• notJoeKing (unregistered)

    I wonder if the Z and Y keys are switched on some keyboards thereby placing the Y next to the X... Anyone know?

  • SomeCoder (unregistered)

    Even with the explanation, I still don't really see the WTF. The hardware was being pushed to the limit? Maybe a WTF but not that interesting. The message saying that the line had been traced and the police were coming? Not a WTF.

    This one isn't that good.

  • Robert (unregistered)

    So let me get this straight: In the original WTF, the ports weren't being swapped at all? That detail was actually added by the Daily WTF editors to make it cooler than it really was? Wow, that is so lame.

  • NightGod (unregistered) in reply to Robert
    Robert:
    So let me get this straight: In the original WTF, the ports weren't being swapped at all? That detail was actually added by the Daily WTF editors to make it cooler than it really was? Wow, that is so lame.
    Which part of his story that said "This pushed the hardware we were using considerably, causing occasional system 'burps', bumping all the ports numbers over by one." was confusing?
  • Anonononon (unregistered) in reply to Robert
    Robert:
    So let me get this straight: In the original WTF, the ports weren't being swapped at all? That detail was actually added by the Daily WTF editors to make it cooler than it really was? Wow, that is so lame.
    Andrew Harkavy:
    This pushed the hardware we were using considerably, causing occasional system 'burps', bumping all the ports numbers over by one. The front desk staff would see bizarre things such as print jobs dumping to their terminals, and the main menu printing out on the printer.
  • Scottford (unregistered)

    more paula. More Paula. MORE PAULA.

  • (cs) in reply to powerlord
    powerlord:
    P.S. I have no idea why the board is doubling the line breaks in the code block above. The only line that's blank in the comment editing window is the one after the #include.

    Looks fine to me (Maxthon over IE 7).

    Though I don't think it was done in C, probably a simple HTML page with some MIME type voodoo.

  • TadGhostal (unregistered)

    In the words of the Great Patrick Star...

    Uhhhhh, I don't get it.

  • Fister (unregistered)

    The port switch is a red herring. It was the interesting part, but the WTF was just the front desk support call. Not funny. They probably didn't actually figure out why the ports were being switched.

    It means that someone successfully ran the fake CMD.EXE file and it gave them the message "F*** off!".

    No. The HTTP GETs for cmd.exe are remote attempts to break into YOUR web server (assuming you're running an unpatched IIS). The other end doesn't care about the file; it cares about the few servers that actually execute cmd.exe locally when given that request.

  • AdT (unregistered) in reply to pt314
    pt314:
    I guess you're using a QWERTY keyboard. I also guess TheRider is using a QWERTZ one.

    In order to avoid running into the same problem, I switched my keyboard layout to Dvorak. As you can see, cy ,rpto l.pu.jyn;v

    Captcha: jrbo.'gay (no kidding, and isn't "cy ,rpto" like "crypto"?)

  • (cs)

    Not a typo - my password is SWORDFISSH. The Real WTF is that the computer assumes that passwords have to be spelled right to be correct.

  • Jimbo (unregistered)

    So the WTF is that the guy puts up with a bug that shuts down all the computers company wide every few months and just fixes the symptoms.

    Yeah I can see that.

  • DropDeadThread (unregistered)

    Maybe the wtf was that the printer and keyboard swapped ports? They inserted a piece of paper with the password on it then the keyboard's keys pressed themselves, spelling out "H-A-C-K A-T-T-E-M-P-T"

  • foxyshadis (unregistered) in reply to David
    David:
    Michiel:
    The real wtf is in the code of the article (@the blinking underscore): 
    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>

    Way back in '96 I was in the first "Internet Programming" class at my school. The instructor claimed that Marc Andressen admitted to adding blink to html one evening when he was drunk.

    Probably true, didn't the entire original Netscape team spend all the time developing the first couple versions drunk, unbathed, and crazy sleep deprived?

