Web Security is Fun!

[wolffyluna]

So, you know how pillowfort.io had some security down time a little while ago? That was roughly when I went from 'ooh, I should buy a key some time' to '...let's wait and see.' Mostly because I'm not a security expert, and I didn't know the details, so I wasn't sure if they were caught out by something weird, or if this was a moonpig level You Should Have Predicted This sorta security issue.

Turns out, it looks like it was the latter!

Which, gee, oof. I mean, yay my instincts, for predicting it'd be this sort of thing-- but oooooof.

Yeah, so definitely not going to pillowfort until they've at least done some more pentests.

Comments

[tornir]

After it was taken down, the 503 page announced to the world they were using a four year old web server.
The server's dev site lists every patched vulnerability, and the versions affected by it; Black Hat shopping list. :(
I don't know if they've patched that (I don't even know if they can), but I too have adopted a '...let's wait and see.' policy, while hoping my friends who haven't don't get burned.

[wolffyluna]

Oh my goodness, it's turtles security vulnerabilities all the way down.

[tornir]

Humble have a book bundle these guys should really get, and it'd only cost them three keys.