Worst security hole you've seen?

I broke into http://dev.superuser.com/ by changing the domain of my ServerFault beta access cookie. (they've fixed it now)

For me, the worst, most devilishly terrible, dangerous, criminally negligent, and yet strangely elegant in its utter destruction of the entire system's security will always be this one from The Daily WTF:

Client-Side PHP

function saveform()
{
  var firstName = escapeSql(mainForm.elements.txtFirstName.value);
  var lastName = escapeSql(mainForm.elements.txtLastName.value);
  /* ... */
  var offerCode = escapeSql(mainForm.elements.txtOfferCode.value);

  var code =
  '  $cn = mssql_connect($DB_SERVER, $DB_USERNAME, $DB_PASSWORD)           ' +
  '          or die("ERROR: Cannot Connect to $DB_SERVER");                ' +
  '  $db = mssql_select_db($DB_NAME, $cn);                                 ' +
  '                                                                        ' +
  '  if (mssql_query("SELECT 1 FROM APPS WHERE SSN=\''+ssn+'\'", $cn)) ' +
  '  { $ins = false; }                                                     ' +
  '  else                                                                  ' +
  '  { $ins = true; }                                                      ' +
  '                                                                        ' +
  '  if ($ins) {                                                           ' +
  '    $sql = "INSERT INTO APPS (FIRSTNM, LASTNM, ..., OFFERCD) VALUES ("; ' +
  '    $sql+= "\''+firstName+'\',";                                        ' +
  '    $sql+= "\''+lastName+'\',";                                         ' +
  '    $sql+= "\''+offerCode+'\')";                                        ' +
  '                                                                        ' +
  '  /* ... */                                                             ' +
  '                                                                        ' +
  '  mssql_query($sql, $cn);                                               ' +
  '  mssql_close($cn);                                                     ';

  execPhp(code);
}

Just gaze at it for a minute. Think of all you could do with what's been handed to you. Now this, ladies and gentlemen, is a Lovecraftian masterpiece.

Back in high-school the lab was running an early version of windows. The administration spend a large amount of funds on a security program.

The gentleman in charge of the lab came up to me and asked me to bypass the system to see if it was secure. "It's O.K., you won't get in trouble."

I rebooted, hit f8, hit N when it asked me if I wanted to load the security program and Y to everything else.

On a free web-host I tried, there was a logical error in the "Forgot Password" method for e-mailing you your password -- if you didn't enter an e-mail address (a secondary e-mail was optional), it e-mailed the password for the primary address for every single user who didn't provide a secondary e-mail.

I and hundreds of others one day received an e-mail with hundreds of usernames and passwords, with the passwords in plaintext.

Not a technical security hole, but a security hole nonetheless:

My banking card was recently eaten by an ATM and it took some weeks before I got it back. When it finally arrived at the bank, a woman from the bank called me to ask whether I wanted to pick up my card or have them send it to me via mail. She also told me that if they would send it they would disable it until I called them to confirm that it arrived safely at my home.

I got the card with a short letter with exact contact information including a note saying I needed to call to re-enable the card. I just called there, gave them my name and account number, BOTH OF WHICH WAS PRINTED ON THE CARD ITSELF and they re-enabled the card.

Basically, if anybody else had snatched that letter, they would have had the card and the number of the bank as well as all the information needed to convince the bank that it was actually me calling. So, not a very good security system there.

Thinking about this, the worst security hole I've ever seen was when the guy who adminned the electronic door lock said "What do you mean, the lock doesn't know about public holidays"?

Yep, every Monday-FRiday that happened to be a public holiday since the door system had been installed saw the front door unlocked 08:00-17:30.

Well simply a

exec unchecked_parameter_from_the_web

in Python to parse an dictionary literal which was given by the user. That was really scary.

I'm Surprised I've not seen the Microsoft wga verification hack mentioned yet.

You could download the control that validated your copy of windows before allowing you access to downloads or alternativly you could paste the following line of javascript into the address bar and hit return.

javascript:void(window.g_sDisableWGACheck='all')

It was intended as a way of letting users verify once and download multiple items, however as it was stored on the client side it was easily manipulated!

In one forum I've got readonly access to hidden threads and administrative interface just by replacing my username in cookies by admin's one, not changing password.

Paraphrasing from memory here, but it's close...

<form action="secretpage.html" id="authentication"          
      onsubmit="return document.forms.authentication.password.value == 's3cr3t'">
    Enter password: <input type="password" name="password"><br>
    <input type="submit" name="Login" >
</form>

A guy I know used this to protect the "private area" of his web site. At first, he didn't want to believe me that even his browser had this wonky "view source" function.

I once had a job where there was a security layer written in Java code that checked if the user had access to edit a DB table column. This is what the function looked like:

public boolean canEdit(User user, DBColumn column) {
    if(true) {
        return true;
    } else {
        return false;
    }
}

Windows 95 had the option to require a password to unlock the screensaver. However, using ctrl+alt+del you could just kill the screensaver.

A legacy app I ported a few years back used a 3rd party callback system for handling payments. Thing was, the callback script didn't check that the amount paid was equal to the price of the order, so it was possible to purchase any product on the site for £0.01 by using Firebug to edit the contents of the 'amount' field on the payment page.

On a website I worked on, they used the username and password as combined primary key. The username was automatically your last name and not required to be unique.

Which leaves only one thing that could be unique...

The worst security hole I've ever seen was build into an earlier version of MS SQL Server, version 7.0 or 2000, can't remember exactly.

When installing this version of SQL Server, the installer would by default give the "sa" account a blank password !!! (the sa account is the SQL Administrator account, it can do anything on the server)

This gave basically anyone access to an SQL server that wasn't protected by a firewall.

But it gets worse.

At that time, many SQL servers were installed to run the service under "local system" authentication, giving the SQL server process unlimited control over the system.

Since you can create COM objects in SQL server you suddenly had complete access over the computer where the SQL server was running.

Many a site has been hacked this way.

I've seen a buffer overflow which could be (theoretically) expoilted via fax.

There was an automatic document routing process which was taking faxes as input, OCR'ing them and extracting some information, then doing LDAP searches based on that, etc. Don't know if it qualifies as "the worst", but definitely made my chuckle.

XSS is what I love to find on a web site.

Here is a link to a log of my findings:

All: http://xssed.com/archive/author=Dr.Optix

Only the specials: http://xssed.com/archive/special=1/author=Dr.Optix/

Have fun browsing them!

Our phones at work.

You have to log in using your 4 digit ID, then push # and enter your 4 digit password followed by #. But if you don't enter any password and push #, it logs you in.

Failphone fails.

The worst I ever saw were credit cards, PINS, and names being stored in plain text. I about had a heart-attack.

An application using faces and managedbeans. The bean used to edit the user already logged in was the same used by the self-register form, where two hidden fields were the only difference. Meaning? If you get someone's document number (equivalent to SSN in USA), you could actually change their password.

My old school had the student's passwords the same as their username, PLUS it was easy to get their usernames (a number, ex 123233), then you could hit add column and find out the first and last name of the students, as well as their usernames. So it was easy to put random garbage in their accounts and make them think there was a "ghost in the machine"