413
votes

What is the worst security hole you've ever seen? It is probably a good idea to keep details limited to protect the guilty.

For what it's worth, here's a question about what to do if you find a security hole, and another with some useful answers if a company doesn't (seem to) respond.

8
  • 47
    Should be community wiki imo... Sep 24, 2009 at 5:38
  • Great thread! I hope it can be linked to from DailyWTF.com
    – Dale
    Sep 24, 2009 at 14:13
  • Why closed? It's a perfectly reasonable question?!!
    – johnc
    Sep 24, 2009 at 22:32
  • 15
    the 60 answers and 28 upvotes would seem to outweigh the 5 votes to close (that took all day to accumulate, AFAIK). but I will refrain from voting to reopen until this has been discussed.
    – rmeador
    Sep 24, 2009 at 22:57
  • 7
    Even if your question has been community wiki for hours, the comment is still a good comment to upvote, as it reminds people that questions similar to this one should be community wiki. That's what I think.
    – Joren
    Sep 25, 2009 at 19:44

163 Answers 163

27
votes

When I use Colloquy (IRC), the password field pops up, but I still have focus in the main screen so the whole world knows my password when I hit enter and don't realize it.

2
  • 22
    The good old IRC fault: <n4p> msg NickServ identify my1super2secret3passwort4 ** n4p has been ghosted **
    – guerda
    Sep 25, 2009 at 6:46
  • 11
    That's why I do my password things on server tab and not on a channel / UI May 4, 2010 at 23:02
26
votes

The company I last worked for had their FTP username and password identical to the name of their domain. They didn't quite bother with repeated warnings.

Needless to say, it didn't take a long time for the site to go under. No online backups so they basically had to rebuild the whole thing. But it doesn't end there. The new secure password after this incident was the same... with 123 added on.

2
  • 12
    Passwords have been around for a long time. You'd think even laypeople would know what the worst passwords are. Sep 24, 2009 at 16:42
  • 3
    Wow, I think I will change my password to um yea "password123", the old one "pass123" seems just too risky :) Mar 3, 2010 at 14:25
25
votes

I broke into http://dev.superuser.com/ by changing the domain of my ServerFault beta access cookie. (they've fixed it now)

1
22
votes

One of the utility companies I have doesn't use autocomplete="off" in their credit card form.

Sure, they don't store your credit card info (a good thing), but imagine how horrified I was when I paid my 2nd months bill and my browser offered to fill in the entire credit card number for me...

1
  • 11
    I see this all the time. Ugh! It's an underappreciated problem. Dec 8, 2009 at 16:06
21
votes

An online DVD-rent-shop in Sweden sent pure SQL-statements in the querystring.

If you selected for example category "Comedy" in the menu-frame, it then sent "select * from movies where category=2" as querystring to the movielist-frame, that then executed the SQL-statement and showed all movies matching the criteria.

Same thing when adding movies to your order.

Just change the query to "delete * from movies" and "Delete * from orders" would make the day for that company.

4
  • 8
    Assuming, of course, that the app had permissions to do that. I wouldn't be surprised if it did, but it's perfectly possible to grant somebody select permission on a table and nothing else. Sep 24, 2009 at 13:38
  • 6
    Even if the db permissions were limited, you're still suddenly vulnerable to any db-specific exploits, (and most people don't religiously upgrade their db software) and probably denial-of-service attacks. Sep 24, 2009 at 14:04
  • I've had to reject a design where SQL is stored on a web page. You would have thought it might have been thought through a little better. Sep 27, 2009 at 14:41
  • Even without all that and with the permissions locked down correctly, it's still very vulnerable to someone doing a ridiculously complex ad hoc query a few times and causing a DoS attack. Oct 23, 2010 at 22:13
20
votes

Some friends were in a class together at university. They discovered the professor posted all the homework solutions, even for homeworks that were not due yet, had not been graded, or hadn't even been assigned. The professor just had links or solutions to them embedded in the class web page, and would comment them out in an HTML comment until the assignment had been collected and graded.

1
  • 3
    What subject was this for? Not a computer-related one, I hope.
    – EMP
    Aug 30, 2010 at 1:20
19
votes

We had a nice one at a store I used to work at. Doors to non-public access areas had keypads, so you were supposed to have to enter a pin code to gain access. However, you could just press # and the doors would open, a fact that we liked since it was much easier to hit # than a 6 digit pin code.

