The Moonpig Bug: How 3,000,000 Customers' Details Were Exposed

It's been all over the British news today: developer Paul Price found a bug in photo-crap-maker Moonpig's site, one that might have exposed three million users' personal information. Paul's got a great technical post about it at www.darkport.co.uk/blog/moonp... -- but there's no decent non-techie explanation except for the one-paragraph summaries in newspapers. It was a perfect storm of tech incompetence: here's how to avoid doing it yourself.

[@s6th795]

Rule #1 of database design: All user input is evil. No exceptions.

[@AshtonSnapp]

What if the user input causes an exception?

[@tiny_toilet]

@@AshtonSnapp See Rule #1.

[@Tobias-nv3dx]

@@AshtonSnapp I laughed way to hard at this ...

[@AshtonSnapp]

Tob ias I’m glad to know that :D you have an awesome day

[@KnakuanaRka]

Or at least treat all user input as possibly malicious.

[@sxa555]

I'm really hoping that the term "moonpigging" becomes a term for companies that give a vague "Your security is important to us" message. Next time I get one (on twitter) I'm RT'ing it with a message "I'VE BEEN MOONPIGGED"

[@thejay8963]

sxa555 Moonpigging Mün-pig-ing When a Company lies about internet security by making false claims of security that stated company does not have.

[@techheck3358]

Tom Lake Charles Moonpigging /muːn/pɪɡ/ɪŋ/ verb *VULGAR SLANG • ENGLISH* 1. When a company makes a very specific denial of a security bug “I was moonpigged” _synonyms:_ disgrace, dishonour, disrespect

[@hencytjoe]

I hereby take the liberty of claiming this term as a valid choice of expression for the aforementioned reason.

[@richardmillhousenixon]

@Kanashimi You can do that with Google Home

[@qqqalo]

When someone claims to care about your data it means they want to sell it and couldn't care less about it.

[@SorryBones]

“If they respond I’ll put it in the description” ...a half decade waiting list huh? They must be very very busy

[@liquidtvafternoons5315]

@@ejewart1450 the patients don't last long

[@aliabdaal]

Wish I’d mined bitcoin in 2015

[@distantt]

I wonder how it works

[@hgu]

Rip

[@lukasvavrich3349]

I did. And i forgot about it. And now there is a bitcoin wallet somewhere on the internet with $800 000 that i can't access. RIP me.

[@distantt]

@@lukasvavrich3349 rip you

[@youngclueless7364]

Ik ur cousin

[@petartodorov9202]

231 weeks since this video was uploaded. Tom hasn't updated the video description with moonpig's response yet...

[@PackerFanGamer]

5 years no update

[@taylor1991]

Does anyone care, doesnt have to be impartial or balanced

[@butikikisame2548]

I don't think Moonpig responded at all. I can't find any article after Moonpig's initial public response.

[@IvanLDiaz]

September 9th, 2020. Pandemmial here. Tom still doesn't get a reply.

[@addisonchan3053]

@@IvanLDiaz Someone seeing the word pandemmial 50-100yrs onward would sound like some trend name or something.

[@Fraktallity]

Tom scott- Defenitley not sponsored by moonpig.

[@Fraktallity]

***** No such thing as bad publicity, however I doubt tom would have sold out that hard if at all.

[@kobiemelverton2231]

By law, he has to state it

[@kikicat123]

you need to send that grammar to moonpig

[@benjaminpatterson3535]

+kobie melverton we all know that now don't we

[@jpeg8596]

Fraktallity - Cheeky Videos ( ͡° ͜ʖ ͡°) He wouldn’t because it is illegal to not disclose that you’re sponsored.

[@mena376]

half moon, half pig, and half bug.... no wait

[@theLuigiFan0007Productions]

The 3 halves you just mentioned caused a buffer overflow in the terribly written site. Congratulations, you now have root access to everything. :DDDDDDDDDDDDDDDD

[@froidesprit]

theLuigiFan0007 Not upvoting your comment because you will then have two different buffer overflows.

[@pinkribbon1007]

mena3976 😂👏

[@panda4247]

It's half moon and half pigbug. Better call Al Gore

[@Banzybanz]

Lulz. This week the same topic was revisited in South Park.

[@AwesomeMinecraftersakuraodomMC]

I cringed so hard when he said that Moonpig decided to use consecutive IDs. I think I'm finally becoming a computer nerd

[@kristiansvendsen6906]

Nope just a weaboo

[@froidesprit]

Nah, definitely a computer nerd. I cringed too, and I am the most anti-anime person alive.

