-
☆ A M B ☆
- 24,524 Posts
Stefanie, would you recommend any of your fork's branches for production use at this point?
At the moment I'm working in
https://github.com/sjstoelting/evolution/tree/1.1.dev.clearing-japanese. I add phpDocumatator tags and do the code cleaning again, meaning functions should only have one exit. As you may see, I also change the code formatting back to MODX standards and go back to the original sort order of the functions.
This branch is done on 1.1.dev and will be merged back, when I've finished that work. I hope to have this done until the end of the weekend.
Can you please test, that the changes you have done are working as they should after the huge commits of the Japanese community?
-- Corrected Typos
[ed. note: Stefanie last edited this post 14 years, 4 months ago.]
Gone away and found a better place to stay
-
☆ A M B ☆
- 24,524 Posts
Will do; probably not until the weekend though.
Just wanted to say how excited me and my friends are with this! Thank you guys so much.
Re YouTube demo: stunning! Hacker deciphered that CAPTCHA in less than a second! On the security issue itself, it would be good to have more practical demos of vulnerabilities we need to protect against.
;) KP
-
☆ A M B ☆
- 24,524 Posts
I have no idea what was going on here. Is this supposed to be somebody hacking a MODx Manager login? Why would somebody put a base64 decode function in their Ditto call? And &startID has been deprecated for years in Ditto; &parents is the correct property.
I do know what that first video is about and I'm not amused.
It is SQL injection through an addon. That addon does not sanitize parameters and you get direct access to the database.
After getting password hashes, try to reconstruct the password. MD5 hash is not secure, it should be switched to SHA1. I thought about it some time ago, but I have not thought about unsecure addons.
By the way, captchas are only to annoy the normal user. There are a lot of tools available, to go over captchas, and this programs are much better in reading them, then I am. In three words: Captchas are useless.
PS.: I forgot to mention, that deprecated doesn't mean not available.
Gone away and found a better place to stay
The demo is showing how a hacker can use information from a PHP error message to break into the MySQL database. Some of it went right over my head, some of the Russian notes were too fuZZy for me to read, but the point from earlier in the thread is that it's dangerous to display programming error messages, while the demo is saying that escaping is not always enough to protect against SQL injection (this example needed to make sure the $pid variable is an integer).
After gaining access to the database with info from the error message for a bug in the gallery code, the hacker is using a script to get a password from the MODX manager users table by trial and error, building it up character by character. They then feed it into an MD5 cracker to make it plain text and use that password to break into that user's site that is linked to from the gallery. (I think - someone was shredding documents next to me while I was trying to watch the video!)
Apart from the MODX/SQL security aspect, the video is emphasizing that you should use different passwords for different sites - the victim here had used the same password for a WP site and somewhere else.
8) KP
(edit: apologies for the info overlap - how I miss the "someone has updated the thread while you were typing" message from the old forum. But let's not get into SMF nostalgia here...)
[ed. note: kp52 last edited this post 14 years, 4 months ago.]
