• (cs) in reply to umm...
    umm...:
    Sounds to me like their web guy is a TDWTF frequenter...how else could they have known about today's topic so quickly?
    I don't think so, a quick WHOIS revealed an email address. Alex, or any TDWTF frequenter could easily have let them know.
  • Dude (unregistered)

    This is just too good to be true! It's gotta be some sort of "Lead Day" trick!!

    HAHAHA!

  • HAX0R.EXE (unregistered) in reply to mister
    mister:
    jimmy:
    I do believe this will become a legend in the vein of the great Paula.
    Not unless we come up with a short and easy to remember meme such as "Brillant" or "FILE_NOT_FOUND" :(

    Hurry up, guys! The time is running out!

    Hmm, maybe:

    var password = "secure"; or alert("PLZ don't hax0r our site!");

  • some guy on the internet ... (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    I'm sure it's frustrating that your "security" is the punchline to a joke that you don't get, but it really is your fault that it's so laughable.

    You should read and understand the comments before accusing the writers of lying. Everything there is true. They're about your "security" and not about your business as a whole.

    You're essentially using a combination lock with the combination written on it, which, honestly, is moronic if you expect it to work.

  • (cs)

    Did anyone tell them about the bad programming on the site? Maybe it is a web-site service provider that you can't do server scripts? In that case, tell them to change the provider. If that cannot be done, another way is to encrypt the page on the client side and use the given password to decrypt it also on the client.

  • Evert (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Oh man.. lynch this scammer

  • Cronus (unregistered) in reply to Jazz
    Jazz:
    My new business plan:
    1. Start contacting companies in the directory.
    2. Let them know that you discovered their information on the federal supplier's guide.
    3. Tell them that the security on the site can be easily bypassed.
    4. Explain that this allows lots of people who are not Federal Procurement Peons to see their company's listing.
    5. Explain that this is really good for their exposure and will lead to lots of new business.
    6. Let them know that for the small, nominal fee of $5,000, you will post instructions on how to access the directory all over the web, in order to give them that exposure.
    7. ????
    8. Profit!

    Fixed that for you.

  • Homer Simpson (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    OMIGAWD!

    Stop it. You're making my sides hurt... I can't stop laughing.

    "It's rude". Welcome to the internet, moron.

  • Smash (unregistered) in reply to JL
    JL:
    No, it's the equivalent of an open doorway with a sign next to it saying: "Please say the password aloud. ... If you said 'eggplant', you may enter the doorway. Otherwise, please leave."

    You're close... it's more like a closed doorway with no lock at all, and your sign is right beside it. The owner still could claim you pushed a door you weren't enbreastled to... if there wasn't a truck-sized hole on the wall next to the door (you could use the URL and avoid the "auth" script)

  • J (unregistered) in reply to Sys

    Now the page has been moved to: http://www.federalsuppliers.com/warning.html

    But they still haven't figured out they need to remove the login/pass from the source...

  • Mark (unregistered) in reply to J

    I just found it too, and its clear that they are incompetant, they chanced the password and user name to zzzzz and fffxxx, but its still right there in the page source. Morons.....

  • Sam Snead (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Are you retarded? Seriously?

  • Cry me a river (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Pull out the Kleenex and wipe your tears there's a reason to PAY somebody to build your Web site. You should be blaming the idiot that built the Web site not the people that aren't falling for the slick phone salesman saying anything he can to make his commission. Being ignorant is no protection under US Law.

  • Chris (unregistered)

    what a joke ... their new url: http://www.federalsuppliers.com/warning.html

    and the new code:

    <script language="javascript"> <!--// /*This Script allows people to enter by using a form that asks for a UserID and Password*/ function pasuser(form) { if (form.id.value=="zzzzzz") { if (form.pass.value=="fffxxx") { location="http://officers.federalsuppliers.com/agents.html" } else { alert("Invalid Password") } } else { alert("Invalid UserID") } } //--> </script>

    I just love incompetant people, don't you? They are absolutely great for business ...

  • AC (unregistered)

    Wow, comments are on page 8 already.