[@TheHaughtsauce]

There is nothing wrong with consecutive IDs. If you think consecutive ids are a problem, it is actually a symptom of a much larger authentication/authorization issue

[@CrazyConnor2]

Same XD

[@undead890]

Consecutive ID's aren't the problem, as long as they are only used on the backend and no one ever sees them.

[@LeftRight1511]

The notion that people still don't "code like they're being attacked" astounds me. One of the first formal courses I took in programming, the lecturer made it very clear we understood the notion and importance of defensive programming.

[@ktcd1172]

Some of us are Old School Programmers. Way back in the day the only kind of real hacking that needed to be worried about was some student coding something that would walk a printer across the room until it pulled the plug from the wall shutting it down until you could get engineers into the facility and haul it back into place and reset the equipment with the system. Security was maintained with locks on the doors and ID checks on personnel allowed into the locations with terminals.

[@Toothily]

@@ktcd1172 okay boomer

[@WildBluntHickok]

@@Toothily Nice to see someone using the word boomer correctly. I'm from the generation after the boomers and what he's talking about would've been when I was a kid in the 80s.

[@nichm7318]

@@WildBluntHickok o k b ö m e r

[@doomse150]

Or you could just start using a high level web framework, since the people designing those usually know what they are doing way better than you do

[@beenis08]

Companies: writing bad code Tom: "yall are getting paid?"

[@chewtag]

not funny

[@beenis08]

@@chewtag damn... and i assume you didnt laugh? 😞

[@codinghub3759]

@@beenis08 was funny, did laugh

[@GamesFromSpace]

Another pro tip: If you're working with offshore developers, always make sure they implemented features the way you requested. I've narrowly avoided silly problems like "sequential customer IDs" or "token strings containing user info" that way. You get what you pay for.

[@robertlozyniak3661]

+Joshua Pearce I wonder which is harder, making sure they do it the way you want or just doing it yourself.

[@GamesFromSpace]

Robert Lozyniak It depends if doing it yourself means reading their code.

[@jacobtracey555]

TL;DR: Don't hire Indian programmers.

[@eTiMaGo]

@@jacobtracey555 Nothing wrong with them, but I once had an Indian friend tell me that the best programmers there end up getting hired by large companies, leaving mostly newbies and low-skilled programmers left on upwork, freelancer, etc.

[@mystic_galaxies9832]

@@jacobtracey555 and why Indians specifically?

[@erictaylor5462]

I found a security hole in a courthouse. I had Jury Duty so was going to the court house every day. I also have a fake leg that sets off metal detectors. This meant, every day I went there they had to pull me aside, scan me with a hand held device then check my leg. They did this the first three days, then on the 4th (and all the rest of the days) they just waved me through, without bothering to check. This meant, had I wished to, I could have easily gotten a gun or other weapon into the courthouse. When I called they were very interested to hear this. They thanked me and quickly fixed it.

[@liesdamnlies3372]

+Eric Taylor Government showing more responsibility for security than a large corporation. I don't know if I should be surprised or something else.

[@erictaylor5462]

***** This wasn't "government" This was a single individual who's ass would have been on the line had someone managed to get a weapon in. Also this was several years ago. Who knows if the same thing wouldn't happen again.

[@liesdamnlies3372]

Eric Taylor Well, okay, someone working for government. Which yes, I'm definitely surprised, given that the level of incompetence demonstrated by government in IT can be staggering. (I've received passwords, which can't even be changed, from government websites, via email in plaintext. Cringe.)

[@erictaylor5462]

***** I sent my sister a password in code at least.

[@toproudtooadmitmitsake1842]

@@erictaylor5462 You're thinking too zoned in, it is the government, you can never rely on security to police itself, complacency especially in repetition is human nature, the onus is on the government to monitor quality and ensure safeguards are in place to keep a constant standard of security.

[@Arbenowskee]

As Tom mentions in 3:34 - a word of caution, always report these kinds of bugs through a lawyer. Big companies will happily sue you or report you to police for "hacking" instead of saying thank you, even if your intentions were 100% honest and you showed them that. Has happened to more than one person I know.

[@OmegaCraftable]

"Code like you're being attacked", love that. :) Great video as always!

[@57thorns]

Because you are under attack, this is the internet we are speaking of.

