+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Much irony, Mr Krebs (/showthread.php?tid=5680462)
Much irony, Mr Krebs - pop.pop.ret - Jul 28, 2017
Yet another example of Brian Krebs failing to practise what he preaches:
![[Image: 8B7vFVK.png]](https://i.imgur.com/8B7vFVK.png)
um, lol... what's up with this Mr Krabs?
![[Image: giphy.gif]](https://media.giphy.com/media/26n6RxWuxzCO2VG5a/giphy.gif)
![[Image: giphy.gif]](https://media.giphy.com/media/l1J3LvYnK13VJAwQo/giphy.gif)
* - xx 0x0 xx - Jul 28, 2017
lol he is just an idiot why people keep talking about him
* - _bengi - Jul 28, 2017
(Jul 28, 2017 07:34 AM)Mandarin Wrote: lol he is just an idiot why people keep talking about him
Maybe because he's the biggest computer security blogger on the Internet. Just a thought. Also, he's never claimed to be a security researcher, or have any kind of supreme technical skills for that matter. That said, I'm pretty confident that he knows more about computers than most of the kiddies on this forum.
Also, to the OP, I'm not sure where the irony is here. He never claimed that his blog was immune to web app vulnerabilities, he's never lectured anyone on how insecure their websites are and he surely never gave any lessons on preventing web app exploitation. All he did was copy and paste a definition that he probably found from Google.
* - Wet Rag - Jul 28, 2017
I thought he wasn't allowed to be spoken about here
* - pop.pop.ret - Jul 28, 2017
(Jul 28, 2017 07:46 AM)_bengi Wrote: Also, to the OP, I'm not sure where the irony is here. He never claimed that his blog was immune to web app vulnerabilities, he's never lectured anyone on how insecure their websites are and he surely never gave any lessons on preventing web app exploitation. All he did was copy and paste a definition that he probably found from Google.
The irony is that he's wrote posts about the dangers of open redirection (and giving examples of sites vulnerable to redirects) while his own site is vulnerable to this. I never claimed he stated his own site was immune to these vulns, but if he's blogging about their risks, then it seems reasonable that he should at least be taking action to protect against it.
He's tried patching redirects in the past that I've posted, then went ahead and implemented more?? If you've been blogging about info security for the past 20+ years, then I think it's somewhat ironic that your own site is vulnerable to the same risks that you're blogging about.
He most certainly has lectured people on how insecure their websites are (his open redirect post being a prime example)
* - Friedrich Nietzsche - Jul 28, 2017
(Jul 28, 2017 08:10 AM)pop.pop.ret Wrote: The irony is that he's wrote posts about the dangers of open redirection (and giving examples of sites vulnerable to redirects) while his own site is vulnerable to this. I never claimed he stated his own site was immune to these vulns, but if he's blogging about their risks, then it seems reasonable that he should at least be taking action to protect against it.
He's tried patching redirects in the past that I've posted, then went ahead and implemented more?? If you've been blogging about info security for the past 20+ years, then I think it's somewhat ironic that your own site is vulnerable to the same risks that you're blogging about.
He most certainly has lectured people on how insecure their websites are (his open redirect post being a prime example)
You don't seem to get that Brian Krebs is a journalist, not a programmer, nor is he a web developer, and most likely did not code that portion of his own site and most likely used a pre-made WordPress plugin or hired someone to code one for him? Report it to him and he will get it patched, I don't see his site being vulnerable ironic as he most likely did not make it vulnerable intentionally and did in fact pay attention to the security of his site.
* - pop.pop.ret - Jul 28, 2017
(Jul 28, 2017 09:42 AM)Friedrich Nietzsche Wrote: You don't seem to get that Brian Krebs is a journalist, not a programmer, nor is he a web developer, and most likely did not code that portion of his own site and most likely used a pre-made WordPress plugin or hired someone to code one for him? Report it to him and he will get it patched, I don't see his site being vulnerable ironic as he most likely did not make it vulnerable intentionally and did in fact pay attention to the security of his site.
You dont seem to get that someone who has reported on cybercrime for 20+ years is clearly going to be aware of these bugs and their implications.
I reported redirects to him in the past, now 10 more pop up. If you think he actually pays attention to the security of his site, then you sir are delusional. Like jfc he even had /server-status publicly viewable on his site for 6+ months and refused to accept that it was an issue when I pointed it out to him. For someone with 20+ years experience of reporting on security issues, his inability to understand what constitutes a security risk is just plain embarrassing.
He was even too dumb to setup 2FA on his paypal account: http://bit(dot)ly/2uJQ6rv - he claimed they don't have it available when they've had it for years.
Brian Krebs Wrote:Nevermind that it was PayPal’s lack of any modern authentication methods that led to this mess
No. It was his lack of competency and him being too lazy to simply look through their settings for the option to enable 2FA.
How is it not ironic that someone who's wrote books about cybercrime, and investigates cybercriminals for a living cant even take basic steps to protect himself from cybercrime?
* - minimalist - Jul 28, 2017
Why post about him?