First Exploit/Bug of Steempay-woo-plugin v0.2 Beta by @steve-walschot : @roelandp robbed my shop for $15,000 in virtual goods! :)

in #steempay8 years ago

So all of a sudden, the store was empty - all items had been sold for 0.1 SBD - the buyer: @roelandp our fantastic first customer whitehat and organizer of #steemfest. I had to disable SteemPay-woo-plugin immediately after losing almost $15,000 worth of virtual products :) so @steve-walschot - back to the coding-board :)

https://steemit.com/steempay/@fyrstikken/first-review-of-steempay-woo-plugin-v0-2-beta-by-steve-walschot-pay-with-steemdollars-on-woocommerce


If you installed SteemPay Woo Plugin - oh boy oh boy are you in trouble now!! :)

Sort:  

Ya jess gotsta luv these here newfangled 'lectronical clicketty-boxes sum daze, duzncha? d=O)

yeah, got to wait for @steve-walschot to write an update now, or ... christmas will start early for some people.

Remember: Bugs are never a waste of time, as even in the worst case scenario, they quickly and easily help you remember every single word mama told you not to say when you were little! d=O)

Not quite as quick as that ()@#*ing idiot who cuts you off in traffic...but pretty close! d;^)

Security is so important. Code review, testing, and validation is mandatory.

Either that, or making sure that the camera is active, so you can at least record all those quickly changing expressions that invariably pop up when the bug first rears it's ugly head. d8^O

True. Top-notch security programs have overlapping/supporting elements of Prediction, Prevention, Detection and Response, which forms a strategic process capability.

Sounds like typical early adopter problems :)

sounds like a'='a' to me...
Code injection in diapers as a vulnerability, from a "security expert"... It is like a blunt blade coming from a "professional swordsmith".

According to him it was $.01 SBD.... we got lies... WITCH HUNT BOYS!!!!

okay fine I will upvote and walk away


             .-.
            o   \     .-.
               .----.'   \
             .'o)  / `.   o
            /         |
            \_)       /-.
              '_.`    \  \
               `.      |  \
                |       \ |
            .--/`-.     / /
          .'.-/`-. `.  .\|
         /.' /`._ `-    '-.
    ____(|__/`-..`-   '-._ \
   |`------.'-._ `      ||\ \
   || #   /-.   `   /   || \|
   ||   #/   `--'  /  /_::_|)__
   `|____|-._.-`  /  ||`--------`
         \-.___.` | / || #      |
          \       | | ||   #  # |
          /`.___.'\ |.`|________|
          | /`.__.'|'.`
        __/ \    __/ \
       /__.-.)  /__.-.) LGB

There is no way this transaction can be honored. Wow. this is shocking for sure.

I've a video that shows how the plugin was created:

Some say that the same coder left the renowned OR 'a'='a';glitch at some of his creations too.

Coin Marketplace

STEEM 0.18
TRX 0.13
JST 0.029
BTC 57684.56
ETH 3120.56
USDT 1.00
SBD 2.33