    Great to see a live WTF/scam directly from Alex, hilarious!

  • Zombie_Hunter (unregistered) in reply to Junkman

    Junkman has a point. The REAL WTF is actually the UK Computer Misuse Act.

  • Anooyyymous (unregistered) in reply to Sys

    The best part of this is I bet they are sending out company-wide e-mails to let everyone know about the "password change".

  • Cronus (unregistered)

    Not that there is much to be gained from the listing of businesses, people need to learn that bad security leads to bigger problems.

    Google Hacking

    Just be thankful FSG that you are getting this "review" of your security for free. And that there isn't any more holes that real life hackers can use. Oh wait, if posting the username and password into view source is their version of "security", I would personally HATE to see what security they put up for more CRITICAL information... like say, CREDIT CARD NUMBERS! If I was you FSG, I would take a long HARD look at your security, and make sure that it IS as secure as you THINK it might be.

  • (cs)

    Countryside Publishing, eh? I seem to recall once applying for a.. Website Manager job, I think (something like that, it was a management level position) and never receiving a reply back from them, several months ago.

    So... whoever you folks hired to do the job was clearly a bozo, or hired bozos. Makes you regret not giving me a call now, doesn't it?

    FWIW I contacted the company and informed them of how bad the site security is. I even offered to provide them consulting services as I live in the vicinity. I doubt I'll hear anything from them, but if I'm lucky I might have my 'fist!!11' customer for my new consulting business.

  • (cs) in reply to MM
    elias:
    spacecadet:
    L. Ron Paultard:
    Aren't all you wienies, I mean geeks, just so proud of yourselves?...

    The business is located in Palm Harbor, FL. That's 11 miles from Scientology HQ, Clearwater, FL. The above comments are textbook examples of a Scientologist "debate" technique called Bullbaiting.

    "Bullbaiting"? What, L. Ron Hubbard couldn't spell "ad hominem attack"?

    He made up new words for everything...

    Well, sorta.

    MM:
    TRWTF is that people keep saying they should get better security, when the only reason they could even want security on that site is to keep people from checking their references like happened in the original story. If they were legit, they would be trying to open up and advertize their site, so that their clients who paid so much to be listed might actually get some traffic off of it.

    Putting username/password boxes on a page while telling everyone who goes to that page what the username and password should be (and telling them where to go directly without putting in that name/password) is something we can laugh at them about, but what identifies them as a scam isn't that they had laughably bad security, it's the fact that they had clearly wanted to have security there.

    This is absolutely the Real WTF, and ties directly into the following:

    umm...:
    What's really interesting is...despite the fact that this story was posted today - somehow, some way this company has such a small amount of web traffic that they were able to come in to work, notice a bunch of click-throughs from TDWTF, visit here, leave comments, and change their page multiple times since. In fact, they knew this story was posted before I did, and I visit here pretty much daily.

    Hmm...

    Sounds to me like their web guy is a TDWTF frequenter...how else could they have known about today's topic so quickly?

    I bet what happened is that someone did indeed call some of the companies on the Super Sekrit List, and some of those companies turned right around and called Federal Suppliers to ask them "WTF, mate?" directly. The comments that've been flying here are probably nothing compared to the fit that's been hitting the shan over there.

    Franz Kafka:
    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    ("4 kids" sob story snipped for brevity)

    Okay, who's trolling? Nobody could be this stupid in real life.

    Instaneous:
    What's the wtf comment record? We gotta be getting close.

    To both of these questions, I present the only-recently-deceased Desktop Search Showdown. That thread was made of win, and for the same reason as this one (only an order of magnitude more so): the purveyor of the original WTF just insisted on coming back around over and over and over with a fresh supply of new WTFs.

  • kerohazel (unregistered) in reply to Smash
    Smash:
    JL:
    No, it's the equivalent of an open doorway with a sign next to it saying: "Please say the password aloud. ... If you said 'eggplant', you may enter the doorway. Otherwise, please leave."

