous:

    'Hairless Galleries', WTF???

  • (cs)

    All I have to say is ... [:S]

  • (cs) in reply to hank miller
    hank miller:
    Ever been locked out of your own system because you forgot your own password?


    Never happened, but that's why Gnoppix has mount(8) and vim(1)... :)


  • Mark (unregistered) in reply to ferrengi
    ferrengi:
    kipthegreat:
    Manni:
    WTF Batman:
    Anonymous:

    Hank - "We ship products with backdoor passwords. They are 10 random digits, and only internal support knows them - we don't tell customers."

    That is a really bad idea - If I was a customer and I found out you had a backdoor I would be really, really upset.



    Bah, people have suspected Microsoft of having backdoors in Windows for years. Supposedly, there's also government code in Photoshop to prevent counterfeiting.

    Dunno how true this stuff is, but it seems at least plausible. Backdoors may already be a fact of life in the products you use every day. Don't like it? Use FOSS. Don't like FOSS? I guess you're stuck. *shrug*

    I would say the Photoshop rumor is probably a legitimate one. Y'know, considering that it was a featured story in Wired last year and you can read all about it on the Adobe website here.



    And don't get me started on the holocaust, moon landing, trail of tears, and 9/11.  All government lies!

    (that's satire, not a serious comment)


    I know you're just kidding around about this last part but to the best of my knowledge, governments didn't do a damn thing about the holocaust. They knew it was going on at least since 1942 and could've easily dropped a few bombs and derailed some of those trains and at least slowed those nazi maniacs down a little bit. Not only that, the US and other countries also sent people who managed to escape back to where they came from so that they could get killed.


    Some of us, on the right side of the Atlantic, were fighting the Nazis since 1939; doing all we could to more than 'slow those nazi [sic] maniacs down a little bit.' Maybe if the US had relaxed it's traditional laissez-faire foreign policy earlier some of the horrors of the holocaust could have been avoided.

    I'm sorry, it just always annoys me when I hear American's boast about how they 'saved our asses' in WWII. I realise you didn't say that, but just be a bit more careful when you say 'governments didn't do a damn thing'.

    Alright, who's up for a rousing chorus of Rule Britania?

    Mark
  • (cs) in reply to DrCode
    DrCode:
    kipthegreat:
    Anonymous:

    Hank:
    We ship products with backdoor passwords. They are 10 random digits, and only internal support knows them - we don't tell customers.

    That is a really bad idea - If I was a customer and I found out you had a backdoor I would be really, really upset.



    I agree, I hope the customers weren't concerned with security ....  There are other ways of hacking things besides a dictionary attack.  Like disassembling your binaries (which is especially easy in Java--not that I'm saying you used Java.. but if you did..).


    You mean Hank and not today's WTF, right?  Because I'd really like to know how you would disassemble the binaries of a web app.

    Well we ship an appliance with a web front end, not have customers loginto out website.. So our customers get hardware, they don't come to our site.

    We have had customers call us up and ask why we used a particular OS. Since we disabled the screen they only way to find the OS out is to put the harddrive in a different computer. So we know for a fact that some customers to look at the binaries. Thus we take pains to obscure our binaries (starting by not using Java). We also don't sell to anyone stupid enough to admit they disassembled our box. (Not to mention registering copyrights)

    The backdoor does not work from the web frontend. It is a different port (ssh) that is easy to firewall. In our experience most customers do have it firewalled, removing protection only if we need to debug their machine (presumably if they forget their password as well).

    Our password will not appear an any dictionary. Even a computer will not guess it. (Too many digits, and the only way to crack it is attempt a log in. Login intentionally uses a non-optimal password checker so that you cannot brute force the password that way)

    It is not perfect I will agree, but it isn't that bad, so long as we manage who knows this password carefully.

  • (cs) in reply to a2800276
    Anonymous:
    Hey! how come you know my PIN?
       -tim


    Forget your PIN, I want to know how they know the code to my luggage!

  • (cs) in reply to merreborn

    merreborn:


    Notably, two used 'banana' -- one of which was for a girl named anna, the other, a jana.  And of course, one kid used 'secret'.

    To all the annas and janas out there: for the love of god, don't use banana for a password.

