Hacker News Reader

After seeing that the feed had been hijacked I poked around to see how easy it was.

My first guess was http://macrumorslive.com/admin which contained the full source code and password hashes to everything on the site.

They must have had a strange configuration because their .php files were showing as plain text files. This revealed their master DB username/password along with many other ways to exploit the site.

There's a reason security through obscurity doesn't work. Unfortunately MacRumors had to find out on what was probably their biggest day of the year.

There's a reason security through obscurity doesn't work

The even worse part is, it isn't even obscure! The path is /admin/ not /walrus/ or something. And why would they have plain-text php files at that URL? It's like shooting yourself in the foot and lighting yourself on fire in a bear pit at the same time.

For the love of GOD. The Internet has been around a few years now. It's time to stop doing stupid shit like this.

Lesson learned for them, then.