[@kusaisama]

💗

[@kujmous]

One could only guess what rights account number 1 was allowed to do.

[@AshtonSnapp]

kujmous Acc No 1 is probably the admin.

[@Hahahawhatsup]

cheers sherlock

[@lyrimetacurl0]

What about number 0? The boss?

[@mitch_tmv]

no number 0 is the time traveller

[@Chris_Cross]

Try -42

[@mathgeniuszach]

I agree with you; something my uncle always says: whatever you program, try to get it to fail. Don't program it to fail, but test it and try to get it to fail so you can fix it. That's one of the reasons I like ethical hackers so much and the companies that use them; you know they won't easily fail to simple security flaws. Kudos to anyone who finds these issues and reports them urgently, safely, and carefully.

[@rud]

"someones ugly baby". Telling it like it is. :D

[@Pangloss6413]

Nice username

[@elminz]

I think one of the biggest things I learnt about security from hackers when working on online games is: "Assume all data you get could be a hack". Even if it's as simple as someone's date of birth, assume it could be forged data designed to break your system. No exceptions.

[@georgiishmakov9588]

date of birth: 1901-1-1"; DROP TABLE Customers;

[@Foul_Quince]

I am constantly amazed how many developers incorporate security through obscurity as a strategy.

[@rogerwilco2]

The problem is that a lot of these things are done when a company has no clue about code themselves and hires someone with a fast talk, or has the 16 year old son of one of the managers do it in a weekend. And then it stays in the code when the site grows and starts attracting lots of costumers. Nobody will be asked to look at it, because "it has worked reliably in the past".

[@tymo7777]

You are a fantastic model for a responsible public figure on the internet.

[@HenryW9]

"Ah, nobody will notice this" - a very british attitude

[@hikari_no_yume]

Also rather reckless. :(

[@geraldhenrickson7472]

Henry W: British? Denial seems a rather large factor of the human condition. I believe anyone, anywhere could say this.

[@geraldhenrickson7472]

Mr Shekel: Why fuel the fire of discontent? Stop blaming all of a given nationality... for the acts of but a tiny few.

[@pepperjeanne1566]

More like " a very *human* attitude"

[@John2find]

I thought it was Indian attitude.

[@europeansovietunion7372]

I'm pentesting right now. This one has no ink anymore, next.

[@mastertrams]

Ok, that was a good'un, but I think you're deliberately missing the point. Wrong type of pentesting mate.

[@scepto43]

@@mastertrams cant tell if thats a r/woooosh or not

[@JustPoaj]

@@scepto43 r/wooosh

[@addisonchan3053]

@Michael Darrow r/noheacknowledgeditasajokebutwantedtomakesurehewasntjoking

[@legendarytat8278]

@@addisonchan3053 r/ihavereddit

[@jacob416]

Context:I live in America. My professor always said “this isn’t the justice system, everyone is guilty until Proven innocent not the other way round.”

[@electricspider2267]

You're innocent, but btw could you like stay in this tiny room for months until we can prove youre actually guilty. Notice i didnt include a '?' Because i'm not asking, im forcing.

[@jacob416]

@@electricspider2267 you forgot "unless you, or someone you know, is able/willing to pay several months worth of your salary all at once, because that's a completely reasonable request of someone who more than likely lives paycheck to paycheck. aren't you glad we have such a flawless and perfectly morale system"

[@erictaylor5462]

Another thing to remember:There is NO SUCH THING as a 100% secure system. The Germans thought this about Enigma. They paid the price. Well the other Germans paid for them but you know what I mean.

[@adaai2384]

+Eric Taylor That is true but it's also irrelevant. There is no excuse for large companies not following the current best practices for information security (in the UK it's a legal requirement). What Moonpig did is analogous to a bank leaving all of your money on the sidewalk with a sticky-note saying "please don't steal this." And then they tried to insist they weren't doing anything wrong.

[@erictaylor5462]

GenericRubbishName I never said they shouldn't attempt to secure information. It's just that locks are for keeping honest people honest. You should always be trying to improve security. Donitz only SUSPECTED Enigma had been broken so added another wheel too it even though all the experts told him it was impossible to break Enigma. Even though this step improved the Navy's performance (at least for a while) the Germans STILL didn't realize the English had broken the Enigma code. The English were reading the dispatches before the German commanders were.

