Insecurity Assessment: Daily WTF

Friday’s Daily WTF offers an amusing and altogether terrifying look at the inept coding on a large brokerage firm’s web site — the same site that controlled things like statement access, wire transfers, and trading. Check out these gems:

ViewStatement.jsp - Responsible for
displaying electronic versions of the monthly statements, this page was
always called with a single querystring parameter: StatementId. And
because StatementIds were sequential … you can pretty much see where
that went.

TransferFunds.jsp - This page would
initiate an ACH transfer between the brokerage company and the users
stored bank account numbers. Only certain users were authorized for
this page, but a sophisticated hacker might be able to figure out that
setting the “canUseACH” cookie token from “N” to “Y” might do the trick.

All of these goodies and more via The Daily WTF.

———————————————

Update:

And while we’re at it, let’s take a look at a very web 2.0 method of link-tracking:

When a user clicks a hyperlink, the followLink() Javascript function is executed and the following occurs:

• a translucent layer (DIV) is placed over the entire page, causing it to appear “grayed out”
• a “please wait” layer is placed on top of that, with an animated pendulum swinging back and forth
• the XmlHttpRequest object is used to call the “GetHyperlink” web service which
• opens a connection to the database server to
• log the request in the RequestedHyperlinks table and
• retrieves the URL from the Hyperlinks table
• returns it to the client script, which then
• sets the window.location property to the URL retrieved, which causes
• the user to be redirected to the appropriate page

This is why when I hear “Web 2.0″ I hear “kiss of death.”

Google Romance - April Fools

Google’s April Fools offering this year is Google Romance. Google can help you solve “inaccurate, disappointing or otherwise cosmically unfair romantic results.”

Do you think the “Post multiple profiles with a bulk upload file, you sleaze” gave it away?

Speaking of April Fools, I am somewhat ashamed to admit that I was fully taken this year. I received a hot tip about a new limited edition remake of a class Pez Arithmetic dispenser, to be sold from the currently under construction Pez store. A fellow Pezhead had found a backdoor, and by clicking store links in a specific sequence, he was able to place his order. After several minutes of fruitless clicking, it dawned on me. . .d’oh!

Steven Seagal: Crystal Cave Hilarity

This is one of those gems you don’t come across too often, but it makes your day when you find them. So, Steven Seagal is a musician? The verdict is still out, but the tongue-in-check reviews at Amazon are very amusing. For your enjoyment:

"I bought several copies in case I became hungry on the way home. I rushed home, changed into my athletic gear and utility belt and immediately began doing pushups. It was like I was a man possesed. I didn’t know it at the time, but this CD harnessed the work ethic, the martial arts prowess and, above all, the stunning handsomness and fashion sense of Steven Seagal into one small package. All that I had to do was press play and I was transformed into the essence of Casey Ryback, ex-navy seal, counter-terrorist expert and environmental mercenary."

"Neither Buddy Guy, Stevie Ray Vaughan, nor B.B. King can hold a candle to Steven Seagal. He is the greatest, just ask him."

"The second song "Don’t you cry,’ is a gentle but firm warning to the previous girl that it would be in her best interests not to cry. Next is a fairly odd ’song’ called ‘Music,’ where Steven simply says the word ‘music.’ Then it rolls into ‘Better Man,’ which is Steven’s way (along with a full and raucous gospel choir) of calling out all the other musicians in the world to "just try and step up to this funky beat." The next song should have been a hit: ‘Lollipop,’ a tender soliloquy about the farmers of America. Then comes the hard-core gangster rap ‘Not for Sale,’ where Steven pulls no punches about how certain things (rainbows, grandmothers) are not for sale."

"Even better than Hasselhoff!"

"This album not only clensed my spirit, it helped me conquer my fear of lollipops."

So there you have it. He breaks legs, hearts, and charts.  Crystal Cave reviews, via Amazon.com

[Read more]

Just Another $.50 Toy

I think what I find most amusing about this is that this is the second story of this nature that I’ve read. That crazy claw game is just irresistible to kids. How do they fit up the chute? Is this a case of poor design or poor supervision? This is what I have to look forward to in a few years, I suppose.

Story via Minneapolis-St. Paul Star Tribune

That thing got a Hemi?

I missed this when it was new — then again, it’s not exactly aligned with any of my interests, but how often do you see a Big Wheel outfitted with a Hemi? Ahh, the Big Wheel. Mine had a hand brake that you could yank to do neat fishtails spins.

All contest finalists at Chrysler’s What Can you Hemi site

Creative Distribution: Pot-laced candy & soda

Toka-Cola, Pot Tarts, Puff-A-Mint Pattie, Stoney Ranchers, Munchy Way, Buddahfinger, Twixed, KeefKat, Double Puff Oreo. . .oh my!

via The Smoking Gun

Isolatr: Web 2.0 Parody

I suppose it’s a sign of the times when the web 2.0 parodies seem to be executed better than actual business ventures. Viva Isolatr!

Visit Isolatr

Tango Cars: Make Miatas Look Like Hummers

This is well off the beaten path, but I ran across these Tango cars the other day — and at the risk of sounding too American, with our love of large cars and utter disregard for the environment and natural resources and all — I got a good chuckle out of them.

• They are 39″ wide — that’s narrower than a Honda Goldwing motorcycle!
• 8.5′ long, so they can park perpendicularly to the curb.
• 0-60 in 4 seconds with a top speed of 150mph.
• The T600 can be yours for just under $120,000. What a steal!

Online Fling Turns Out to be Man’s Mom

“Sweet Juliette” and “The Prince of Pleasure” carried on an online romance for several months, and began falling for each other. They simply had to meet. They show up at the agreed upon place, and <gasp!> “Oh my God, it’s Mama!”

“Danny and I were so flustered, we blurted out the whole story to the cop,” recalled matronly mom Nicole, 52. “The policeman wrote a report, a local TV station got hold of it — and the next thing we knew, our picture and our story was all over the 6 o’clock news. “People started pointing and laughing at us on the street — and they haven’t stopped laughing since.”

View story (via Yahoo! Entertainment)

Fight Club for Software Engineers

I must admit that I’m not sure what to make of this. It’s like your grandmother’s version of Fight
Club, except with software engineers.

Picture Fight Club, without bare fists, but with toilet seats (Hello Kitty toilet seat, no less, I kid you not), rolled up magazines, and broomsticks.

Really, I’m at a loss. It reminds me of Starship Troopers and The Blair Witch Project. Mildly amusing, mostly painful, altogether confusing.

via CBS5.com, San Francisco

Tags: Fight Club, Video

« Previous Page — Next Page »