Fox News' FTP Password Anyone?
An anonymous reader writes "While browsing around the Fox News website, I found that directory indexes are turned on. So, I started following the tree up, until I got to /admin. Eventually, I found my way into /admin/xml_parser/zdnet/, in which, there is a shell script. Seeing as it's a shell script, and I use Linux, I took a peek. Inside, is a username and password to an FTP. So, of course, I tried to login. The result? Epic fail on Fox's part. And seriously, what kind of password is T1me Out. This is just pathetic." It's already been changed of course, but that's still pretty amusing.
Dude, why didn't you look around for the bug that makes them misreport the news so horribly that a majority of FOX News viewers still believes Iraq was responsible for 9/11 and Saddam had WMDs when the US invaded?
"It is nice to know that the computer understands the problem. But I would like to understand it too." --Eugene Wigner
You're going to jail and slashdot is getting shut down. It's a federal offense to interfere with an official government propaganda outlet.
Enjoy your stay in gitmo!
Now the question is, was it changed by Fox or someone else.
That is all we need, months of stories how "evil hackers got into Fox network"
Followed up with "Hackers: Evil and must be stopped?" to linking hacking to Obama, a danger to your kids and finally Hackers gone wild at Spring break.
I'm not that much into security, so I hope I don't sound "pathetic", but I was wondering what's wrong with the 'T1me Out' password. I'd say all company passwords I've ever had were no harder than that, and none of them had a space in it. And honestly how many of you guys use a password like YwMCU07D?
Oh shut the fuck up, you Gentoo fanboi. If they used Gentoo, the server would still be recompiling from a kernel update six months ago. Take your Genntoo, and jam it up your ass sideways and backwards. It's 0.038% more optimized for that.
That password would've been satisfactory if it was kept better.
In all fairness (do they even deserve it?), the password listed in the script is for ZDNet's FTP, not Fox. Still pretty embarrassing, but it's not going to hurt Fox at all (I imagine it could have hurt CNet/ZDNet). And it definitely could've hurt the relationship between both corporations' IT departments.
There seems to be a string of these lately between content aggregators. About a month ago there was that page on MS's site endorsing Linux. Turns out the content was from another site (I think, actually, CNet).
Not to say I'm not totally surprised. In this day when about 50% of someone's site is content from somebody else, it's not surprising there's snafus. I'm just waiting for the day when one of the sites leaves up SSH logins for another.
Just because you find the key to my car lying on the street doesn't mean you can go for a joy ride.
I wonder if I use bold in my signature, people will notice my posts.
Actually, as of this post, the ftp server can still be accessed with the same username and password from the script.
Random corporation has bad security: Brief blurb about how corporations should take better care of their security infrastructure in order to make sure that leaks/intrusions don't happen. Perhaps even a person or two giving advice in the form of which files to edit and what to change.
Corporation that people don't like has bad security: Note after note about how evil the company is and that they're idiots in the highest sense.
1) The password has probably been around for awhile with no one guessing it. What exactly was wrong with it? Uppercase/lowercase/numbers, combination of multiple words, it is at least moderately strong.
2) Why the hell are you blaming Fox? You think the entire company sat in a conference room and decided on a security scheme and a password?
3) Why did this deserve front page news? Exploits like this are found on a daily basis, and ones much more humorous/interesting/newsworthy.
Bingo! Never, ever, ever! NEVER store a password in plaintext in a script. Not ever. That's always a huge security issue, because you never know who is going to read the file. If you need unattended logins, there's SSH, Kerberos/GSSAPI, whatever.
My blog
this originated on 4chan.org's /b/ late last night (NSFW.) the shell script was a small script for uploading to a ziff-davis ftp server, it wasn't actually a fox ftp password (look at the directory name the shell script was found in, and i'm sure z-d appreciates this too.) also, there was an image directory that had directory listing turned on too. i didn't stick around long enough to see if any /b/tards found anything interesting in there, but i know an image dump was being made.
...to doing 'fair and balanced' journalism.
Oh the irony!
Aw, crap. Now there'll be another round of armchair security experts saying "You should turn off directory indexes!" and easily-led sysadmins actually doing it, and we'll have that many fewer sites where you can bypass the broken navigation to actually find things through the directory indexes.