  • Smash (unregistered) in reply to Michiel
    Michiel:
    The real wtf is in the code of the article (@the blinking underscore): 
    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>

    It would be odd enough to have the printer output the admin password (supposing it did). But I wonder whether the underscore on the paper blinked too

  • Tp (unregistered) in reply to tmountjr
    tmountjr:
    Not a typo - *my* password is SWORDFISSH. The Real WTF is that the computer assumes that passwords have to be spelled right to be correct.

    You know, I really miss that google spellcheck thing that goes: "did you mean 'swordfish'?", when using ssh, because you cant see the damned characters and it is really hard to get the password correct with this stupid qwertz keyboard!

  • Eleganza (unregistered)

    So are we all on the same page now? The original story mentioned the strain on the hardware but neglected to mention that the result of that strain was the bumping up of the ports by one, which is why we were all confused.

    And the WTF itself is not the punchline, but rather the bogus hacker message and the front desks (understandably) alarmed response to it. Class dimissed.

  • Zombie_Hunter (unregistered)

    HOLY SWEET MOTHER OF JEEBUS!!! you used the <blink> tag!!!! YOU USED THE <BLINK> TAG!!!!! Don't you know every time a blink tag blinks God kills a kitten AND a puppy!!!!!!!!

  • (cs)

    Hahaha,

    I find:

    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>

    funny.

    Mike

  • Case (unregistered) in reply to Eleganza
    Eleganza:
    So are we all on the same page now? The original story mentioned the strain on the hardware but neglected to mention that the result of that strain was the bumping up of the ports by one, which is why we were all confused.

    And the WTF itself is not the punchline, but rather the bogus hacker message and the front desks (understandably) alarmed response to it. Class dimissed.

    From the WTF version: "After some debugging, Andrew discovered the issue — some of the port numbers had shifted"

    Just because you couldn't be trouble to read all the way through a rather wordy and boring WTF doesn't mean that he screwed it up entirely.

  • Martini (unregistered) in reply to TheRider
    TheRider:
    mtu:
    Kinda reminds me of how I used to place an executable file named cmd.exe onto my web server, which did nothing but pop up a message boy saying "F*** off!".

    I laughed at every HTTP 200 this caused in my logs :D

    A "message boy"?!? WTF?

    HTTP 200? As far as I remember, 200 means success. Don't you mean HTTP 404? or something else? WTF?

    I probably just don't get it.

    Correct on both counts. He is laughing because he looks at the logs and sees the number of times the program ran successfully, popping up that message box for some server admin to see (and have to click OK).

  • (cs) in reply to Zombie_Hunter
    Zombie_Hunter:
    HOLY SWEET MOTHER OF JEEBUS!!! you used the <blink> tag!!!! YOU USED THE <BLINK> TAG!!!!! Don't you know every time a blink tag blinks God kills a kitten AND a puppy!!!!!!!!
    If you kill both a kitten and a puppy, God uses a <blink> tag.
  • captain obvious (unregistered) in reply to AC
    AC:
    Paul:
    Or maybe a Freudian fart - he may have been thinking about boys.

    Makes sense, I do it all the time.

    think about boys?

  • DracoSid (unregistered) in reply to Aloysius
    Aloysius:
    So if the port numbers were changed randomly, the front desk computer terminal could have connected to the admin port, sent some random characters and got the police warning on the screen. Still, what caused the random port shift?

    Yep! And i'll bet the wardialers got the front desk login, with no password prompt -- straight to a root shell.

  • (cs) in reply to anne
    anne:
    That's no WTF, that's just awesome! Thanks for bothering to look at the source and unearth that great comment, too. I have to remember to use the wtf attribute more often in my HTML. :)

    I came across some code on a LiveJournal page that had lots of instances of <font shmolor="...">. Not quite sure what browser that was destined for?

    Here: http://www.google.co.uk/search?q=font%20shmolor&hl=en

    WTF..?

