• Anonymous (unregistered) in reply to TomCo
    TomCo:

    yo ku de ki ma shi ta ! !

    <FONT face="Courier New">-- evening, night clause outflow tree rub, scrape city who </FONT>

    "ba ka ya ro u" wa nan de su ka

    <FONT face="Courier New">-- "ba sent, oder question mark furnace u" I, me, oneself, self, ego what outflow to do sent, oder </FONT>

    Ahhh, now I understand. [^o)]  _jokes_

    The nihonAlert() was just a way for me to show that developers can shout at the "user" in more than just plain old English.  Hope I did not offend with my rough & rusty romanji. [:^)]

    <FONT face="Courier New">yoku dekimashita = well done</FONT>

    <FONT face="Courier New">"bakayarou" wa nan desu ka? = what's "bakayarou"?</FONT>

    <FONT face="Courier New">bakayarou = idiot</FONT>

  • (cs) in reply to Anonymous
    Anonymous:
    TomCo:

    <FONT face="Courier New" color=#ff0000 size=6>nihonAlert('BAKKA YA RO!!!!');</FONT>

    FYI: ???? (?????) is romanized as bakayarou, not "bakka ya ro".

    This forums software supports Japanese in posts? OMG! How the hell?

    (Must be some sort of side-effect of ASP.net, I suppose; I can't imagine Tellegent bothering with something like that of their own accord...)

  • (cs) in reply to Sean
    Sean:
    This makes me want to start keeping my money under my mattress.


    Has anyone heard about what is currently happening in Austria with BAWAG, the 3rd largest bank in Austria,?
  • UTU (unregistered) in reply to makomk

    This is way out of the scope of the subject but here goes...

    makomk:
    Anonymous:
    FYI: ???? (?????) is romanized as bakayarou, not "bakka ya ro".


    This forums software supports Japanese in posts? OMG! How the hell?

    (Must be some sort of side-effect of ASP.net, I suppose; I can't imagine Tellegent bothering with something like that of their own accord...)



    After having succesfully designed and developed a multilanguage system I've noticed that doing that is actually a lot easier than creating a system where only some language(s) work. It really requires you to do "something" to disable languages, but little next to nothing to support them. Doing it correctly, on the other hand, is a bit trickier, that must be granted, but the theory behind multilanguage UI is actually a lot more of not doing some charset dependent input testing like $whatever =~ /^[a-z\ ]+$/ but instead using character classes like $whatever =~ /^[:ALPHA::SEPARATOR:]+$/ ... the first example messes up on most languages other than english, the second one does not. And it wasn't really all that hard after all :)


    Oh yes, and I hate double-entering the CAPTCHA's... (first time: APPRENTICE, now: ANALYSIS... how suiting is that)

  • (cs) in reply to TomCo
    TomCo:
    It's been a long while since I had to translate, so I had this site do it for me:

    http://www.animelab.com/anime.manga/translate

    Here's what I got in return (using the "translate" button).

    yo ku de ki ma shi ta ! !

    <font face="Courier New">-- evening, night clause outflow tree rub, scrape city who </font>

    "ba ka ya ro u" wa nan de su ka

    <font face="Courier New">-- "ba sent, oder question mark furnace u" I, me, oneself, self, ego what outflow to do sent, oder </font>

    Ahhh, now I understand. [^o)]  _jokes_


    I'd love to have a look at how that site works. I have a feeling that to someone who actually knows Japanese, it would be just as much of a WTF as some of the code here. Honestly, that thing is apparently about as useful as pulling random words out of a Japanese dictionary. With babelfish the result at least usually has a vague resemblance to the correct translation. That site most definitely can NOT <font face="Verdana, Tahoma, Georgia, Arial, Helvetica, sans-serif" size="2"><font color="#000000" face="Verdana, Tahoma, Georgia, Arial, Helvetica, sans-serif" size="2">"translate simple phrases or give you the general subject of a sentance</font></font>", not even close. sentance indeed.

  • (cs) in reply to brazzy
    brazzy:
    TomCo:
    It's been a long while since I had to translate, so I had this site do it for me:

    http://www.animelab.com/anime.manga/translate


    I'd love to have a look at how that site works. I have a feeling that to someone who actually knows Japanese, it would be just as much of a WTF as some of the code here. Honestly, that thing is apparently about as useful as pulling random words out of a Japanese dictionary. With babelfish the result at least usually has a vague resemblance to the correct translation. That site most definitely can NOT <font face="Verdana, Tahoma, Georgia, Arial, Helvetica, sans-serif" size="2"><font color="#000000" face="Verdana, Tahoma, Georgia, Arial, Helvetica, sans-serif" size="2">"translate simple phrases or give you the general subject of a sentance</font></font>", not even close. sentance indeed.


    <grin> it's probably what they use (in reverse) to generate subtitles and instruction manuals?

  • anonymous (unregistered) in reply to Bus Raker
    Bus Raker:

    This isn't a WTF.  The security assessment company was surely being tested by this firm to see if they knew what they were doing.