[@JustusLynetta]

Honestly, theoretically enigma seemed unbreakable but it had a major flaw. You should check out the new version of enigma which is several magnitudes better and most likely won't be able to be cracked in humanity's time.

[@erictaylor5462]

PacManAction That doesn't even make sense. "Theoretically seemed"? It was, to the people who designed it "theoretically unbreakable" and thus seemed unbreakable, but the theory was wrong. And you're right, the Enigma concept is still used today but with the flaw, a letter can never be "substituted" with itself, but the entire process is done in computers instead of clockwork machines. The great advantage of this is the number of "wheels" you can have is unlimited. And with each added wheel the number of possible outcomes is increased by a multiple of 26. Enigma was an amazing cipher machine, but like the builders of Titanic, they were over confident in their design.

[@JustusLynetta]

Yes, theory can be proven wrong. It's been done many times, something that works in theory doesn't always work practically. And I'd advise look up the TypeX machine.

[@DamienWells]

Not too long ago, someone I know gave me some advice similar to what you said at the end of the video. His words were along the lines of "When coding security as an adult, don't think logically, try to think like a kid. If you build it logically and too structured it's easy to crack. And even if it's logical and structured but still you think it's near unbreakable, most of your attackers will be kids, young people, the ones who think outside the box. It's easy for those people to find holes you never thought possible." What are your thoughts on this?

[@vincentmuyo]

... Why wouldn't you code logically? It's not going to get safer just because no one can read the code.

[@Ashebrethafe]

@@vincentmuyo The code should be a logical implementation of the design, but that design should be as unstructured as possible. Moonpig should have used random customer IDs, instead of taking the "logical" approach of making them consecutive, so that nobody could use their IDs to determine someone else's. They also should have generated a _different_ random ID for each token, so that a user whose token ID was compromised could get a new one by deleting the old token and signing in with their username and password.

[@Toothily]

I think that's a poorly articulated way to say, don't get cocky or rest on your laurels, but instead be curious and devious in testing your own code.

[@beesree39]

@@Toothily how does one rest on a yanny

[@clockworkkirlia7475]

@@beesree39 ...Well played.

[@aydoyt]

You wouldn't guess what advert KZbin decided to slap at the top of my recommendations Moonpig

[@shuttsteven]

As someone who has no horse in this particular race, I have never heard of Moonpig before as a US customer, really enjoy these computer security videos. I hope to see more of them in the future!

[@Mousy677]

I love how sarcastic tom is in these videos, given that he's usually so nice in videos

[@loulimibarney3435]

People should stop thinking computing is a niche area and that they are doomed not to understand anything about it and realize computing is as law, it applies to everything and everyone should know about.

[@paulverse4587]

My school used a webportal a while back, so that we can upload our homework, see what is to be done, schedules and notices. However, the ID was stored in the URL itself - and you can see the ID of others by visiting their profile. Simply replacing it I was perfectly allowed to be my teacher or school mates, giving me full insights in all conversations between them and others. I was young so I played around a bit and was also able to see the invoices and ability to delete the entire school's account, change homework, schedules, and change admin roles. Luckily I was not stupid enough/too boring to change anything major or dwell too deep, so nobody noticed. I tried to bring this to my teachers attention but they didn't understand or care and when they seemed to think I was trying to "hack it" I stopped trying. This was in ~2008.

[@paulverse4587]

Also as I found out, the school paid a ludicrous amount monthly to this platform.

[@warmachineuk]

Third party frameworks and libraries allowing virtually unhackable cookies were available in 2008. The developer had no excuse. Your school was ripped off.

[@paulverse4587]

@@warmachineuk Yup

[@llynxfyremusic]

god the way your teacher brushed you off pisses me off.

[@DampeS8N]

Great breakdown as always. Clear, detailed, correct and complete.

[@CalebJohnsonlivingca]

good lesson in the illusion of "security through obscurity"

[@thebouncyball2305]

Yeah, it's a huge gamble to think like that. It only takes one malicious person to discover something like this, and it's only a matter of time.

[@samjiman]

This video was sponsored by Funky Pidgeon. :P

[@fn9six]

Funky, fun and free delivery. Woohoo

[@kristiansvendsen6906]

We'll even throw some other customers credit card details in! WOOOHOOOO

[@invisi.]

pigeon*

[@adflyofficial]

f u n k y p i g e o n . c o m

[@thinwhiteduke4324]

@@adflyofficial i read this like in the advert 🤦‍♀️😂

[@hikari_no_yume]

Tom mentions this being risky because a company might sue you. It gets worse, actually: the AT&T "hack" done/discovered by weev got him in jail - and it was a very similar type of issue to the one described in this video. I won't apologise for weev because he's a nasty piece of work and has done many horrible things, but the thing that got him sent to jail was AT&T being mad over exactly this issue.

