Deloitte’s ‘Test your Hacker IQ’ site fails itself after exposing database user name, password in config file

Thomas Claburn reports:

Updated A website created for global consultancy Deloitte to quiz people on knowledge of hacking tactics has proven itself vulnerable to hacking.

The site, found at the insecure non-HTTPS URL http://deloittehackeriq.com/, makes its YAML configuration file publicly accessible. And within the file, in cleartext, is the username and password for the site’s mySQL database.

Read more on The Register.