Stupid Security Mistakes you have seen

Bowyakka

I will kick this off

Where i work we have a couple of macosx machines fro website testing, now the unix infra team wants nothing to do with these machines, so they are maintained by "IT Support" which is a largly windows based crowd.

Due to the way in which our environment is setup, many users hack their own hosts files , so in their intellegence it support gave the devs the following command to change the host file on macosx

ChristyMcJesus · Apprentice Joined: 02 Oct 2004 Posts: 184

Heh, funny.

Biggest security fubar I saw recently was yesterday, when my bank took £3000 out of my account and sent it to China. I found this out when I tried to pay for my groceries, 5 minutes before the store closed. Oops.

Bowyakka · Posted: Mon Nov 07, 2005 4:03 pm Post subject:

Wha geez thats you bank !!?!?!?
_________________
glows in the dark

rodoke · Posted: Mon Nov 07, 2005 9:19 pm Post subject: How about

the futility you feel every time you announce a new password to people, and you notice 2/3s of them immediately writing them down on Post-its.

codergeek42 · Posted: Mon Nov 07, 2005 9:29 pm Post subject:

Windows running with administrative priveleges by default. :roll:

_________________
~~ Peter: Brony, GNU/Linux geek, caffeine addict, and Free Software advocate.
Who am I? :: EFF & FSF

Billybob · Apprentice Joined: 23 Oct 2003 Posts: 189

I don't remember why, but I was floating around Yahoo Mail one day and decided to test it for XSS vulns. Turns out there was plenty. About an hour later I had a preliminary exploit to show off. So I found Yahoo's security contact thingie-ma-bob, contacted them, and within a mere three months they fixed it. Wow.
_________________
---

Computer Life

abaelinor · n00b Joined: 27 Aug 2005 Posts: 51

homeobocks · Posted: Tue Nov 08, 2005 3:13 am Post subject:

LOL WINDOWZ IS A SECURITY MISTEAK M I RITE?
_________________
HOW DO I SHOT WEB

MACSRULETHEWORLD · Tux's lil' helper Joined: 17 Apr 2004 Posts: 131

at my school the admin left IP addresses and passwords to every single computer in a publicly viewable folder.

abaelinor · n00b Joined: 27 Aug 2005 Posts: 51

/dev/random · Posted: Tue Nov 08, 2005 4:34 am Post subject:

acasto · Posted: Tue Nov 08, 2005 4:35 am Post subject:

The biggest security mistake I have seen was not wiping the gun for prints before ditching it.
_________________
Leerrroooooyyyyyyyy JENKINS!!!!1111...................

"You know the Nazi's had pieces of flare.. that they made the Jews wear."

santiagozky · Posted: Tue Nov 08, 2005 5:17 am Post subject:

in my university I take care of a web server (runing w2k3 :lol:

), a few after they gave me remote control (full control), i made a mistake and close all the remote conections, so I needed physical access to the server. When i got it I was escorted by one guy of IT support , but after a few minutes he got bored so he let me alone in the site with full physical acces to all the servers.

they are lucky that Im a good guy.

wdreinhart

alistair · Retired Dev Joined: 15 Jul 2005 Posts: 869

rlogin -l username machine

once upon at time didnt check username and allowed u to login with a username of -froot (which means no password)

easy access to root.

[edit]Even linux can have mistakes.

abaelinor · n00b Joined: 27 Aug 2005 Posts: 51

gkmac

Enlight · Posted: Wed Nov 09, 2005 1:52 pm Post subject:

ChristyMcJesus · Apprentice Joined: 02 Oct 2004 Posts: 184

cokehabit · Advocate Joined: 23 Apr 2004 Posts: 3302

AA and British Gas leaving their comms rooms unlocked with £10,000,000 worth of equipment inside. All you need is a cup of coffee and the Gas records and people stuck on the motorway go up in smoke with the rest of the building

gkmac · Posted: Thu Nov 10, 2005 7:49 pm Post subject:

One other computer at work ran Windows NT 4 (I think) where the clock would drift by about 5 minutes every week. Clicking the taskbar clock to try and fix it was no use, since that was restricted along with many other things.

So I yanked out the UPS power cable and stuck it back in, pressed DEL during the memory count and the unpassword-protected BIOS was all in reach. Just to correct that clock, but someone else could tinker with the IDE sector/head/cylinder settings (why do BIOSes still have those?) and cripple the computer enough for somebody to call tech support.

Lechium · Apprentice Joined: 04 Apr 2005 Posts: 244

mofrikaantje · n00b Joined: 15 Oct 2005 Posts: 11 Location: Belgium

biggest mistake i ever saw was at our school, you could access the teacher computer containing all the marks from almost all that teacher's pupils (also ours) trought all the computers in the network... stupidly enough, i told him before changing my marks :cry:

Mnemia · Guru Joined: 17 May 2002 Posts: 476

Lechium · Apprentice Joined: 04 Apr 2005 Posts: 244

At my univ at one of the computer labs there is a computer that is used to get students id/password in case theyt forgot it.
It uses fullscreen IE with turned off toolbars. It it linked to the page where you fill in your perosnal info, press button, and it loads page with your id/pass word. Than you push another button and it loads 'click here to get your id/password' screen.

Here's the thing thou -- you press backspace which functions as a back button, and by doing that you can go back and see personal information, id and password, of all people who used the system...