  • (cs) in reply to Smash
    Smash:
    It would be odd enough to have the printer output the admin password (supposing it did). But I wonder whether the underscore on the paper blinked too

    http://www.errorwear.com/picmonth-mar2002.php

  • ysth (unregistered) in reply to Martini
    Martini:
    Correct on both counts. He is laughing because he looks at the logs and sees the number of times the program ran successfully, popping up that message box for some server admin to see (and have to click OK).

    I would be very surprised to learn that CMD.EXE requestors were doing anything at all with the response, much less executing any javascript in it.

  • Lyle (unregistered) in reply to Grovesy

    I'd suspect that it was down to the true WTF - that the passwords were being used somewhere else, and doing control commands.

    So "Fidelio" contains "DEL IO" - which would possibly delete/reconfigure all the I/O ports?

    And "Swordfissh" contains "SSH" - thus the 'hack attack' ?

    I dunno, but that's how I read it, anyway.

  • Azd (unregistered) in reply to MikeDawg

    The Real WTF is that <blink> doesn't seem to work in Internet Explorer 7.

    No sorry, the REAL WTF is that I'm using IE7!

  • Dave (unregistered) in reply to Josh
    Josh:
    The Y isn't anywhere near the X.

    It is on a German keyboard. Probably others as well.

  • (cs) in reply to captain obvious
    captain obvious:
    AC:
    Paul:
    Or maybe a Freudian fart - he may have been thinking about boys.

    Makes sense, I do it all the time.

    think about boys?
    I'm assuming that you're assuming that the posts you've quoted are by boys. Believe it or not, they could be girls, and thinking about boys is perfectly normal for them.

  • oliver's travels (unregistered) in reply to Thief^
    Thief^:
    captain obvious:
    AC:
    Paul:
    Or maybe a Freudian fart - he may have been thinking about boys.

    Makes sense, I do it all the time.

    think about boys?
    I'm assuming that you're assuming that the posts you've quoted are by boys. Believe it or not, they could be girls, and thinking about boys is perfectly normal for them.

    you mean girls can be thought paedophiles too?

    well, i never!

  • AdT (unregistered) in reply to foxyshadis
    foxyshadis:
    Probably true, didn't the entire original Netscape team spend all the time developing the first couple versions drunk, unbathed, and crazy sleep deprived?

    That's sickening. Where I live, programmers don't work when they're drunk...

    Zombie_Hunter:
    Don't you know every time a blink tag blinks God kills a kitten AND a puppy!!!!!!!!

    You mean if I use the blink tag excessively, it will solve the urban dog sh** problem?

    andreyvul:
    If you kill both a kitten and a puppy, God uses a <blink> tag.

    What use would God have for a blink tag? <blink>RTFB</blink>?

  • The Nerdgod (unregistered)

    This story needs a better punchline:

    "Juanita was coming in every night and unplugging the ports to connect her RS232-powered vacuum cleaner"

  • Kederaji (unregistered) in reply to KT
    KT:
    Michiel:
    The real wtf is in the code of the article (@the blinking underscore): 
    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>
    ">_<
    Proof that the blink tag even makes anime fangirls go "WTF NOOOO! >_<"

    CAPTCHA: incassum. Sounds like an indian in a bad western. "Tie rope to waist incassum you fall."

  • mtu (unregistered)

    As the author of the now semi-famous CMD.EXE, let my clarify some things.

    It was written (well, "written") in VB6 and so yes, it consisted of nothing but MessageBox("F*** off!"), or whatever that statement looked like.

    Though whoever mentioned it was probably right, the intruder wouldn't care about what the file really did, expexting it to execute on my machine with certain parameters anyway.

    And yes, I'm using a QWERTZ keyboard.

    Any no, I'm not attracted to boys. I'm attracted to boz's, but luckily nobody knows what they are ;)

    Captcha: Latin for "to be".

  • jaymz (unregistered)

    i laughed when i saw the comment in the code for the underscore :) i thought to myself 'oh, thats cute, i wonder how they did that' only to find your comment in the wtf attribute...

  • Kivi (unregistered) in reply to jaymz

    Last!