0
17
votes

Not strictly a security hole, more of a "feature" that lots of rookie server admins didn't know/care about at the time.

Around 1999-2001 I had lots of fun with Frontpage and unlocked Frontpage server extensions installed on public facing websites.

When you had Frontpage installed you got this nice handy "Edit in Frontpage" button within Internet Explorer.

When visiting a site, e.g. www.foo.com, If you clicked on the "Edit in Frontpage" button in Internet Explorer and the server admins hadn't done their job properly then Frontpage happily opened up the full directory structure of the virtual directory and allowed you to read/edit the contents.

This worked on many sites from little one man band setups to bigger public organisations.

I always fired an email off to the "webmaster" when found an open server and I once got a £50 gift voucher from an online retailer for alerting them to this.

Shocking stuff really.

DISCLAIMER - I need to point out that Frontpage was on the standard build PC I was given in those days, not of my own choice!

5
  • 4
    And to this day I'm still asked "is Frontpage good enough?" :s
    – Robert K
    Sep 24, 2009 at 14:22
  • 23
    It's refreshing to hear about a company that actually thanked someone for alerting them to a security hole instead of trying to blame them for it.
    – Ryan Lundy
    Dec 4, 2009 at 15:11
  • 2
    Well, I didn't tell you about the 2nd time I found a similar hole for a potential client, I naively thought they would be happy to know about such a glaring hole, but apparently not - we subsequently did not win this business – no £50 voucher that time!
    – JohnAOwens
    Mar 12, 2010 at 12:40
  • 1
    About a year ago I was asked to check over a website being designed for an old client by another outfit. Naturally I looked for vulnerability to a SQL injection attack - and the site was wide open. So I documented what I'd done and how to fix it, only to have the boss of the company on the phone to me half an hour later screaming at me that I was a hacker, he was reporting me to the police and and he was off to see his lawyer so he could take me down for everything I'd got. He rather sheepishly backed out a couple of days later when I imagine someone talked some sense into him.
    – Cruachan
    Aug 12, 2010 at 10:48
  • 1
    This seems to me like a good way to filter out potential clients. You don't want to sign a contract with someone like that and get burned later... Sep 21, 2010 at 19:46
17
votes

Windows 95 and 98 had the best bug ever. If you just pressed cancel you would be logged in with admin priviliges :) Had a great time at my dads work back then :D

6
  • 13
    actually, IIRC, that was your password to get on SMB shares and the like. it was never meant to serve as authentication for the local machine.
    – asveikau
    Oct 20, 2009 at 1:18
  • 9
    With Win9[58], there wasn't anything like "admin privileges", because every user had full, unrestricted access (the little toggle in Control panels->Users notwithstanding, that was basically eye candy). Feb 2, 2010 at 22:00
  • 8
    This is not a security hole. What that login screen actually did is unlock your "password list" (.PWL) file, which stored passwords for network shares (and possibly some other passwords). If you didn't care about the password list then it was perfectly fine to hit Cancel. As already mentioned, there was no local authentication at all, let alone any "admin privileges".
    – EMP
    Aug 30, 2010 at 0:11
  • 5
    @Evgeny: Isn't the lack of local authentication (and of accounts with lesser privileges) a security hole by itself?
    – Vinko Vrsalovic
    Oct 30, 2010 at 6:55
  • Oh, I hated this one. As others have said, it's not actually a hole as the machine wasn't secured in the first place. The problem was idiot users who didn't understand that they weren't on the network--and then I get the call because my app on the server won't run. May 28, 2011 at 0:09
16
votes

My bank once detected a "suspicious transaction" on my debit card. They recommended I cancel it and get a new one.

While I was waiting for the new card, I needed to make a withdrawal. So I walked into the bank, gave the a woman my old card, and explained, "This card was recently canceled, but I need some money. Could you give some from this account?"

As I walked out of the bank, cash in pocket, I realized I had just taken money from an account using a canceled card without ever being asked to show any form of ID.

