Nearly 1% of websites built with a content management system (like WordPress or Joomla) are unknowingly exposing their database password to anyone who knows where to look.
TL;DR — Summary of the Problem
Using a text editor to modify content management system (CMS) configuration files (like wp-config.php) could expose your database password to the world. Several popular text editors like Vim and Emacs automatically create backup copies of the files you edit, giving them names like “wp-config.php~” and “#wp-config.php#”. If the text editor crashes or the SSH connection drops during editing, then the temporary backup files may not be cleaned up correctly. This means that the CMS config file (which contains the database password) could accidentally be made public to anyone who knows where to look.
Most servers, including the ubiquitous Apache, will happily serve the plaintext of .php~ and .php# files without passing them through the PHP preprocessor first, since they don’t have the .php file extension. Thus, your sensitive database credentials are just one GET request away from being accessed by a malicious party.
I wrote an automatic program, which I call CMSploit, to test for the prevalence of this issue across the wider web. I tested the top 200,000 websites (as ranked by Quantcast) and found that 0.11% of websites are vulnerable. If we eliminate non-CMS sites, and just look at CMS-powered websites, then we find that 0.77% of websites running a CMS have publicly-visible config files.
If you want all the gory details, then keep reading.
Delving back into project history long before we launched publicly in 2008, the autoupdate project was one of the very first we started working on. The idea was to give people a blank window with an autoupdater. If they installed that, over time the blank window would grow into a browser. And today, some five years after our autoupdater started updating a mostly blank window that could barely load webpages, it is now an engine for delivering an incredibly sophisticated web technology platform onto our users’ computers, which in turn allows web app developers to build amazing new online experiences. I have never seen such an effective platform update mechanism before.
How cool is that??!
Invisibility is a key part of one of Chrome’s four “S”s – simplicity. We seek not to bother the user with information that is irrelevant. As important as it might seem to engineers for our users to weigh fully a variety of considerations relating to our software, in reality they have better things to be doing. They’re trying to find a restaurant, check an email, post a facebook update, and then get the hell away from the computer. Every time the user agent steps in between the user and their task, we slow them down and diminish their enjoyment. Content, not Chrome.
I discovered a vulnerability in Adobe Flash that allows any website to turn on your webcam and microphone without your knowledge or consent to spy on you.
It works in all versions of Adobe Flash that I tested.I’ve confirmed that it works in the Firefox and Safari for Mac browsers. Use one of those if you check out the live demo. There’s a weird CSS opacity bug in most other browsers (Chrome for Mac and most browsers on Windows/Linux).
Update 10/19/2011:CNET says that Adobe is working on a fix and it could be ready by end of week. Adobe also emailed me and said “our product team is wrapping up their investigation and is now working on a fix, which should not require a Flash Player update”.
Update 10/20/2011: Whoa, this story is everywhere!
Update 10/20/2011: Adobe says they just posted a fix to the Settings Manager that should resolve the issue. I just tested it out, and indeed the issue appears to be fixed now. Congrats, Adobe, for the quick fix!
This attack works by using a neat variation of the normal clickjacking technique that spammers and other bad people are using in the wild right now. For the uninitiated:
Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.
— Wikipedia
Something I’ve needed to do from time to time is spoof my computer’s MAC address. This is useful for debugging network issues or temporarily getting onto the Stanford Wi-Fi network when my physical MAC address changes, such as when Apple replaced my logic board (motherboard).
Hi, this is Feross. I'm a computer science student at Stanford University. I'm interested in Internet technology, web development, and computer security. I like hacking on cool software projects, running, basketball, retro video games, and shiny gadgets.
You Should Follow Me