[@philpem]

The key difference, as I understand it, was that Weev proceeded to crawl AT&T's customer database, download a massive chunk of it and then hand it to journalists, thus compromising thousands of customers' private information for the sake of irresponsible disclosure. Paul Price created a few new accounts with his own details (or perhaps fake details) to which he held the authentication details, then proceeded to use the customer IDs for those. At no point (at least based on what I'm aware that he's said publicly!) did he obtain any information to which he was not legally entitled access. Moonpig could take the nuclear option and try for criminal charges under, say, the Computer Misuse Act (disclaimer: I am not a lawyer, solicitor, barrister, or anything like that), but there's probably enough "responsible behaviour" to easily shoot something like that down (I'm not a lawyer. Have I said that yet?). That said, if MP did go down that route, the press would have an absolute field day. "Moonpig sues guy who reported security bug! A greetings card company has sued a computer security researcher who told them about a security bug, then gave them A YEAR to fix it! More on page five!"

[@hikari_no_yume]

philpem Yes, I suppose it's fair to say weev didn't get in trouble for merely exposing the vulnerability, I should have mentioned that.

[@goodkisser8591]

Yes, hacking other companies/websites, regardless of if you’re ‘just testing’ is illegal, because nobody knows what you did as well as informing them, you could’ve already sold all of the data.

[@hexagonist23]

Not if you use tor.

[@geordonworley5618]

This is a very important point, and every programmer really needs to understand this concept. I hope the message gets across and they actually fix the system.

[@paulaclarke3421]

Tom Scott speaking sense as usual. Thanks Tom.

[@BanterEdits]

Tom, I have to say, you are my favourite KZbinr, just ahead öfter Vsauce. Your content is funny, inspiring, smart and also very informative. I would love to see you on german TV one day and think: This man should be cloned because he is a perfect tutor for humans of all ages. Thank you for producing all of the content. Regards, Felix

[@BanterEdits]

*ahead of

[@bentheguy101]

Interesting how your profile photo is a VGA cable

[@JamEngulfer]

Hey, just so you know, comments can be edited after you post them.

[@BanterEdits]

JamEngulfer not on mobile^^

[@JamEngulfer]

Checkername1 | Closed Oh right, fair enough

[@WalnutBun]

Genuinely think that this is the sort of thing that goes beyond "incompetence" and into "criminal negligence".

[@Erraticfox]

Outstanding Tom, you always explain these videos with just the right amount of information. Not to much and not too less. Keep up the great work, Tom! Cheers.

[@thephantom1492]

Shouln't that compagny get an huge fine AND get banned from visa/mastercard due to the insecurity? I tought in the UK that such thing would result in huge fine due to the blattant insecurity... and credit cards don't like that too...

[@goodkisser8591]

thephantom1492 the “huge fine” isn’t as big as you’d expect for a massive company, especially not back then

[@jintie]

tought? you mean taught?

[@kyleedwards4903]

@@jintie Glad you're here to save us all the mental strain of trying to figure out what that could have possibly meant. God forbid a person accidentally omits a letter in a word. We need more people like you in the world, our stockpiles of unearned self-satisfaction are dangerously low

[@TheSudsy]

@@jintie thought

[@j.hawkins8779]

@@kyleedwards4903 you. shut up. no one cares about what you have to say. if you wanna be like that, delete your comment and go to some other website that cares about you.

[@Phantoml25]

"how could I break this" That's how I always think

[@joshuahadams]

Sledge hammer, that's how you can break this.

[@Xeverous]

+Josh Adams with enough force, everything can be "solved"

[@renatokobashigawa7025]

that's how my country thinks about economy

[@lappansommer546]

Even about my heart!? (sniff)

[@PeterT1981]

Inspiring passion in your monologues! As a non-nerd, I can’t believe the degree to which I was able to follow that. Well done

[@FabrizioBianchi]

Love when Tom explains protocols and love the new graphics too!

