search
Carter Cole LinkedInCarters Twitter PageCarter Cole on FacebookCarters YouTubeCarter Coles RSS

Thursday, June 10, 2010

I knew an open source CMS was a bad idea for whitehouse.gov

I like playing with security... its fun to break things (of my own or with permission) and its what makes security work. If we never tried to break the design and assumed security then the less moral of us would and they would find our code easy pickings. XSS is one of my personal favorites because they are everywhere, usually easy to find, and can be super nasty (sammy is my hero)

So when i heard that Obama was going to make the WHITEHOUSE.GOV website a Drupal site i thought it was quite dumb... i mean its the whitehouse... you need a friggen CMS? hell waste some money on an old fashion webmaster and have it all flat html (i just think that a defaced homepage for america would totally suck) with the code for the site open source I instantly now know about most of the code that whitehouse.gov runs on and i can do my own pen testing before i even try on the whitehouse.gov domain. I wasnt alone in this ha.ckers.org makes these same exact points... and i commented on it

flash forward 211 days


what happens across my RSS feed? do my eyes decieve me? zomg its an article describing how Drupal is redefining its policy to clarify it only supports security on STABLE releases
and...
The clarifications are a response to the discovery of a potentially serious XSS hole in the Drupal Context module three weeks after White House developers proudly released their own plug-in based on the buggy module.
- from The Register

i hate being right

now i haven't looked at the XSS hole myself yet but they said it was in the administrative console (they say that makes it limited i think that now i can steal the admin auth cookies) even if they caught it in time this is the exact issue i was warning about. am I crazy? what do you think? id love to spark off a good discussion on it :)

8 comments:

  1. The added is Louis Vuitton Coeurs Charm.It is louis vuitton replica absolutely a admirable Valentine item,I think.It is fabricated of gold-finished assumption & lacquer,and actualization tiny hearts in ambrosial colors.You can use it as a key ring too if you wish! What's added important,The hearts are altogether advised in such admirable colors that will absolutely sweeten the attending of prada replica your gucci replica.So ambrosial and romantic.If you wish a beautiful accent for your gucci replica,again a attractive Louis Vuitton agreeableness is what you're searching for.Let's personalize our accoutrements now!In the aboriginal 1800's,Louis Vuitton began as a baggage packer for replica louis vuitton the affluent Parisian families.He abstruse his barter able-bodied and with some automatic account and a lot of harder work,absitively to try his duke at designing his own luggage.His baggage was accurately advised to fit perfectly,while getting stacked,in baggage cars.Louis Vuitton created his replica belts own aggregation in the year 1854.Then to atom accurate or affected become an important affair during the online shopping.Actuality sum up four advantageous methods to atom affected Swatch watches:Each accurate Swatch has a altered account No composed by English belletrist and Arabic numerals.Altered belletrist angle for replica watches uk altered series.Abounding humans now adopt affairs a Swatch watch online to save time and money.

    ReplyDelete
  2. Chinastars has been engaged in the R&D and production of Reflective tape and Reflective vest for over decade years and is now the largest manufacturer of reflective material and high visibility clothing in China. Reflective material we have reflective fabric, fire resistant reflective tape, heat transfer film, reflective ribbon and yarn etc. We also manufacture safety vest, hi vis jackets, sportswear and uniforms where our reflective material are widely applied. See more on chinareflective Safety vest

    ReplyDelete
  3. Quester is a Pakistan-based questioning answering website where people can ask questions and we try our best to provide them with the best answers. Anyone can ask any legit question in English or Roman Urdu and we provide answers in the same language format. www.quester.pk

    ReplyDelete
  4. Quester is a Pakistan-based questioning answering website where people can ask questions and we try our best to provide them with the best answers. Anyone can ask any legit question in English or Roman Urdu and we provide answers in the same language format. www.quester.pk

    ReplyDelete