    You're close... it's more like a closed doorway with no lock at all, and your sign is right beside it. The owner still could claim you pushed a door you weren't enbreastled to... if there wasn't a truck-sized hole on the wall next to the door (you could use the URL and avoid the "auth" script)

    Is this a clbuttic case of swear filtering? (http://thedailywtf.com/Articles/The-Clbuttic-Mistake-.aspx)

  • no name, thanks. (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT
    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    thank you hackers for trying to destroy federal suppliers guides reputation. i have worked here with my wife for 10 years now and have helped hundreds of clients obtain federal government work. i have 4 children and though you don't care you are hurting the feelings of many good employees and customers by your immature actions. sorry our site wasn't protected to your standards however all of you are being reported to the appropriate authorities as we have your information too. you should of protected your info a little better. not only is the company legit we actually have held a 5 year GSA contract with the federal government and one of my best clients just broke 500,000 dollars in federal sales directly related to the GSA contract we got them. i am proud to work here and help small businesses obtain government workand also help federal buyers locate qualified small businesses to do business with. if you not interested in government work or our services of helping small businesses navigate the federal market fine but please don't slander the company. its rude, your comments are not truthful we are not a scam and i hope someday you realize that all you have to do is check us out with dun & bradstreet or GSA or the florida local and state chambers of commerce to see that what we do is real and federal buyers do request both our hardcopy guides and the online directory as well.

    That's funny, it switches from "we" to "me/my" in the middle. And doesn't use proper grammar or punctuation. Some TDWTFer want to take credit for this, or shall we judged that their legal representation, that would post comments to a forum is on a level with their website security?

  • Anon (unregistered)

    Their MySQL is on 3306 if anyone wants to try

  • Jimmy (unregistered)

    Lol this organisation is ridiculous, cheap mock-up scam that can't even 'invest' in an easy server based php login system

  • Anon (unregistered)

    Also someone smarter than I could probably go this route: ftp://federalsuppliers.com

  • Barry (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Haha, your going to jail

  • Silentbob (unregistered) in reply to JaredR26

    I agree!

    And that employee comment, legendary comment! LUSER !!

  • (cs) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT
    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    thank you hackers for trying to destroy federal suppliers guides reputation. i have worked here with my wife for 10 years now and have helped hundreds of clients obtain federal government work. i have 4 children and though you don't care you are hurting the feelings of many good employees and customers by your immature actions. sorry our site wasn't protected to your standards however all of you are being reported to the appropriate authorities as we have your information too. you should of protected your info a little better. not only is the company legit we actually have held a 5 year GSA contract with the federal government and one of my best clients just broke 500,000 dollars in federal sales directly related to the GSA contract we got them. i am proud to work here and help small businesses obtain government workand also help federal buyers locate qualified small businesses to do business with. if you not interested in government work or our services of helping small businesses navigate the federal market fine but please don't slander the company. its rude, your comments are not truthful we are not a scam and i hope someday you realize that all you have to do is check us out with dun & bradstreet or GSA or the florida local and state chambers of commerce to see that what we do is real and federal buyers do request both our hardcopy guides and the online directory as well.
    Oh Jeez, this must be the fourth time I've promised myself not to respond before reading through the posts. Three hundred is a little extreme, though. I just have to; then I'll read the posts.

    This is hysterical. Alex (not you, the other Alex), buy this man a capital letter. (Whoops, that's not Wheel of Fortune, is it?) Even punctuation would help.

    This has got to be the best WTF ever, by far. Not only was the javascript insane; not only was the salesman insane; not only is this hurt response insane; but you've actually managed a Geraldo-level expose.

    And it's funny. Which is the main point.

    Now I'll go get a beer and read the other posts. LOL.

  • (cs) in reply to Lucy
    Lucy:
    As an employee of the company, I was just made aware of your site. Our company is legitimate and we're not a scam. The fact that our site security is weak is something we are addressing. We are staffed with good people, we offer a great service, and you are trying to ruin our reputation. You are crossing legal lines.

    I am asking you to stop your actions immediately.

    Would that be the first, second, third, or fourth series, Lucy?

    Never mind. They're all comedy classics.