    LOL [:D]

    And couldn't be bothered logging in, because:

    1. I was interested in what the captcha was
      1. orange the first time when I got the <FONT color=#ff0000>CAPTCHA Validation Incorrect </FONT><FONT color=#000000>message.</FONT>
      2. ZORK
      3. platinum (I'm obviously failing the test, and must be a machine)
    2. I figured if I was going to end up posting a corrupted block quote months after the last post in the thread, I may as well be

    annonymous

  • GJP (unregistered)

    ... some clever mind (or company) once created this "software". What happens after the Assestment company tells you, you've got the worst written, most unsecure web-app ever? Do you sue the builders of this web-app? Chop their heads off?

    I've seen projects go misserably wrong (though never this bad!): 1,5 year of development with 8 persons straight down the drain with absolutely nothing yo show for it. I was really surprised that noone got fired or demoted or anything. "That didn't go to well.... wanna give it a go at another project?".

  • (cs) in reply to UTU
    Anonymous:
    After having succesfully designed and developed a multilanguage system I've noticed that doing that is actually a lot easier than creating a system where only some language(s) work. It really requires you to do "something" to disable languages, but little next to nothing to support them.


    Can't agree there. Too many libraries and fundamental things like entire languages still take it for granted that the charset is an ASCII derivative or assume that a character = one byte (like, for example, the C spec). Therefore, it becomes rather difficult to AVOID doing one of the numerous things that will break compatibility with languages that use non-ASCII charsets. It gets much worse when you have to deal with varying charsets where you have to make conversions and have to know which charset you're dealing with in order to do it correctly.
  • (cs) in reply to Maximilianop

    "Really, why is it companies keep hiring 2 bucks per day programmers to handle costumer data.... THAT is a WTF itself... The rest is WTF by inheritance."

    is that someone who plays dressup a lot? :-)

  • (cs)

    "ViewStatement.jsp - Responsible for displaying electronic versions of the monthly statements, this page was always called with a single querystring parameter: StatementId. And because StatementIds were sequential ... you can pretty much see where that went."

    I think I'm misunderstanding something here, is there a dangerous security issue relating to sequential ID's in a database?  Can someone explain the WTF in this statement?  I get all the other deplorable wtf's in there though, don't you worry...

  • (cs) in reply to Azkoyen
    Azkoyen:
    "ViewStatement.jsp - Responsible for displaying electronic versions of the monthly statements, this page was always called with a single querystring parameter: StatementId. And because StatementIds were sequential ... you can pretty much see where that went."

    I think I'm misunderstanding something here, is there a dangerous security issue relating to sequential ID's in a database?  Can someone explain the WTF in this statement?  I get all the other deplorable wtf's in there though, don't you worry...


    Without further checks, it's too easy to guess other StatementIds. Large random generated ids might help a bit, but double-checking "has the user currently logged in user the right to see the statement" is the way to go.
  • shad0w (unregistered) in reply to Bill

    Oh darn, I do these security audits for living and this example is just marvelous. The first thing you do when auditing is checking the cookie contents. This audit could be finished in less than 15 minutes if you know where to start from.

    This is definitely a WTF story since these examples don't show up anymore so often. You could go to hotscripts.com and download almost any web shop software and get tested and more secure solution from there.

    We did encounter a couple of these examples earlier on but haven't really seen anything this stupid in a few years. And that's quite a few audits ago. LOL.

  • (cs) in reply to ammoQ
    ammoQ:
    Azkoyen:
    "ViewStatement.jsp - Responsible for displaying electronic versions of the monthly statements, this page was always called with a single querystring parameter: StatementId. And because StatementIds were sequential ... you can pretty much see where that went."

    I think I'm misunderstanding something here, is there a dangerous security issue relating to sequential ID's in a database?  Can someone explain the WTF in this statement?  I get all the other deplorable wtf's in there though, don't you worry...


    Without further checks, it's too easy to guess other StatementIds. Large random generated ids might help a bit, but double-checking "has the user currently logged in user the right to see the statement" is the way to go.


    Personally, I would never trust pseudo-random record id's to protect data, and if I ever caught someone doing that, I'd brain them with a shovel.  This site has really opened my eyes to the true nature of modern bad code, and the fact that it's a lot more widespread than any one person could ever know!

    btw, this forum software is ack!  It's the content that matters though, not the server software...
  • (cs) in reply to Azkoyen
    Azkoyen:


    Personally, I would never trust pseudo-random record id's to protect data, and if I ever caught someone doing that, I'd brain them with a shovel.


    If the random generator is really good, the pseudo-random IDs are not easier to guess than a password. On the other hand, it's much more likely that those IDs are exposed somewhere - query strings, cookies, cache etc. So I guess you are right, at least when security is critical.

  • (cs)

    I usually just lurk but this one forced me to register just to say "wow".

Leave a comment on “Insecurity Assessment”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article