Directory indexes, on a properly-run site, are a Good Thing and should be encouraged. They are and should be turned on by default in real httpd software. Anything secret that's accessible through a directory index would also be accessible by guessing the URL - so security has to be enforced by 403 Forbidden, not by "nobody will know the URL," anyway. Don't disable directory indexes unless you have a really good reason - and if you think you have a really good reason, especially if you think it has something to do with some kind of "security," then you're probably wrong.
A post on the newsworthiness of the main article is not off-topic. Should be modded back up.
There was over 4GB of employee data on the FTP, including username, name, email, password, address, etc.
There was a recent podcast from This American Life (hardly the bastion of conservative thought) where a (former) teenager whose job it was to spread propaganda from Saddam's government said he was afraid about what would happen when the war started because he wasn't sure whether or not his government had chemical weapons, etc. Yes, there's a difference between some teenager (even if he and his father worked for the government) and our intelligence community. Yes, fundamental flaws exist/existed in our intelligence community, partly no doubt due to our administration's tendencies to promote "yes men". Yes, there's a difference between thinking they're there and declaring that you know exactly where they are. However, I'm still going with Hanlon's razor on this one.
Ben Hocking
Need a professional organizer?
So someone, somewhere is telling people that passwords that contain upper and lower-case and numbers are good passwords?? They _just_ forget to tell you that if the upper-letter is the first letter of a word, and the number is an easily predictable substitute, when you gain ABSOLUTELY NOTHING!
Yes, this password would be cracked in 5-20 seconds by an average password cracker.
Tit's up - and outa there!
/home/linuxin/public_html/site/admin/db.php on line 50 /home/linuxin/public_html/site/admin/db.php on line 50
"mysql_pconnect() [function.mysql-pconnect]: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (111) in
Warning: mysql_select_db(): supplied argument is not a valid MySQL-Link resource in
Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (111)"
We have meltdown - I repeat we have meltdown. Now someone get that pile of circuts and goo off the rack and get a new one in here pronto.
On July 11, 2007, the posted an article that talked about FTP and why it's bad. But they were concerned about anonymous access. Doh.
All you have to do is try to view a directory in a browser. If you get an index, you know it's on. If not, you know it's off or there's an index file. Examples: http://www.foxnews.com/story/ and http://www.foxnews.com/i/.
I wonder if I use bold in my signature, people will notice my posts.
Yawn... just another opportunity to feed the flames for all the liberals on /. Reading through all the replies that have nothing to do with the original article and just focus on bashing conservatives and the content of the stories run by the network proves my point. It's getting old guys/gals... really old.
I was once visiting the offices of a design firm that was doing some work for Disney. As far as I remember, the procedure for adding new content was:
- Email the admins (with password), requesting an upload opportunity giving detail of content and approval reference
- Admins create FTP account on a purpose-built server
- Admins send back time-sensitive FTP details
- Design company uploads to FTP server
- Committees review content, send authorization to admins
- Admins upload content.
And this was for already-approved work. Kinda puts this level of security to shame...
-1 not first post
You make a very good point.
North Korea is also part of the "Axis of Evil". However they have WMD's and some pretty nasty long range missiles. They may not be able to strike The US, but they could devastate South Korea, Japan and Taiwan. We keep begging North Korea to please, pretty please, come to the negotiating table. No talk of invasion there.
Sadam complied with the U.N. inspections we demanded. Grudgingly but he complied. He ended his weapons programs and allowed us and our allies to control two thirds of his air space. (All of this had to be forced on him, but he complied).
So the moral of the story?
If you are an evil dictatorship, do not comply with The US and its allies. Build up your arsenal and become as powerfull and as dangerous as possible. The US only invades weaklings. The US begs for negotiations with the dangerous crackpots.
I believe Iran watched all of this unfold. The way Sadam and Iraq complied, and were rewarded with invasion. The way North Korea refused to comply and became more dangerous, and gets more and more aid on its terms.
This is why Iran has restarted its nuclear program.
Pretty good foreign policy we have, huh?