  • no name, thanks. (unregistered) in reply to Lucy

    Um, no, good people feel a sense of moral responsibility when writing code or script, a sense that leads one to learn how to do things properly, rather than half-buttockedly, so whoever wrote your website fails the test of "good people."

  • CC (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT
    FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT:
    thank you hackers for trying to destroy federal suppliers guides reputation.

    I really hope that's real. I don't think it's the "hackers" that are damaging his reputation...

  • (cs) in reply to dpm
    dpm:
    Lucy:
    As an employee of the company, I was just made aware of your site. Our company is legitimate and we're not a scam. The fact that our site security is weak is something we are addressing. We are staffed with good people, we offer a great service, and you are trying to ruin our reputation. You are crossing legal lines.

    I am asking you to stop your actions immediately.

    Μολὼν Λαβέ.

    WTF has this to do with loony Greek gun-fetishists in Wyoming?

    Oh ... I see what you mean.

  • jorge_sur (unregistered) in reply to RevLee
    RevLee:
    Don't blame them for insecure code, its not even original code. This site http://www.2createawebsite.com/enhance/password-protect.html offers a familiar looking free script to protect your site: <!--// /*This Script allows people to enter by using a form that asks for a UserID and Password*/ function pasuser(form) { if (form.id.value=="userID") { if (form.pass.value=="password") { location="page2.html" } else { alert("Invalid Password") } } else { alert("Invalid UserID") } } //--> </script>

    Which is what yo have to do. Not on client side, not comparing strings and with some java vudu in between. But those are minor details

  • (cs) in reply to L. Ron Paultard

    Just repeating this in case anyone missed it the first time.

    L. Ron Paultard:
    The business is located in Palm Harbor, FL. That's 11 miles from Scientology HQ, Clearwater, FL. The above comments are textbook examples of a Scientologist "debate" technique called Bullbaiting.

    I guarantee half of this company's employees are Scientologists.

    Fuck that thing about four kids. Even Florida social services will look after them better than L. Ron Hubbard.

  • Bob (unregistered)
    <script type="text/javascript"> window.location="http://google.com"; </script>

    This post is encrypted using 2ROT13. Unauthorized decryption is a violation of the DCMA.

    Ha ha now I can sue everyone and get rich!

  • (cs) in reply to this webcomic is a wtf
    this webcomic is a wtf:
    WHATS THE MATTER WITH TRAILERPARKS?
    they tend not to understand the sarcastic implications of uppercase that's what.
  • mouseanon (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    I am hoping this jackass is a troll, if this is a real reply....

    /facepalm

    captch odio (shouldn't that have been odious?)

  • k3n (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    If you are a professional, offering professional services which may contain the transmission of potentially sensitive information, it is your obligation to properly secure your website. That goes for anyone with a routable IP.

    Now, I don't really care if you're a legit business or not. Well, actually I do, but that's not why I'm responding. I'm responding because you're way off-base here, man. Unless the "appropriate authorities" that you're referring to actually are ninja developers, in which case I guess the joke's on me!

    I would go as far as to say that a vast majority of the readers here at The Daily What The ..., I mean.. Worse Than Failure, could've done the same thing as Alex. Don't take that as braggadocio, either- its a slam against your site's "security". Said security is equivalent to hiding your car key in the gas tank; when your car gets stolen, the insurance company will laugh at you (while they deny your claim on the grounds of stupidity).

    Spend some money (gasp!) and fix your site. And let me give you a hint here: don't hire a government contractor for the job ;)

    p.s. your domain registration is about to expire.

  • (cs) in reply to Lucas
    Lucas:
    Google also hacked your site:

    http://www.google.com/search?q=site:officers.federalsuppliers.com&hl=en

    I suggest you bring the full force of your company's legal team, which I assume consists of a man who drinks gasoline and a golden retriever, to bear on this hacking problem.

    How do you drink a golden retriever?

    Just asking. I figured this dialog could benefit from a bit of grammar nazi-ism...

  • (cs) in reply to John
    John:
    Bob Smith: This is the same as leaving your wallet with your bank card and a note that has your PIN at a restaurant.