    Years ago, I was working as both a sysadmin and doing tech support at a state college. For some reason, I'd been discussing security with one of my non-technical (but quite cute) coworkers, when she interrupted me with, "I have the best password in the world. Wanna know what it is?"

    Two conflicting desires: one, to maintain some level of professionalism and say, "No! Don't tell me your password! Ever!" ; two, to satisfy my morbid curiosity.  The better angels won out, but I was halfway through my standard "don't ever tell anyone, including me, your password" speech when she cut me off.

    "I don't care," she said, cheerily, "I trust you. It's 'peanut.'"

    Good on you for the extra credit. Where I was, I had to defend one of my interns when he accidentally discovered that some numbnut in the academic computing department had installed SubSeven on one of Public Safety's computers, and left it running, WITH THE DEFAULT USERNAME AND PASSWORD.

    Naturally, that guy is now the head of IT security for the college.

  • (cs) in reply to witch
    witch:
    Anonymous:

    Anonymous:
    What's the big deal? We did that all the time when I worked for professor Falken
    on the WOPR project. As far as I know there was only one meddling kid who managed
    to sneak in -- and even then, it wasn't REALLY global thermal nuclear war. 

    Cute kid, really. 

     

    "Would you like to play a game?"



    That should have been 'Shall we play a game?'

    Also, it should have been "global thermonuclear war." Three words, not four.

  • cj (unregistered) in reply to Pete
    Anonymous:
    Anonymous:
    probably the same guy that uses 1234 for a pin number


    Isn't that the sort of combination an idiot keeps on his luggage?  :D

    or on his planet's air so nobody can vacuum it out...
  • (cs) in reply to sammybaby
    sammybaby:

    merreborn:


    Notably, two used 'banana' -- one of which was for a girl named anna, the other, a jana.  And of course, one kid used 'secret'.

    To all the annas and janas out there: for the love of god, don't use banana for a password.

    Years ago, I was working as both a sysadmin and doing tech support at a state college. For some reason, I'd been discussing security with one of my non-technical (but quite cute) coworkers, when she interrupted me with, "I have the best password in the world. Wanna know what it is?"

    Two conflicting desires: one, to maintain some level of professionalism and say, "No! Don't tell me your password! Ever!" ; two, to satisfy my morbid curiosity.  The better angels won out, but I was halfway through my standard "don't ever tell anyone, including me, your password" speech when she cut me off.

    "I don't care," she said, cheerily, "I trust you. It's 'peanut.'"

    Good on you for the extra credit. Where I was, I had to defend one of my interns when he accidentally discovered that some numbnut in the academic computing department had installed SubSeven on one of Public Safety's computers, and left it running, WITH THE DEFAULT USERNAME AND PASSWORD.

    Naturally, that guy is now the head of IT security for the college.

    Which guy is now head of IT - the intern or the numbnut? (Do I even need to ask?)

  • (cs) in reply to DrCode
    DrCode:
    Anonymous:
    What's the big deal? We did that all the time when I worked for professor Falken on the WOPR project. As far as I know there was only one meddling kid who managed to sneak in -- and even then, it wasn't REALLY global thermal nuclear war.


    Malvin: I can't believe it, Jim. That girl's standing over there listening and you're telling him about our back doors?

    Jim Sting: [yelling] Mister Potato Head! Mister Potato Head! Back doors are not secrets!

    Malvin: Yeah, but Jim, you're giving away all our best tricks!

    Jim Sting: They're not tricks.



    Better slap a footnote on that post before you get nailed for plagarism there, chief.
    http://us.imdb.com/title/tt0086567/quotes
  • David (unregistered) in reply to WTF Batman

    On 95 & 98 it was the escape key. There's still a workaround on most XP systems. It has you setup an administrator user account with password on first boot, but it leave the password of the user "Administrator" blank. So you just reboot into safe mode (if the system uses the XP Welcome screen that hides Administrator), and XP will normally let you log in as administrator with a blank password unless the user realized it was blank and changed it.

  • David (unregistered) in reply to David

    Forgot to quote

    WTF Batman:
    Bah, people have suspected Microsoft of having backdoors in Windows for years. Supposedly, there's also government code in Photoshop to prevent counterfeiting.