4
  • 3
    I once closed a bank account without showing my ID. I walked out of the bank with all the money that had been in the account.
    – poke
    Oct 23, 2010 at 3:36
  • 1
    done the same. I was honestly stuck but I needed money, walked into the bank and had no card no visual ID - They said "Name, Address, DOB" ... all of which are on my freelancing CV and website.
    – Glycerine
    Oct 30, 2010 at 12:10
  • Using the card to bring up your account is not the same as using it at an ATM. Your account number stays the same across cards so it is perfectly reasonable to use a cancelled debit card for this purpose. You don't even really need the card - you walk in with the number... you will have to pass some sort of identity verification and it may be pretty lax - but that's why you have withdrawl limits and the authentication they use varies. Every bank I've used has also required my PIN to be entered - and that has not changed when a lost card has been replaced... sorry, I consider that convenience. Nov 16, 2010 at 19:53
  • 1
    The point was I DIDN'T have to pass some sort of identity verification, PIN or otherwise.
    – Seth
    Nov 16, 2010 at 21:37
16
votes

For me, the worst, most devilishly terrible, dangerous, criminally negligent, and yet strangely elegant in its utter destruction of the entire system's security will always be this one from The Daily WTF:

Client-Side PHP

function saveform()
{
  var firstName = escapeSql(mainForm.elements.txtFirstName.value);
  var lastName = escapeSql(mainForm.elements.txtLastName.value);
  /* ... */
  var offerCode = escapeSql(mainForm.elements.txtOfferCode.value);

  var code =
  '  $cn = mssql_connect($DB_SERVER, $DB_USERNAME, $DB_PASSWORD)           ' +
  '          or die("ERROR: Cannot Connect to $DB_SERVER");                ' +
  '  $db = mssql_select_db($DB_NAME, $cn);                                 ' +
  '                                                                        ' +
  '  if (mssql_query("SELECT 1 FROM APPS WHERE SSN=\''+ssn+'\'", $cn)) ' +
  '  { $ins = false; }                                                     ' +
  '  else                                                                  ' +
  '  { $ins = true; }                                                      ' +
  '                                                                        ' +
  '  if ($ins) {                                                           ' +
  '    $sql = "INSERT INTO APPS (FIRSTNM, LASTNM, ..., OFFERCD) VALUES ("; ' +
  '    $sql+= "\''+firstName+'\',";                                        ' +
  '    $sql+= "\''+lastName+'\',";                                         ' +
  '    $sql+= "\''+offerCode+'\')";                                        ' +
  '                                                                        ' +
  '  /* ... */                                                             ' +
  '                                                                        ' +
  '  mssql_query($sql, $cn);                                               ' +
  '  mssql_close($cn);                                                     ';

  execPhp(code);
}

Just gaze at it for a minute. Think of all you could do with what's been handed to you. Now this, ladies and gentlemen, is a Lovecraftian masterpiece.

9
  • 1
    Just because you can doesn't mean you should. Dear Gods...
    – Esko
    Jan 14, 2011 at 7:27
  • 2
    If you use code like this, you deserve to face the consequences. Ouch! +1 for TDWTF :)
    – invert
    Jan 17, 2011 at 13:07
  • 2
    Its such a blatant error I missed it for the first few seconds.
    – Glycerine
    Jan 30, 2011 at 14:31
  • 2
    @Glycerine: I know. Your brain doesn't want to accept that people would ever do this. But hey--they're using that escapeSql method, so it must be secure! Jan 30, 2011 at 16:30
  • I don't understand how this is necessarily wrong. Quite possibly, this is because I'm not familiar with data bases or php. But isn't the main issue that you'd be able to enter php code in the form fields? Isn't it quite possible that implementation of the escapeSql() function also ensures that the input does not contain php code?
    – Alderath
    Dec 27, 2011 at 14:42
15
votes

1-800 dominos will give unlisted address's related to any target phone number. When prompted if you are calling about the phone number you called from select no. The system will prompt you for a new phone number, the system will then read back to you the name and address that's associated to this phone number. Enter in your target's phone number and you now have their name and address. This is pretty common with automated ordering systems and if dominos has fixed this there are literally hundreds more.

5
  • 2
    Or you could just use the phone book Dec 8, 2010 at 2:51
  • 1
    @Lavinski: He said "unlisted"
    – diadem
    Dec 16, 2010 at 20:51
  • Well, if they're unlisted, where is Dominos getting them from? Seems to me they must be listed somewhere...
    – Tyler
    May 27, 2011 at 22:48
  • Good luck searching for a specific number in a phone book.
    – Gary
    Jul 1, 2011 at 14:03
  • 2
    @MatrixFrog From orders. The list is their list. Jul 6, 2011 at 14:38
15
votes

Enter desired username: iboyd

Enter desired password: *********

That password is already in use for that username. Please choose a different password.