    No, because even with the PIN and the card, accessing his bank account is illegal and you can't just walk up and access his bank account by knowing his branch address and nothing else.

    This man has an aardvark. On a pedestal. He has a velvet rope surrounding the pedestal. He has a carnival hawker crying "Guess the secret word and SEE THE AARDVARK! You can't see the aardvark if you don't guess the secret word!".

    And, of course, everyone is just looking around the carnival barker, over the velvet rope, and pointing out to him that that's no aardvark, that's a raccoon with a skin condition.

    Do you mind? Many of my best friends are raccoons. Some of them even have psoriasis. And the secret word is We interrupt this broadcast with an important message: the secret word is Criminon!

  • Anonymous (unregistered) in reply to Sys

    I came across a site a while back with similar security.

    The awesome thing about it was that they actually went the extra mile to (lightly) obfuscate the javascript they used to check the password, but the "secret" URL they were protecting was simply the form element's action attribute. The script would just return false to the form's onsubmit event if you didn't type the right password (which could be easily seen in the urlencoded script anyway).

  • (cs) in reply to Richard Sargent

    I have lynx:

    Index Government Work Securing Federal State GSA Contracts Listing ... (p1 of 4)

              >>> Check Out Our Banner Advertisers Here
 *
 * HOME
 * Company
 * GSA
 * Federal Regulations
 * Guide Layout
 *
 * Distribution
 * Procurement
 * Agents

    If you call up the "agents" link, it displays:

    Federal Procurement Officers This site is reserved for Federal Procurement Officers only.

         Purchaser Login Area

     User:                                 ____________________
     Password:                             ____________________

                                      Reset

                                           [BUTTON]

    Infobar

    More About GSA

    A GSA Schedule Contract permits you to create customer loyalty, increase awareness, and quickly make contract deals through BPAs and Teaming Arrangements. LEARN MORE

    Questions?

    If you have any questions about the Directory, just send an email to: [email protected]

  • Anon (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Then PLEASE spend a few bucks on a web coder to properly secure your website. You are putting your information at risk.

  • Pub1 (unregistered)

    Hmm, this is a legitimate business that sells overpriced stuff with somewhat high pressure techniques, to presumably unsophisticated businesses. I sense the "idea" behind the so-called secure area is not to be too secure -- if you are a government purchasing officer, you would be given password access anywhere and since there are no state secrets here, real security isn't essential. But that doesn't change the fact that this service is very poor value and most of the 'stuff' is the selling, not the substance.

  • Smash (unregistered) in reply to kerohazel
    kerohazel:
    Is this a clbuttic case of swear filtering? (http://thedailywtf.com/Articles/The-Clbuttic-Mistake-.aspx)
    Yes, and I was pretty sure someone would get the joke. It was only a few days back after all.
  • _ (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    tl;dr

  • SP (unregistered)

    Wow, so many comments.

    Yea go ahead report me for hitting your website. I dare you to come get me. I double dare you. Come and get me.

    Come on... Come get me for accessing your "secure" junk.

    Anyway. Your company is slime. What you are doing is legal, but it is slime. I know it, you know it. You got caught redhanded.

    Shut up and take it like a man.

  • hahahaha (unregistered) in reply to sorakiu
    sorakiu:
    From the story above, it was not obvious to me that they were scammers.

    This comment leads me to believe you'd be an ideal customer for my new business.

    Are you insured against large, seabound mammals? No? Then your family could be at risk!

    Call 555-7894 and buy new Walrus Insurance today!

  • S (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    Seriously? This is a joke right? Learn to capitalize letters, use commas, and add spaces between words like "work and." The grammar alone shows that the people running this company are ill educated in the least.

  • Travis (unregistered) in reply to FEDERAL SUPPLIERS GUIDE CUSTOMER SUPPORT

    I really hope you're kidding. Your security not being "up to out standards." You know, I had a security system for this awesome fort I built when I was 10. Whenever my parents approached, I would say, "You have to say 'password' to enter."

    Yeah, that's what you guys did on your site.

Leave a comment on “So You Hacked Our Site!?”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article