    Dunno how true this stuff is, but it seems at least plausible. Backdoors may already be a fact of life in the products you use every day. Don't like it? Use FOSS. Don't like FOSS? I guess you're stuck. shrug

    Anonymous:
    On 95 & 98 it was the escape key. There's still a workaround on most XP systems. It has you setup an administrator user account with password on first boot, but it leave the password of the user "Administrator" blank. So you just reboot into safe mode (if the system uses the XP Welcome screen that hides Administrator), and XP will normally let you log in as administrator with a blank password unless the user realized it was blank and changed it.

  • (cs) in reply to fullstop

    Anonymous:
    Anonymous:

    Yes, assuming the type (in this case java.lang.String) supports the Object.equals contract, which it does. Those who babble about performance implications from multiple invocations of a method are yet to learn about HotSpot compilation and premature optimisation (HotSpot is better at inlining method invocations than you).
    <INSERT-LARGE-CORPORATION-NAME-HERE>


    Interestingly enough, "12345".equals(new Integer(12345)); will return false.
    In java at least.
    </INSERT-LARGE-CORPORATION-NAME-HERE>

    Why is that interesting?  "12345" is a string and new Integer(12345) is an Integer.

  • (cs) in reply to hank miller
    hank miller:

    We have had customers call us up and ask why we used a particular OS. Since we disabled the screen they only way to find the OS out is to put the harddrive in a different computer.


    http://www.insecure.org/nmap/nmap-fingerprinting-article.html
  • Worf (unregistered) in reply to Rank Amateur
    Rank Amateur:

    zzz123:
    As of 6-8 months ago, your standard inkjet printer/scanners at Best Buy worked just fine on US bills.  I used a crisp $20 to test out half a dozen models I was considering buying.

    I had seen the documentary on a rock show promoter travelling around Illinois passing copied bills, and the comment from the Secret Service that all "modern" copiers had protections against it.  I was curious if it was true.  Maybe on bigger business copiers, but not these cheap things...

    Maybe the protections he was referring to are the hidden identification codes some printers print that allow the Secret Service to match a counterfeited bill to a printer.

    http://www.schneier.com/blog/archives/2005/10/secret_forensic.html

    (snip)


    Actually, they're looking for a 5-dot constellation image that's printed on most currency these days. It consists of a center dot, and 4 dots around it. I believe that if you take the two dots opposite each other and the center dot, they're all in a line.

    Of course, this page has even more information on the methods as well -
    http://www.cl.cam.ac.uk/users/sjm217/projects/currency/

    So it's protection built into the design of the currency, plus software used to detect it.

    Time to download a copy of SANE. Open-source scanning libraries and apps are going to get banned soon since they can't incorporate this code...

    As for detecing the OS, besides using nmap to identify the OS (a perfectly legitimate use of it, after all, sometimes more interesting services are found that way on network appliances), often the general operation can give away the OS. For example, if web pages start having ".asp" extensions, you can be sure the appliance runs some form of Windows, and if you get cgi-bin/someapp.pl, well, it's likely a Unix flavor of some sort (typically BSD or Linux).

    Heck, you don't even need to use nmap! Just use Ethereal and your web browser (or other method) to get the HTTP headers. HTTP headers often leak this information (check out Netcraft, if you don't believe me).

    Getting the OS is quite easy without "hacking" into the device.
  • (cs) in reply to sammybaby
    sammybaby:

    I'd been discussing security with one of my non-technical (but quite cute) coworkers, when she interrupted me with, "I have the best password in the world. Wanna know what it is?"

    ...

    "I don't care," she said, cheerily, "I trust you. It's 'peanut.'"



    Okay, I missed something. The real WTF here would be her explanation of why she thought that was "the best password in the world".

    Oh, and she was totally hitting on you, dude. :)

  • (cs) in reply to ammoQ
    ammoQ:
    http://www.insecure.org/nmap/nmap-fingerprinting-article.html

    That can tell you linux or FreeBSD or Windows, but it cannot tell mandrake vs RedHat. The customer was interested in why we choose mandrake. They were mad that we choose a motherboard made in Tiawan, instead of one made in Korea (where the customer was from - or I should say ex customer).

    While the code was perl, we had setup the web server so that the .pl was not part of the url, and the customer made it clear they were reading our perl code.

  • (cs) in reply to Brendan Kidwell

    Meh. I usually just rely on keeping an account with privledges to the password file. If you have that, you can go in and 'reset' a password by deleting it, unless a brightboy programmer makes it automatically throw out zero-length passwords.

