Frackin script kiddies!!

[jarod-ajLrJawYSntWk0Htik3J/w at public.gmane.org (Jarod Wilson)]

On Wed, Aug 4, 2010 at 11:08 AM, Richard Pieri <richard.pieri-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
> On Aug 4, 2010, at 12:04 AM, Jarod Wilson wrote:
>>
>> Sorry, why does where the data is stored matter? With the online
>> banking I've seen, you still connect to a site via ssl first. No
>> authentication yet. Then you authenticate. Then you can see all your
>> financial information. How is this ultimately any different that
>> having to authenticate and then seeing data that is on the same
>> machine? Only difference I see is that perhaps the bank is a bit
>
> Everything. ?Everything is different.

Take it a step at a time. Start with encryption. Then authentication.
Both cases (banking site and my mythweb deployment), encryption comes
before auth. *That* part is the same. And that's the same part you
insisted was weak. In both cases, if the authentication is defeated
(the attacker has your login info), they can see all the data. They
can see my television recordings and they can see my bank statements.
They can delete recordings, they can delete automated payments. They
can schedule new recordings, they can schedule new automated payments.
It really doesn't matter that the bank has a multi-tiered setup,
because they now trust the individual that has managed to get
themselves logged in to your account.

At this point, actually hacking into the system underlying the web app
hasn't even come into play at all yet. And even actually gaining
access to the system running the web server isn't particularly
different in either case -- very recent reports showed that the market
leader in web servers is apache running on CentOS. So its entirely
possible the *exact* same (theoretical) apache exploit could be used
to gain access to both my myth box and the bank's edge web server. Its
only *after* a successful hack that "Everything is different" really
starts to be valid.

> I've already explained it quite thoroughly but since that is insufficient to convince you. ?So, there's really no point in me wasting my time.

Yes, I still contend that you've left a lot of my questions without
any satisfactory answer. So no, I'm not convinced. Regardless, I've
actually enjoyed the discussion, and I apologize for wasting your
time. :)

-- 
Jarod Wilson
jarod-ajLrJawYSntWk0Htik3J/w at public.gmane.org