Slashdot Mirror
SuperProf Private Tutor Site Fails Password Test, Makes Accounts Super Easy To Hack (grahamcluley.com)
Superprof, which claims to be "the world's largest tutoring network," has made its newest members' passwords utterly predictable... leaving them wide open to hackers. From a report: SuperProf is a website that helps you find a private tutor -- either online via webcam, or face-to-face. The site claims to have over three million tutors on its books, helping people learn languages, how to play musical instruments, or giving kids extra lessons in tricky subjects. It's not the only site which offers these kind of services. For instance, SuperProf has just taken over UK-based The Tutor Pages, and -- to the surprise of many Tutor Pages teachers -- migrated them to SuperProf. And, sadly, that account migration has been utterly incompetent from the security point of view.
In an email that SuperProf sent Tutor Pages teachers last night, it shared details of how they can login to their new SuperProf account. If a tutor's name is Barbara, her new SuperProf-provided password is "superbarbara". Clarinetist Lisa's new SuperProf-supplied password is "superlisa."
In an email that SuperProf sent Tutor Pages teachers last night, it shared details of how they can login to their new SuperProf account. If a tutor's name is Barbara, her new SuperProf-provided password is "superbarbara". Clarinetist Lisa's new SuperProf-supplied password is "superlisa."
Looks like someone needs tutoring in security. ;)
Anons need not reply. Questions end with a question mark.
Those passwords are superretarded.
I just made myself a level 99 algebra!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Actually it is.
When ever I hear about a product bragging about its security, it is usually the ones with the most obvious flaw.
Because people who know about good security, understands how hard it actually is, and would never put their reputation out saying that their stuff is completely secure and safe.
"I have never had my product hacked" That doesn't mean it is secure. Just that it wasn't a target, or compatible with the common forms of hacking.
When you have a product meant for the general public, you are under the gun on making it easy for the right people to use, and hard for the wrong people to use. The right people will tend to forget passwords or make stupid ones.
Then there is software security. There is a degree of trust in your software that you cannot completely control. A flaw in your OS, a Flaw in the Web Server, A flaw in your programs library.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Or, also quite likely, you never realized you were hacked, either because they covered their tracks too well, because you were just too incompetent to properly check, or just because you refused to listen to poor beleaguered sysadmin who tried to tell what was going on.
"1-2-3-4-5? That's the stupidest combination I've ever heard of in my life! That's the kinda thing an idiot would have on his luggage!"
"1, 2, 3, 4, 5? That's amazing! I've got the same combination on my luggage! [Sandurz and Helmet look at each other in disbelief]"
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Just as likely it means that you haven't noticed the hacking yet.
Does that mean I can get admin privileges with the password "supersuperprof"?
True enough.
Security is hard though, and you are constantly needing to find a way to make it better.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The passwords should have been superlisa1, superbart1, etc. N00bs. All of em.
The most shocking about this news article it that it isn't a Florida woman!
superrobert';deleteusers--
Derp Derp!!!
superderp, RTFS!
"WIDE OPEN TO HAXX0RZ!!1!elebenty" is not remotely funny. Or informative.
But it's very msmash.
Barely an inconvenience...
The server password is: superpassword
but don't tell anyone
Yet another web-site company with no qualifications to do so managed by morons.
Whatever. Most of this shit is ran by idiots, this is no exception.
I wish I could say I'm surprised, but this is yet another example of what is probably a marketing company who wants ads and analytics, and who has a half-ass website because there is no budget for qualified tech people.
The web is shit, caveat emptor.
I am reminded of when my school got its first Windows network in the mid-90s. All of the pupils were initially given the password pupil. It didn't take long to guess that all of the teachers had been given the password staff, and some hadn't changed it. The headmaster hadn't changed his either: it was head. We had some fun with WinPopup for the first couple of weeks...
If the default passwords are so easily guessable, what other security weaknesses does SuperProf have? Can someone break into their servers, and get the SSN and bank account numbers of their tutors and students?
Nope. You need to login with password 'superadmin'
The company CEO's password is 'superuser'
and the backdoor is 'superroot'
The backdoor to the backdoor is 'superNSA'
and the hidden directory is 'superKGB'
You can rob the company blind of its virtual currency holdings with the username 'superwallet' or just empty the conventional bank accounts with online password 'superbanking'