full-disclosure - Presidential Candidates' Websites Vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: Marek.Isalski at smuht.nwest.nhs.uk (Marek Isalski)
Subject: Presidential Candidates' Websites Vulnerable

For those who didn't catch it on The Inquirer already, it sounds like not even the would-be presidents of the US can afford decent security: http://www.theinquirer.net/?article=16939

"site shows signs of being vulnerable to SQL injection errors" and "packed with cross-site scripting errors"... Has Donnie been doing overtime? :)

Most amusing comment given the still raging Win/Linux debate on this list: "Kerry has open source credentials - he is using Apache running on Red Hat.  Bush's OS of choice is none other than Vole's IIS 5.0 server." 

Most worrying comment: both sites use visitor trackers (something I always feel is a sign that the site's owners feel that invasion of privacy is less important than commercial success).  Maybe one day we'll just do away with elections and go by the Google PageRank of the candidates' websites?

Marek