News for hackers. Stuff that matters.

A comment on Accessing Publicly Available Information on the Internet Is Not a Crime. Parent comment

Re:Accessing Publicly Available Information on the Internet ... by mnw21cam on Thursday December 14, 2017 @10:50AM (#15923181)
From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through.

For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report that a database was lifted with usernames and passwords either in plaintext (for the love of all that is holy) or hashed with unsalted SHA1, or similar?

[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by gkya on Thursday December 14, 2017 @11:35AM (#15923625)
I wish there was a "web security checklist" where if you ticked all the boxes, you can be pretty sure you have the well-known holes covered. This is why web frameworks are really useful, the decent ones get you way ahead in securing your application from the most common attacks. But if you self-bake, then you have to manage the entire complexity of the web platform.
[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by npsimons on Thursday December 14, 2017 @12:04PM (#15924007)
> I wish there was a "web security checklist"

https://www.owasp.org/index.php/Main_Page

https://www.stigviewer.com/stig/database_security_requiremen...

[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by nicoburns on Thursday December 14, 2017 @11:54AM (#15923904)
This doesn't cover everything, but it's a pretty good starting point:

https://stackoverflow.com/questions/549/the-definitive-guide...

[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by deejaybog on Thursday December 14, 2017 @12:02PM (#15923991)
OWASP top 10 is as close as it gets to a checklist: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...
[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by jrimbault on Thursday December 14, 2017 @11:26AM (#15923531)
I think most "hacks" have been the results of social engineering and misconfigurations rather than software/hardware vulnerabilities.
[ Parent | on HN ]
Re:Accessing Publicly Available Information on the Internet ... by talmand on Thursday December 14, 2017 @01:18PM (#15924863)
I keep plaintext passwords, but I reverse the string to prevent the hackers.
[ Parent | on HN ]