97 Things Every Information Security Professional Should Know

Chapter 69. Don’t Check It In!

Patrick Schiess

During high school, my friends and I spent countless hours trying to hack each other. One day, I stumbled upon an easy way to trick them into inadvertently exposing their passwords through administrative error logs. Using an early 2000s popular online bulletin board software as a medium, I lured my friends into what I assured them would be an engaging space to share thoughts on topics such as video games, programming, and music. I explained that all they had to do was log in to the website using their regular credentials and they would be good to go. However, when they attempted to do so, the software gave an error: Invalid password : [P@55w0rd!], which ultimately ended up in the error logs. As an administrator, I was able to view the logs to find their passwords and subsequently hijack their emails, gamer accounts, and web hosts—ultimately winning our juvenile “capture the flag” competition.

Today, the internet is a very different place. Secure coding practices and multifactor authentication provide enhanced protection against these types of rudimentary password attacks. As security constraints have evolved, social engineering and phishing may seem easily avoidable for user accounts. However, application passwords and secrets may still be at risk of getting compromised unless the proper precautions are taken.

At a former employer, ...