我最近看到的最大安全漏洞是iOS 4 (iPhone)的锁屏漏洞，允许任何人立即访问任何iPhone(打电话、地址簿、通话记录、照片)。

http://www.pcworld.com/article/208813/ios_4_lock_screen_security_flaw_grants_access_to_contacts.html

在文本框中输入1=1将列出系统中的所有用户。

在我以前的学校，他们把用户密码以明文形式存储在cookie中。

这本身就很可怕，但更糟糕的是，他们把它们储存在饼干里供*.大学。当然，现在所有学生和员工的页面都在university.edu.au/~user这样的网站上。

<?php

var_dump($_COOKIE); // oops.

我们有一个旧的计算机集群，在我工作的一个实验室里没有运行。几个本科生认为，让它运行起来会很有趣，这样他们就可以学习一点并行计算了。他们让它运行起来，结果证明它非常有用。

One day I came in and was checking out the stats...It was running at 100%. Now this was a 24 node cluster and there were only 3 of us that ever used it so it was a little strange that it was running at this load. I started playing with it, trying to figure out what was loading it...turned out someone had gained access and was using it as their own little porn server and spammer. I asked the undergrads what kind of security they put on it, they looked at me and said "Security? We didn't think it would need any."

我给它加了个密码，就这样。把它用作色情服务器的人原来是一个本科生的朋友。

http://www.metasploit.com/users/hdm/tools/debian-openssl/

一个“安全”的网站，每个页面都是加密的，但登录页面!