[@itsagentd283]

I remember back in the day when I was making a control panel for a game server and ran it on my test server. It was hacked within minutes by a friend just because I didn't check the input of 1 script causing my friend to get access to admin on the server and causing mayhem. I just didn't escape anything for one field and that was my downfall. Luckily I asked a friend to test the security and it was on a test server. You should never release something on a live machine until it has been tested.

[@imarcus1973]

I once had the pleasure of doing some updates on an accountants website. I discovered that as well as all their clients passwords being stored in plain text, their uploaded accounts documents were stored in a publicly accessible folder with consecutive ids as file names. To be fair the company I worked for had me update the code at no cost the customer. I was amazed at how many passwords were in the format: [username]123 ...!

[@thenerdyouknowabout]

I have never heard a better summary of moonpig! brilliant tom!

[@d3line]

Thank you! I really enjoy your tech-y videos.

[@Alex2Buzz]

"When dealing with sensitive information, assume the client is compromised."

[@gametime449]

He indeed did say that.

[@Alex2Buzz]

gametime449 Yes, it's my own tweak on it. I actually came up with it before I watched this video.

[@Roxor128]

"Innocent until proven guilty" is for lawyers, not software developers.

[@FerroNeoBoron]

Code it like someone is going to break it is not only a good mantra for security purposes, it's usually a good mantra for writing application code in general.

[@gunslingerspartan]

you know... years ago I found this channel and it had throwing drums and a symbol off a cliff outside shipley, trying to get on the budget news coverage, and being elected as a pirate captain I really really like that I can stumble back to it for well made educational content years later

[@chrispi314]

As a developer I always think about safety first. My boss can sometimes argue with that time is money, I simply answer that I know my job and time doesn't respect what we do without him. The problem you described suggest me that they hire some low cost trainee to do the job. Because, even in your studies, you learn basic stuff like that. It's practically like counting on your finger...

[@CoolAsFreya]

As a networking student "never trust user input" and "treat everything as malicious until proven otherwise" are the two biggest rules in setting any network or service up

[@Vedrajrm]

This channel is amazing, I've been like binge watching his videos like everyday

[@Thiefree]

My brother knows me so well. He showed me three of your videos and let me get on with it. One week later, I must've seen forty or more. I like what you do, Tom!

[@JustOneAsbesto]

"Moonpig bug" sounds like something from a Beat Poem, or William S. Burroughs novel.

[@Sathrand]

Thank you for the hearty laugh.

[@CoffeeOnRails]

found this kinda incompetence with the reg system at school. they attempted to throw me out

[@VicvicW]

Zach Ashton A third party system our school used was terrible. Albiet it was just a past paper system, but it's even the idea of it. I said I'd forgot my password, expecting the standard, enter new password malarky. Nope, it sends me a plaintext version of the password.

[@geraldhenrickson7472]

You are the exception...ie different. Different scares people. Do not stop.

[@ahreuwu]

my school got literally a plain windows 7 install from 2010 with no access to updates (somehow) and the admin password was "" (nothing, just press enter). wut

[@undead890]

Jack B Ouch, that site hurt my web developer soul.

[@Kerbal_fever]

I always remember my IT teacher looking over our code as 'A test of destruction'.

[@ANXIETOR]

I see that three employees of moonpig gave you thumbs down.

[@Booone008]

Excellent video! It baffles me every time I hear of one of those incidents that there are still PAID developers who make these mistakes. Allow authentication with nothing but an auto-incrementing user id?! I cannot even count the amount of bells that should ring. Heck, even 9-year-old me wrote better authentication systems than that (and that used a shitty md5 function applied to the non-salted password, and the token was a PHP session id transmitted over the URL query string ... good old times ...). I didn't consider it possible to find something worse than that in f***ing 2014! Thanks for spreading awareness, Tom, and kudos to the guy who reported the hole.

[@DemolitionTurtle]

Great video, Tom! I'm never gonna give up watching if you're never gonna let me down with these ;) I really like these computer security videos, although it is scary how insecure some reputable services are.

[@Kitulous]

did you just rickroll me?

[@LunizIsGlacey]

@@Kitulous yes, they did.

[@timscheive413]

Haha I got an Experian ad on this video. Loving your channel

[@CinemaDemocratica]

Greatest opening line of a Tom Scott video in history.

