Rage at Autodesk

Camarilla · 3 Sep 2011 at 22:45

Now all you need to do is put all those files in a rar, give yourself a silly name on Twitter, and you're a leet hax0r

rexehuk · 3 Sep 2011 at 22:46

Huge breach of data protection...

dowie · 3 Sep 2011 at 22:47

@OP - since you made this discovery - why not drop a few brief e-mails to tech journalists at UK newspapers. The press do seem to like exposing organisations which have been slack with looking after personal data - it might also provide a strong motivation for them to fix the problem and for enforcement action to be taken against them.

dfarrall · 3 Sep 2011 at 22:47

I think people would be suprised at how insecure computers are in general.
Only a few months ago one of the largest certificate authorities got hacked and lost certificates for hotmail, google ect. They hosted about 1/5th of the websites certificates.

This means any website could impersonate one of those and youd be none the wiser. The whole certificate system is broken really as 75% of people click "Add exception" when they see a certificate error, when infact they could be passing on all data they send to somebody else before its then relayed to the correct server.

GSXRMovistar · 3 Sep 2011 at 22:47

For those unaware of who Autodesk are or unable to google them see here, http://en.wikipedia.org/wiki/Autodesk.

With $$$ figures like that there is no excuse to have these type of flaws in you web security.

teaboy5 · 3 Sep 2011 at 22:48

dfarrall said:
I think people would be suprised at how insecure computers are in general.
Only a few months ago one of the largest certificate authorities got hacked and lost certificates for hotmail, google ect. They hosted about 1/5th of the websites certificates.

This means any website could impersonate one of those and youd be none the wiser. The whole certificate system is broken really as 75% of people click "Add exception" when they see a certificate error, when infact they could be passing on all data they send to somebody else before its then relayed to the correct server.

All that coming from the person who couldn't type autodesk into google correctly!

rexehuk · 3 Sep 2011 at 22:49

They will be fined for this... no way to stop it tbh. Unless they manage to shut the hole now without it getting to media.

GSXRMovistar · 3 Sep 2011 at 22:52

Appears to be offline now, but as above no way to cover this up.

teaboy5 · 3 Sep 2011 at 22:53

Still working here

Kenai · 3 Sep 2011 at 22:53

GSXRMovistar said:
Appears to be offline now

Negative, they're just onto you. Start hiding.

Fine here.

[FnG]magnolia · 3 Sep 2011 at 22:54

teaboy5 said:
Some times it hard to tell if your just trolling.

Check the directory there is a massive amount of data left open to the public, which shouldn't be.

LeJosh said:
That means you're a moron.

Or trolling, I prefer to think it is the latter.

On topic: I'm finding it quite shocking the lack of security from these companies.

I wasn't trolling, I genuinely had no idea what everyone was getting so worked up about. And yes I could have googled it but given that everyone was so uptight I thought I'd ask what was going on. Thanks for the input.

Anyway, back on topic

rexehuk · 3 Sep 2011 at 22:54

But I wouldn't let someone breach data laws when they invest that much in IT infrastructure.

MagicBoy · 3 Sep 2011 at 22:55

Oh fantastic. There's a bunch of account details for my work on there.

/facepalm

dowie · 3 Sep 2011 at 22:55

appears to be a bigger list of personal details in this file - corporate peeps rather than students:

http://au.autodesk.com/ama/i_company_edit.txt

asim18 · 3 Sep 2011 at 22:55

GSXRMovistar said:
Appears to be offline now, but as above no way to cover this up.

Fine here.

Start deleting your browsing history dude. In fact, nuke it from orbit just to be sure!

Messiah Khan · 3 Sep 2011 at 22:55

teaboy5 said:
The amount of info on that directory is out of control! Check the maillist folder alone!

Just found an excel file with over 60,000 email addresses, names and addresses! :eek:

Vulcan · 3 Sep 2011 at 22:56

I've now managed to get a login password from access logs.

dfarrall · 3 Sep 2011 at 22:56

teaboy5 said:
All that coming from the person who couldn't type autodesk into google correctly!

Well its my area of study

They also didnt get fined/lose revenue or anything over it.

asim18 · 3 Sep 2011 at 22:57

Longbow said:
I've now managed to get a login password from access logs.

Time to fire up those VPNs and dozen proxies?

LeJosh · 3 Sep 2011 at 22:57

[FnG]magnolia;19987564 said:
I wasn't trolling, I genuinely had no idea what everyone was getting so worked up about. And yes I could have googled it but given that everyone was so uptight I thought I'd ask what was going on. Thanks for the input.

Anyway, back on topic

My mistake, I meant no offence.

Basically, couple thousand personal credentials are open to anyone with a computer/internet. A billion dollar company that has such lax security with personal details, it's worrying really.

Just like the Sony fiasco.