Nearly 1% of websites built with a content management system (like WordPress or Joomla) are unknowingly exposing their database password to anyone who knows where to look.
TL;DR — Summary of the Problem
Using a text editor to modify content management system (CMS) configuration files (like wp-config.php) could expose your database password to the world. Several popular text editors like Vim and Emacs automatically create backup copies of the files you edit, giving them names like “wp-config.php~” and “#wp-config.php#”. If the text editor crashes or the SSH connection drops during editing, then the temporary backup files may not be cleaned up correctly. This means that the CMS config file (which contains the database password) could accidentally be made public to anyone who knows where to look.
Most servers, including the ubiquitous Apache, will happily serve the plaintext of .php~ and .php# files without passing them through the PHP preprocessor first, since they don’t have the .php file extension. Thus, your sensitive database credentials are just one GET request away from being accessed by a malicious party.
I wrote an automatic program, which I call CMSploit, to test for the prevalence of this issue across the wider web. I tested the top 200,000 websites (as ranked by Quantcast) and found that 0.11% of websites are vulnerable. If we eliminate non-CMS sites, and just look at CMS-powered websites, then we find that 0.77% of websites running a CMS have publicly-visible config files.
If you want all the gory details, then keep reading.
Update 10/19/2011:CNET says that Adobe is working on a fix and it could be ready by end of week. Adobe also emailed me and said “our product team is wrapping up their investigation and is now working on a fix, which should not require a Flash Player update”.
Update 10/20/2011: Whoa, this story is everywhere!
Update 10/20/2011: Adobe says they just posted a fix to the Settings Manager that should resolve the issue. I just tested it out, and indeed the issue appears to be fixed now. Congrats, Adobe, for the quick fix!
I discovered a vulnerability in Adobe Flash that allows any website to turn on your webcam and microphone without your knowledge or consent to spy on you.
It works in all versions of Adobe Flash that I tested.I’ve confirmed that it works in the Firefox and Safari for Mac browsers. Use one of those if you check out the live demo. There’s a weird CSS opacity bug in most other browsers (Chrome for Mac and most browsers on Windows/Linux).
This attack works by using a neat variation of the normal clickjacking technique that spammers and other bad people are using in the wild right now. For the uninitiated:
Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.
— Wikipedia
Over one year after I built YouTube Instant, my little 3 hour project is still getting talked about in the national press.
To me, it’s a giant lesson about the power of programming for the Web. It’s also proof that engaging with the media through blogging, Twitter, and Quora can create a meaningful public discussion and even help you shape a news story.
September 11, 2012. Out in Silicon Valley, the last bastion of full employment, the Steve Jobs and Mark Zuckerbergs of the future are staying up all night writing code in dorms.
On February 26, I will be featured in a speaker panel called How to Become a CEO by Age 21 at a Stanford Asian-Pacific Student Entrepreneurship event geared towards high school students. I’m flattered that I was invited to participate.
Hi, this is Feross. I'm a computer science student at Stanford University. I'm interested in Internet technology, web development, and computer security. I like hacking on cool software projects, running, basketball, retro video games, and shiny gadgets.
You Should Follow Me