  • grizzly (unregistered)

    Please make the bad flashing stop. Pleeeeeaaaaasee.

  • Matthew (unregistered) in reply to Michiel
    Michiel:
    The real wtf is in the code of the article (@the blinking underscore): 
    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>

    I think that is the only valid excuse to use blink tags: Simulated terminal cursor. In fact, I would venture to guess that such use was the sole reason it was even invented.

  • Anon (unregistered) in reply to pitchingchris
    W3 Opinion

    Line 122, Column 29: there is no attribute "wtf".

    [image]
    PASS: FIDELIO<blink wtf="sweet, an excuse to use the blink tag!">_</blink>
    You have used the attribute named above in your document, but the document type you are using does not support that attribute for this element.
  • (cs) in reply to mtu
    mtu:
    As the author of the now semi-famous CMD.EXE, let my clarify some things.

    It was written (well, "written") in VB6 and so yes, it consisted of nothing but MessageBox("F*** off!"), or whatever that statement looked like.

    So it actually displayed a message box on the web server??? Or do you mean it used client-side VBScript, with the intention being to cause the user's web browser to display the message?

    Though whoever mentioned it was probably right, the intruder wouldn't care about what the file really did, expecting it to execute on my machine with certain parameters anyway.
    Chances are close to 100% that the requests for cmd.exe were by bots. Returning a 200 response might have wasted their owners time in thinking that they'd compromised your server, though it's more likely the bots were simply worms trying to propagate themselves.
  • mtu (unregistered) in reply to grizzly
    grizzly:
    Please make the bad flashing stop. Pleeeeeaaaaasee.
    If you're using Firefox: Open about:config and reset the value browser.blink_allowed.
    nomdeplume:
    So it actually displayed a message box on the web server??? Or do you mean it used client-side VBScript, with the intention being to cause the user's web browser to display the message?
    Neither - it was a simple, standalone .EXE which I thought would be executed such that the "client" would see the message popping up.

    Cut me some slack, dammit, I was like fourteen ;)

    Captcha: "aptent". Probably the opposite of a tent. Cloth in a hole or some such.

  • Cloak (unregistered) in reply to Damir
    Damir:
    Michiel:
    The real wtf is in the code of the article (@the blinking underscore): 
    <blink wtf="sweet, an excuse to use the blink tag!">_</blink>

    And for a moment there I've thought they used an animated GIF :D

    TRWTF is using the blink tag

  • anon (unregistered)

    Fidelio (the system referenced in this WTF, going from the impressively secure password) is pretty old, wonky, and may be kissing-cousins related to some DailyWTF articles. It would not surprise me in the slightest if Fidelio's port assignment routines borked under high loads (or frequent connect/disconnects from the terminals, which appears to be the case in this article.) I doubt that it was the mistyping of the passwords, but it's possible.

  • Kivi (unregistered)

    Last!

  • n/s (unregistered) in reply to Kivi

    Not last!

  • Junkman (unregistered) in reply to Martini

    [quote user="Martini"][quote user="TheRider"][quote user="mtu"]Kinda reminds me of how I used to place an executable file named cmd.exe onto my web server, which did nothing but pop up a message boy saying "F*** off!".

    I laughed at every HTTP 200 this caused in my logs :D[/quote]

    A "message boy"?!? WTF? [/quote] I dunno - I think I'll incorporate into my next app...

    [image]
  • Paolo G (unregistered) in reply to Junkman

    [quote user="Martini"][quote user="TheRider"][quote user="mtu"]Kinda reminds me of how I used to place an executable file named cmd.exe onto my web server, which did nothing but pop up a message boy saying "F*** off!".

    I laughed at every HTTP 200 this caused in my logs :D[/quote]

    A "message boy"?!? WTF? [/quote]

    Yes, a message boy. He was employed by the hotel.

  • Anonymous (unregistered) in reply to Michiel

    Ignore him; I think that that is the ONLY good use for the <blink>blink</blink> tag.

Leave a comment on “Phoning It In”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article