[@j2simpso]

Ahh good ol pentest. As a leftie I’m very fond of this as most pens on the market smudge unless you adapt a cranes grip on the pen. Having to go through the hundreds of pens to find that one pen that both doesn’t smudge but also maintains a smooth flow of ink is crucial. 🤣

[@Khunark]

goddamned liberal

[@AJG6150]

For some reason, whenever I watch Tom's videos, I become thirsty.

[@namelessasdf]

wait me too o.o

[@Joe-wj4hj]

Thirsty for knowledge

[@JapaneseWhiteKid]

It's because he always makes mouth noises, if you know what I mean (not speaking obviously)

[@craigthecat4202]

Me too :o

[@the1exnay]

Me too ;)

[@JackReid0]

Saw an older Tom Scott video today. So glad you got a haircut, looking a lot better.

[@SulphurS16]

The beginning is the best explanation of moonpig

[@AllThoughts3rased]

"moonpig, well they make crap" Oh this is gonna be good

[@Igneous01]

You would be surprised at how terribly vulnerable poorly designed some software is in the business world, I go mad thinking about what's going to happen when our company launches its SaaS platform...

[@ginfox91]

Thanks Tom, another interesting video. I'm glad I've never registered with moon pig. I'll bear this in mind the next time I code.

[@billyjesus5442]

switching between two static cameras, love it!

[@dapperrogue]

Delta Airlines had a similar bug in December that allowed you use another passenger's boarding pass. Whoops.

[@miko5742]

watching this after spiff's new vid

[@warmachineuk]

As a programmer, I know there's simply no excuse for this. Web application frameworks can generate large, unguessable strings of text as session ids. Even if someone manages to copy your session id, it's useless as soon as you logout or you've been idle too long. The client never sees a customer id.

[@djofftheshit]

7 years later, the description was never updated

[@Falney]

There is nothing wrong with using consecutive numbers for an ID in certain circumstances. For instance if the ID is kept fully internal and no one ever finds out how your ID system works and it isn't used with vulnerable data. A far more suitable approach (And the one I use) is to use UUID's. This is a random 36 character hexadecimal value which has less than 1% chance of returning a duplicated UUID for every quintillion UUID's. There are a over 5 unodecillion combinations possible. Which is basically a lot.

[@Qbe_Root]

Of course, just don’t use consecutive IDs as permanent tokens to access private accounts…

[@floppaquest4916]

5 unodecillion? Amateur. Try 2 combinations.

[@a_penguin1183]

Was it just me that got an advert from Moonpig straight after the video? 😂

[@fourk_]

I started getting moonpig ads. I thought I was the only one

[@AntiComposite]

Their press response is basally saying "Please don't punish us for PCI violations," as many do. And no, the last four of a credit card number is not payment information. Troy Hunt wrote a good piece on this.

[@peterharrow3621]

That closing sentence. It gave me feels.

[@samsargent284]

"...and run up 10,000 quid mining bitcoin on someone else's credit card." I love you Tom

[@fig8man]

How do you mine bitcoins with a credit card? where do I even plug it in?

[@pisse3000]

The disk drive. And don't worry if your computer doesn't have one, there are external ones you can buy.

[@pisse3000]

***** (it's a joke)

[@pisse3000]

***** But 2 am is the best time to read KZbin comments!

[@Luca-jy8ne]

I'd say buy a lot of hashing power from someone else and direct it to your wallet. Not sure if there's an easier way.

[@warmachineuk]

As others have written, treat all user input as evil. Desktop web browsers have a developer mode, allowing even amateur users to edit the page they download, including hidden form values, cookies, hyperlink parameters, and form validation done in Javascript. Identify the customer from a hidden customer id in the page and a teenager will hack your application.

[@BenMcKenn]

Congratulations on your second camera Tom

[@allanrichardson1468]

When I was programming mainframes, the biggest worry was user input that might ACCIDENTALLY crash a program, and most of the input editing was aimed those kinds of errors, like someone exchanging a transaction’s effective date and their birth date on a form, then we tried to compute their age. Once the PC and the internet appeared, we also had to worry about outsiders trying to crash or misuse systems on purpose.

[@dom_h]

Does this mean you can get the tester account details by trying the first few accounts? :D

[@thebouncyball2305]

most likely, assuming those accounts are still live.

[@nishantmehta]

I love your channel. Still a student, aspiring to be a good developer. Thanks

[@2mnyshp]

How I love these videos!!

[@levolta]

Interesting video! I would like to know what exactly identity theft is. I get the main idea, but I, and I think many others, do not know exactly what bad things can be done(or have been done in the past to regular people). Most people I know do not really care about it.

