The Daily WTF
Follow
RCE As a Feature
Kakistocracy, the rule of the worst and least qualified, is introduced as a relevant concept. A teacher, Jared B, shares his experience working for an ed-tech company founded by a mechanical engineering professor named Harry. Harry had developed a C interpreter and built a company around it, offering K-12 curriculum based on C programming. His software included a web IDE and a locally installed Windows version with a daemon for running C code remotely.This daemon, however, had no authentication and was bound to 0.0.0.0, allowing any domain or computer on the same network to execute arbitrary C code. These critical security vulnerabilities had existed for years, unnoticed by Harry's exclusively hired graduate student developers. The software was installed on thousands of school computers.Jared reported these issues to Harry, who released an update citing "security improvements" but failed to inform IT leaders about the importance of updating. Jared also discovered a cookie-stealing exploit and a code injection vulnerability on another of Harry's websites. This latter vulnerability exposed thousands of unencrypted credit card transaction records. Despite these significant security flaws and data exposures, Harry's company remains in business and has received accolades. The commentator contrasts this situation with someone they knew who was stuck on outdated technology but did not endanger an educational system.