IoT camera crew Titathink tells Reg it'll patch GET bug in a week Titathink has become the second vendor to respond to the modified firmware that exposed a variety of surveillance cameras to a malicious URL attack. As we wrote last week, a security pro called Slipstream looked long and hard at the cameras' firmware, and found a URL that carried a parameter called “basic” would be copied to a …
I thought that was one of El Reg's joke names. Who would unironically name their company that?
It's IMHO still beaten (sorry) by what happened to Powergen in Italy :). That said, the name is not of English origin so it may contain traces of culture, foreign language - or nuts.
In the last couple of weeks we have had directory traversal, open management ports without defined address ranges and multiple credential guessing attacks. What's next - a resurgence of SQL injection? Come on people - this is basic stuff.
Dear web experience manager - Next time that employee with a liking for doughnuts and coffee, no fashion sense and a claim to 10 languages none of which he can use to communicate with human beings says "are you sure? Can you just confirm that in en email" remember - that glint in his eye is his anticipation of watching you wet your pants in panic as your latest bit of shiny web experience crashes and burns due to the sheer weight of uninformed decision making.
What do you mean a resurgence? SQL injection never went away. Just look at questions people on Stack Overflow are asking related to database querying from an external program/script. At least 90% of the people asking on that topic are building their queries by concatenating user input into query strings. It's like prepared statements don't even exist for most developers.
What's even more fun was when I was researching non-web TLS/SSL to secure my garage door app.
There were tons of the usual SSL questions on Stack Overflow, but most of them were answered with "here's how to make your SSL code accept ANY certificate" which pretty much turns SSL into an exercise in burning CPU cycles.
And the response was "thanks mate!" and NO ONE ever said it was for testing, nor were there any warnings to not use that in production, and the security implications were never discussed.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