[@TomScottGo]

levolta It's a shorthand for "someone impersonating you" -- best case, they order a couple of things using your credit card, your bank notices and cancels everything, no major harm done. Worst case -- and you see cases of this with relatives and friends, not unknown online attackers -- they take out some loans in your name, run off with the money and ruin your credit score.

[@NNOTM]

***** I think the worst case is probably a whole lot worse than that. Granted, this is unlikely to happen to a lot of people, but I think someone who can impersonate can, in addition to ruining your credit score, also ruin the relationship with anyone you know, get you to lose your job, get you into a court for some crime you didn't commit, etc.

[@Booone008]

NNOTM As you pointed out, doing that is luckily not the goal of the average bad guy targetting insecure services. If the attacker does not hold a personal grudge against you but is instead targetting random people that he happens to be able to hijack, he is usually "only" after money and/or prestige. That being said, it can still ruin you pretty easily when your online identity is taken over, especially nowadays where so much of our life takes place online ...

[@jca111]

Identity theft can maifest in many ways, but I was the victim about 8 years ago, and someone took £2K of loans out in my name. It too me 4 years to clear my name, and an awful lot of agro. They were however caught. All they needed was my name, address and DOB. Where they got it from (it was no one I knew) I do not know, but it could realistically be many places.

[@angelthemage2972]

it’s been 5 years and they haven’t replied. F

[@torvic99]

Fantastic video.

[@dude3650]

much wow. such yes. Love you content. keep it up . thanks for making me more conciuos of how I code.

[@TacComControl]

Remember to check through more than 14 different listings when checking for Pen-testers. The Pen-15 rule is EXTREMELY important to remember.

[@Eiddew]

MANBEARMOONPIG

[@vladimirnikolic6612]

lold

[@undead890]

I'm super cereal

[@douglasg14b]

Don't forget that project management often drives these kind of flaws, not necessarily the devs themselves. I've been on projects where I bring up that accounts can be enumerated, that Ids are visible sequentially...etc But it ALWAYS gets deferred to the "It hasn't been a problem yet, so we are not going to work on it" pile of security negligence.

[@AshDCTaylor]

Could you perhaps make a video on the security bugs that you found? It sounds very interesting to me.

[@karl5874]

I just discovered your channel yesterday and have watched through almost all your videos (because they are amazing, brilliant, unique, can't find words) and just realized I have had ADBLOCK ACTIVATED on every single video. (I was just about to ask why you didn't have ads...) I hope Jesus (but primarily you) will forgive me D:

[@Boolihan]

Hopefully you have rewatched every one of his videos in the month since you posted this. WITHOUT ADBLOCK

[@karl5874]

Wild Gaming Honestly I think I have now... Not even joking...

[@zsdanix]

Did you know, that if you skip ads the content creator gets no money at all, just like if you used adblock. Also content creators can't get any money from mobile views (where ads might run even for people using adblocks on PC). Yeah KZbin ad revenue is a messed up system.

[@grumpygoomba9763]

Surely they must get something from mobile views assuming the ad is watched all the way through. Mobile is now the biggest platform in terms of number of views.

[@Showsni]

So what is the best way to report something like this? I ran across a security vulnerability on a certain broadband provider's website entirely by accident - one that ultimately let you log in to anyone's account simply by knowing the username, without having to use the password at all. (Then once you're logged on you can of course see address, email, name, phone number, past invoices, etc...) Several emails to the company over the course of a few weeks and no fix; eventually, after a few months pass, I manage to get through on the 'phone, walk the tech support person through the steps, and now it looks like they've finally fixed the problem. (I am curious how exactly the problem came to exist, but I'm not exactly tech savvy. Maybe someone could explain it to me if I tell them the repro steps!). Did I do the right thing in keeping quiet and just privately contacting the company?

[@NoriMori1992]

Yes. That's what the guy who found the Moonpig vulnerability did. If they fixed it after you helped them, then there's nothing more for you to do. If they haven't fixed it yet, it's time to go public with it.

[@blackAngel88it]

The token being the only thing needed to authenticate the user is definitely much, much worse than having a sequential ID. The combination of it is quite catastrophic, of course.

[@simmosideways]

Hi Tom, I'd love to see details of your main workstation and firewall/router setup. I think it would make for an interesting video. Thanks, from Australia!