5
  • I've been banging my head against my table (poor table) and it's very likely that I overlook something, but I can't see a security hole in here: those passwords can still be saved salted and hashed. It's just a irritating message, because if someone really wants to use the same (possibly complex) password over and over again, just let them do so. Nov 8, 2010 at 23:04
  • @Marcel, if the system tells me a username and password, I can log in to their account. yes?
    – jb.
    Nov 8, 2010 at 23:16
  • 2
    @jb (who can't get called, because his username is too short :-P) – Ah, the system is echoing his credentials to the browser/program, even his password? I thought Ian typed his user/pass and the system replied with that message. Nov 8, 2010 at 23:30
  • 5
    No, Ian did type his username and password to the system, which does not require that usernames are unique, but that the combination of username and password is; therefore, in receiving this error message, he has stumbled upon a way to access the system using the credentials of a different user with the same username.
    – Jon Purdy
    Nov 9, 2010 at 3:06
  • i guess i should have explained the Enter desired password more clearly. When you are signing up, you enter the username and password you'd like to use. Unfortunately you cannot use those credentials because they're in use by someone else. If you pick a different password you'll be good (but i thought its funnier when you make the realization for yourself - the same as i did).
    – Ian Boyd
    Nov 9, 2010 at 13:57
15
votes

Back in high-school the lab was running an early version of windows. The administration spend a large amount of funds on a security program.

The gentleman in charge of the lab came up to me and asked me to bypass the system to see if it was secure. "It's O.K., you won't get in trouble."

I rebooted, hit f8, hit N when it asked me if I wanted to load the security program and Y to everything else.

14
votes

On a free web-host I tried, there was a logical error in the "Forgot Password" method for e-mailing you your password -- if you didn't enter an e-mail address (a secondary e-mail was optional), it e-mailed the password for the primary address for every single user who didn't provide a secondary e-mail.

I and hundreds of others one day received an e-mail with hundreds of usernames and passwords, with the passwords in plaintext.

0
13
votes

I used to work for a point-of-sale company. Their software was used by a lot of pizza joints.

It was up to the customer to change the default passwords. The default information is printed in the user manuals and such. :)

Well, some kids who worked at one of these pizza joints guessed they hadn't change the root password (Unix/Linux based system). They then proceeded to buy him and his friends free delivered pizza to his house for close to a year before the pizza joint noticed. It makes me laugh everytime I think about that job. :)

13
votes

Once I worked with a firm to which I had to share information through encryption. They provided me with a GPG key pair - both their public and private keys instead of just sharing the public key and the info that was highly confidential.

I had to explain them that this process was wrong and they realized that they had been doing this for a long time.

0
13
votes

I once found a bug in a local Internet portal called ROL.RO (Romania OnLine - owned at that time by PCNET). They had a free webmail system. I wanted a certain (easy to guess which) username, but it was already taken.

By curiosity I went to the "forgot my password" page entering my desired (but taken) username. Then, upon submitting, I was presented with the security question which was blank.

Wow... let's see if they are lame. I made sure the answer textbox was empty, and I submitted

"CONGRATULATIONS, ENTER YOUR NEW PASSWORD".

I entered a password and hijacked the account.


What probably happened in their ... PHP scripts was that they compared the null from the database (in the answer - of course they kept it in clear text) to the empty string submitted by me. Having them "equal" lead me to the next step, the reset of the password.

Yes, lame.

13
votes

Believe it or not, I've found this fairly recently on one website:

eval($_GET['code']);

Server didn't even have safe mode on...

0
12
votes

Not the worst but one that was a good laugh was the Android OS reboot bug. When users had the G1 phones they could type "reboot" from anywhere on the phone (ie: sms or emails) and the phone would reboot.

2
  • While certainly a funny bug, I don't see this as a security hole. The user is already allowed to reboot. Dec 15, 2011 at 20:46
  • 1
    Typing "reboot" was just one example. Having everything you type on the phone going to a root shell is a pretty big bug and security hole.
    – Brandon
    Dec 16, 2011 at 22:24
12
votes
if( $session['role'] = "admin" ) //grant admin rights

Just one character off ("=" instead of "==" ) is all it takes to grant admin rights to anyone who is logged in. Your truly is guilty.

