No. 1 Story
HP job cuts loom for Australian employees
A number of Australian employees of Hewlett-Packard are facing the loss of their jobs as the global computer giant looks to slash its worldwide workforce by up to 30,000.
read moreRelated Articles
Report, bug, receive, visit, from, the, policeJuniper Networks has extended its SSL VPN security to the iPad with the release...
A recent survey by security company Sophos exposes the dilemma to business posed by...
You might think that thousands, nay millions of people will be on the Internet...
- Sponsored Editorial -
AppLabs sees huge value proposition for its clients with...
- sponsored editorial -
Australian independent software testing and training organisation, Planit,...
More From
Report a bug; receive a visit from the police
David Heath
Wednesday, 19 October 2011 09:28
Page 1 of 2
When a kindly soul discovers a trivially simple security bug and then posts it to the organization concerned, the last thing he expects is a warning letter from the lawyers and a visit from the police.
This is what we call a BIG DEAL.
Patrick Webster, a client of the Fund and private security consultant observed that the URL used to access specific details of his account appeared to include his account ID number. In itself, that's not a problem, many sites do that. The problem was that there was zero security once a person was logged in.
Webster did a very simple thing - he changed the ID number in the URL and hit Enter.
Lo and behold, he was able to access someone else's account.
His next step was probably something of a silly move. In 30 seconds, he was able to write a script that stepped through every account number and confirmed the details were visible. In hind sight, the first test ought to have been enough.
This is exactly the same kind of bug that was identified in FamilyHQ soon after launch.
Continued...
You think you have a disaster recovery plan?
Think again. Most businesses only have PART of a DR plan - and this spells business disaster in the event of an IT disaster.
Download The Seven Sins of Disaster Recovery White Paper now and find out how you can prevent this happening to you.