    I once had to go in and hack root on a unix machine, then run a SQL injection on mysql so I could get in and change a password on a system where the "administrator" had managed to lose every single password that would allow him to do anything. Then, when I got done, I ended up doubling the bill because they had the audacity to complain that I'd had to take the system down for 10 minutes while I was removing the root password.

    Used to know a guy who always installed a rootkit on all the machines he deployed that would email him the root password everytime it changed. On the one hand, this is bad and evil, on the other hand, when the jokers routinely forget the root password, and you don't live in the same town...What else can you do?

  • Barefoot (unregistered) in reply to uncool

    You mean 1-2-3-4-...5! as a code for your suitcase! ;)

  • George (unregistered)

    I see the WTF; it's one that really irritates me:

    if (request.getParameter("backdoor") != null
          && request.getParameter("backdoor").equals("secret"))

    should just be:

    if ("secret".equals(request.getParameter("backdoor")))

    See?  No need for the null check, and the extra getParameter() call. Are these guys paid by the line or something?
    On the security side: good thing they put a password on their back door.  Not sure why they didn't just make it "password", though.

  • Someone (unregistered)

    O, come on, what's wrong with this client-side JavaScript?

  • (cs) in reply to gravey
    gravey:
    DrCode:
    Anonymous:
    What's the big deal? We did that all the time when I worked for professor Falken on the WOPR project. As far as I know there was only one meddling kid who managed to sneak in -- and even then, it wasn't REALLY global thermal nuclear war.


    Malvin: I can't believe it, Jim. That girl's standing over there listening and you're telling him about our back doors?

    Jim Sting: [yelling] Mister Potato Head! Mister Potato Head! Back doors are not secrets!

    Malvin: Yeah, but Jim, you're giving away all our best tricks!

    Jim Sting: They're not tricks.



    Better slap a footnote on that post before you get nailed for plagarism there, chief.
    http://us.imdb.com/title/tt0086567/quotes


    Two questions: First, what is "plagarism"?  And, second, wouldn't it be the copyright holder that I would get in trouble with, and not the IMDB?  (Although, of course, I did look the exact quote up on IMDB.  Anyway, fair use and all that.)

  • n00blet (unregistered) in reply to nullptr
    Anonymous:
    Not only does he include this nastiness, but he also uses a pet peeve pattern of mine (and a consistently great indicator of a crappy developer) -- not using a variable to store the result of a lookup (getParameter). Why, WHY do all crappy developers always do this?


    He also used a pet peeve of mine: redundant null checks. Reverse the equals() and the condition is reduced to
    if ("secret".equals(request.getParameter("backdoor"))
  • Roy J (unregistered) in reply to Brian H

    Look at the code, of course!

  • SnarkSnark (unregistered) in reply to ptomblin

    Isn't the first three letters of the day of the week backwards always going to be 'yad' ? 

  • ELIZA (unregistered) in reply to ferrengi

    Please, please, please tell me it wasn't Diebold

  • Sallyovavy (unregistered)

    I recently started using CBD oil to avoid manage my dread and https://organicbodyessentials.com/blogs/skincare-blog/what-does-toner-do-for-your-face emend my log a few zees z's quality. I be compelled say, it's been a game-changer for me. The lubricator is undemanding to practise, with just a few drops protection the in fun, and it has a mild, harmonious taste. Within a occasional minutes, I can deem a nous of calm washing beyond me, which lasts representing hours. My snooze has improved significantly; I perish asleep faster and wake up instinct more rested. There's no grogginess or side effects, neutral a candid, quieting effect. Highly praise quest of anyone looking to manage forcefulness or update their sleep.

  • JamesAbece (unregistered)

    Trying https://www.nothingbuthemp.net/online-store/THC-Tinctures-c142300582 has been perfectly the journey. As someone fervent on spontaneous remedies, delving into the to the max of hemp has been eye-opening. From THC tinctures to hemp seeds and protein puissance, I've explored a miscellany of goods. Teeth of the disarray adjoining hemp, researching and consulting experts receive helped journey this burgeoning field. Entire, my sophistication with hemp has been favourable, gift holistic well-being solutions and sustainable choices.

Leave a comment on “C'mon, There's Nothing Wrong With That!”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article