5
  • +1 for honesty. A unit test should have picked this up though.
    – si618
    Jul 16, 2010 at 8:57
  • A what? :) Ever tried unit testing in Drupal ... eurgh
    – stef
    Jul 16, 2010 at 10:28
  • I did not understood his one, what one character is stef talking about ?
    – Rachel
    Oct 24, 2010 at 2:11
  • 1
    $session['role'] = "admin" this sets the $session value to admin, it is not a comparison. It should have been $session['role'] == "admin". You need two == to do a comparison.
    – stef
    Oct 25, 2010 at 8:29
  • 9
    PHP itself is guilty here. Allowing variable assignments in if statements is obviously going to lead to tons of these kind of mistakes. Oct 30, 2010 at 13:27
11
votes

I don't know if this is the worst, since I've seen some that were pretty bad, but:

Years ago, a place I worked at brought in a system called FOCUS. Don't know if it's still around or not. It's great for reporting, and we developed and taught perhaps a thousand or two non-IT people how to produce their own reports. Very handy. They could do the basic reports, some could do the medium-hard stuff, and IT could help with the harder stuff.

All of the data for reporting was copied regularly to shadow databases in FOCUS' own format. For the more sensitive data, we set the secure option, which encrypted the data. All well and good.

So, one day my boss calls me in, and we've lost the password to one of the sensitive databases. It's going to be hard to reproduce the data in this case, so he asks me to see if I can break the security. I had no experience as a hacker, so it took me about 5 or 6 hours to hand him the password. I started by creating some test files, and encrypting them with different passwords. I found that changing one character in the password would change two bytes in the encrypted file, specifically, the high nybble of one byte, and the low nybble of another byte. Hmmmm, says I. Sure enough, they stored the password somewhere in the first 80 bytes of the encrypted, but obfuscated the password by splitting the bytes into nybbles, and storing them in predictable places.

It didn't take long after that to write a REXX script that ran under the VM/CMS system and would tell us the password of any encrypted database.

That was a long time ago - in the early nineties, and I'm sure they've since fixed this problem. Well, pretty sure.

2
  • +1 for actually examining the bytes, nybble by nybble. Wow. Jan 14, 2011 at 15:19
  • 1
    Citizen, please report to re-education immediately for your violation of the DMCA.
    – wberry
    Dec 5, 2011 at 19:00
11
votes

Mine would be discovering an ODBC DSN used for reporting, where the password matched the user, and the user belonged to the database server administration group.

So any PC with this ODBC DSN could read/alter all data (and worse) through the report user, using any ODBC compatible tool. No authorization required, and authentication was as weak as you can get.

I was working in a public hospital, and the software was installed on nearly every PC in every government hospital in the state, with the database server containing all sorts of sensitive medical data (full patient details, lab test results, etc.)

Worst of all, we quietly reported the security hole, then officially, and it still wasn't fixed in the 2 years I remained working there, and that was 5 years ago.

4
  • 2
    Assuming this was in the US, some people could have gotten into an awful lot of trouble. Sep 24, 2009 at 13:40
  • 3
    Absolutely. Won't mention which country or state, but the government spent a LOT of money on this software (including hardware rollout + support it was 8 figures). The most frustrating part was how simple the fix would be...moving the user out of the db server admin group to somewhere where only read access was granted (on appropriate tables).
    – si618
    Sep 24, 2009 at 23:49
  • They might babysit that account with a kickout report for unexpected activity.
    – Aaron Bush
    Feb 25, 2010 at 19:40
  • @Aaron, maybe, but given the slackness of security, and the fact this account was used for all reporting done by clients (user count in the thousands), somehow I doubt it.
    – si618
    Feb 25, 2010 at 22:58
10
votes

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

4
  • 1
    They're not the only one. If you do a search for that file you'll find lots of sites that do the same thing.
    – avacariu
    Aug 31, 2010 at 20:19
  • How was CSV file publicly available, if its in webroot folder of application server than how will it be publicly accessible ?
    – Rachel
    Oct 24, 2010 at 1:58
  • 1
    the file had a .txt extension, and their web server was setup to serve it as text. All you had to do was enter the right url and you'd get the whole readable file in your browser. Oct 25, 2010 at 5:43
  • 1
    This kind of negligence is illegal. If no one at the client will listen to you, I'd seriously consider reporting them. Jan 14, 2011 at 19:49
9
votes

Saw a door that somebody forgot to lock once...

Alternatively, saw some JavaScript which executed some SQL via an Ajax call. Only problem was that the SQL to be run was rendered with the page and then passed to the service...

