3 ms·

Looks like they had an admin update panel that was "secured" through obfuscation: http://img.skitch.com/20090106-p2dughwb2yujxdutfh55ixxajn.png http://img.skit

• jedc 18y ago
  Lesson learned for them, then.
• tdavis 18y ago
  For the love of GOD. The Internet has been around a few years now. It's time to stop doing stupid shit like this.
• Jasber 18y ago
  After seeing that the feed had been hijacked I poked around to see how easy it was. My first guess was http://macrumorslive.com/admin http://macrumorslive.com/admin which contained the full source code and password hashes to everything on the site. They must have had a strange configuration because their .php files were showing as plain text files. This revealed their master DB username/password along with many other ways to exploit the site. There's a reason security through obscurity doesn't work. Unfortunately MacRumors had to find out on what was probably their biggest day of the year.
  • tdavis 18y ago
    There's a reason security through obscurity doesn't work The even worse part is, it isn't even obscure! The path is /admin/ not /walrus/ or something. And why would they have plain-text php files at that URL? It's like shooting yourself in the foot and lighting yourself on fire in a bear pit at the same time.