你见过的最糟糕的安全漏洞是什么?为了保护罪犯,限制细节可能是个好主意。

不管怎样,这里有一个关于如果你发现了安全漏洞该怎么办的问题,还有一个关于如果公司(似乎)没有回应该怎么办的问题。


当前回答

我在The Daily WTF上看到过这个。

<script language="javascript">
<!--//
/*This Script allows people to enter by using a form that asks for a
UserID and Password*/
function pasuser(form) {
    if (form.id.value=="buyers") { 
        if (form.pass.value=="gov1996") {              
            location="http://officers.federalsuppliers.com/agents.html" 
        } else {
            alert("Invalid Password")
        }
    } else {  
        alert("Invalid UserID")
    }
}
//-->
</script>

恕我直言,没有什么比这更好的了。

其他回答

当我使用Colloquy (IRC)时,密码字段会弹出,但我仍然在主屏幕上集中,所以当我按下enter键时,全世界都知道我的密码,而我却没有意识到。

http://apache.org/.svn/entries

我最后工作的公司的FTP用户名和密码与他们的域名相同。他们不太在意反复警告。

不用说,网站没过多久就倒闭了。没有在线备份,所以他们不得不重建整个系统。但这并没有结束。这次事件后的新安全密码是一样的…加上123。

About 3 years ago I built a site for a somewhat large non-profit organization in our state. When it came time to deploy the application to their web host server, I noticed an odd file named "cc.txt" or something obvious like that in their public site. It was under their web root, was getting served, and was a csv file of all their donor's names, addresses, credit card numbers, expiration dates, and CVV/CVC codes. I cannot count the number of times I brought the issue up - first to my boss, then our company accountant, the client's IT director, finally the client's President. That was 3 years ago. The file is still being served, it can even be googled. And it's been updated. I tend not to respond to their donation solicitations when I get them.

去年,我发现我所在的公司用来处理支票/报表的网站充满了SQL注入漏洞。

不用说,他们很快就把洞补好了。