1
  • 3
    A free AJAX SQL server... sounds like fun!
    – Kobi
    Sep 24, 2009 at 11:11
9
votes

Stocking credit card information in a database with no encryption ( WHOLE information: number + expiration date + cryptogram). In addition, the database was used as a kind of CRM, so lots of sales people can access it with a not-secure-at-all password. (Who haven't changed it since I left the company 3 years ago.)

4
  • 4
    I'm sure there are quite a few of us who have worked for companies which (illegally) store credit card details.
    – si618
    Sep 24, 2009 at 10:59
  • Yeah, I was going to say, not only is that a security issue, but ILLEGAL. Sep 24, 2009 at 17:51
  • 3
    wow I get pissed off everytime amazon tries to remember my creditcard number... DON'T HELP ME... I don't want my account saved on your servers. Sep 24, 2009 at 18:42
  • 5
    @Brandon Hansen: I don't know that it's illegal in the USA, but it is grounds to have your ability to handle Visa cards revoked immediately. Oct 2, 2009 at 17:34
9
votes

Not a technical security hole, but a security hole nonetheless:

My banking card was recently eaten by an ATM and it took some weeks before I got it back. When it finally arrived at the bank, a woman from the bank called me to ask whether I wanted to pick up my card or have them send it to me via mail. She also told me that if they would send it they would disable it until I called them to confirm that it arrived safely at my home.

I got the card with a short letter with exact contact information including a note saying I needed to call to re-enable the card. I just called there, gave them my name and account number, BOTH OF WHICH WAS PRINTED ON THE CARD ITSELF and they re-enabled the card.

Basically, if anybody else had snatched that letter, they would have had the card and the number of the bank as well as all the information needed to convince the bank that it was actually me calling. So, not a very good security system there.

4
  • So silly. All they have to do is require the card to be activated in person at a branch. That way they can perform a photo ID check and nefarious types would be less likely to attempt it knowing they will be recorded whilst doing so.
    – si618
    Mar 15, 2010 at 22:42
  • 3
    That would be a better idea if bank branches were open outside their usual interval of 11:45am to 12:15pm, Mon - Fri, and located on every block in every city.
    – detly
    Jun 3, 2010 at 7:12
  • 1
    Did you call from your home phone (or whatever phone number they have on file for you)? Some banks will use the caller id as one method of authentication. It is possible that they would have asked you more questions to verify your identity if you were calling from another number.
    – pkaeding
    Jun 3, 2010 at 14:30
  • Most (I'm not going to claim all) banks only activate your card if you call from one of your contact numbers. Sometimes I felt a company had no need for my cellphone number, but I tried to use it to activate my card. I've gotten bumped to a human and asked my security questions on several occasions. What I really hate is my bank grooming me for phishing attacks by CONSTANTLY sending me email with hyperlinks in it. Bad bank, no cookie.
    – Jason
    Jun 10, 2010 at 22:39
9
votes

There's a bank that offer some services via its web site. The developers considered any one who had logged in as a valid user for the entire system, and they use URLs to identify the account number, so simply just changing the ID on the URL and you can view other accounts' balances.

It's really very bad for a web developer who think authentication and authorization are the same thing.

Also it's good that the bank doesn't transfer money via its website, otherwise some people will be rich ;-)

4
  • 2
    What country is this bank in?
    – Incognito
    Oct 23, 2010 at 19:17
  • 1
    Sorry, I can't give more details, this bank is the biggest one on that country, so I can't give any more info ;-) Oct 23, 2010 at 20:22
  • 2
    +1 for responsible disclosure. Give them time to fix the security hole, if they don't fix it then provide full disclosure so that they are forced to fix it :)
    – si618
    Oct 24, 2010 at 23:20
  • 1
    Seems like someone finally exploited this: it.slashdot.org/story/11/06/14/2046216/… Jun 15, 2011 at 11:41
9
votes

The worst I personally found was at a university which used machines running X for all the systems (including professors' offices). A single server hosted all these X sessions...

Amusingly, you could launch a new X application (clock being a favorite, but any X application would work) and choose the terminal it was displayed on. With a quick script, you could launch it on every computer on every lab/office on campus...

Of course, the application which really exposed this security hole was a fake shell login, the inputs from which were recorded to a file.

It ran for a week and scarfed up hundreds of student and professor usernames and passwords, and generated a couple of EXTREMELY unhappy administrators.

Not the answer you're looking for? Browse other questions tagged or ask your own question.