Vibe-coded South African website hacked just six days after launch

Vibe coding didn't hack the site. Bad deployment did. Hardcoding secrets into frontend code is a human amateur hour mistake as old as the web. Classic PR tactic by domains, ROFL. blame the tool, sell the website builder.
 
Adenoid Hynkel said:
Classic PR tactic by domains, ROFL. blame the tool, sell the website builder.
Click to expand...
Except its a well documented fact that many vibe coded sites and/or software are full of security holes...as, again, proved by this.

Perhaps, maybe the AI is programmed to put it in there for its own use, who knows
 
JustAsk said:
Except its a well documented fact that many vibe coded sites and/or software are full of security holes...as, again, proved by this.

Perhaps, maybe the AI is programmed to put it in there for its own use, who knows
Click to expand...
No it isn't, it's only "full of holes" because most idiots don't/can't audit the code. It works so it must be right, right?
 
In a recent LinkedIn post, Diamond detailed how a client’s website was compromised after they decided to use an AI tool to build it.

“They’d chosen not to use our website builder. They’d built the site themselves with one of the popular AI tools: free and impressive,” Diamond said.

“It looked great and sort of worked. I say sort of because the design was nice, but not much else worked. Then it was gone.”

The site’s owners asked Domains.co.za’s support team what had happened to the site. Diamond said the answer was quick to discover.

He said that the AI tool had left the admin password in the site’s code in plain text. Anyone could read the password by checking the site’s code using a developer tool.

“No sophisticated attack. No zero-day exploit. The attackers just read the password and walked in through the front door,” said Diamond.

“Hackers don’t need to be clever. They know exactly which mistakes AI tools make, and they run automated scans for them around the clock.”
Click to expand...

The AI tool didn't make the mistake. I would assume that this popular AI tool didn't build on an CMS. I am curious, though, why there was an admin password? Something here isn't gelling.

I can assume, say, that the story is true, that the root was exposed? Though my thinking here is that the AI thought it was still staging? Possibly a Markdown.

The website builder bulked on by Domains is also AI-assisted.
 
JustAsk said:
Except its a well documented fact that many vibe coded sites and/or software are full of security holes...as, again, proved by this.

Perhaps, maybe the AI is programmed to put it in there for its own use, who knows
Click to expand...
Pushing dev variables straight to live production is a PEBKAC issue, not an AI conspiracy.
 
For Wordpress dev, installing Novamira (Pro) and Easy MCP is a breeze now to get things done via MCP. I tested this a while ago in sandbox, and it is amazing how good the tooling is now. Still though, can't build it with Claude Code alone, would at least also require other competitive models. And... a own-hosted Qwen abliterated model.

Frontier models have become good with UX/UI, and I think that is what is selling to the masses. The rest, well, you need to pay attention.
 
Fulcrum29 said:
The AI tool didn't make the mistake. I would assume that this popular AI tool didn't build on an CMS. I am curious, though, why there was an admin password? Something here isn't gelling.

I can assume, say, that the story is true, that the root was exposed? Though my thinking here is that the AI thought it was still staging? Possibly a Markdown.

The website builder bulked on by Domains is also AI-assisted.
Click to expand...
I'll try answer some of your questions, as it was my post that MyBB wrote this article on. (To be honest, I was very surprised to see the article this morning in MyBB as I had no idea it was even going to be written)

1) The client built some sort of admin section that had a login and password that controlled his site was in the HTML code.

2) The post is based on what happened with a real client and what was explained to me by the support team when having a weekly debrief and discussion of what we need to look out for or possible support issues that may appear going forward. We try look at what is happening and look at future scenarios that the team needs to be aware of.

3) Quite correct, our website builder does allow you to create a website or adjust website pages with the assistance of AI, but this is a professional website builder and has guardrails. The average person using AI to build anything would not even think that a password was even in the code.
 
Mike Hoxbig said:
No it isn't, it's only "full of holes" because most idiots don't/can't audit the code. It works so it must be right, right?
Click to expand...
Most developers who use AI to assist with coding know what they doing, for our perspective as a hosting provider we are seeing a massive increase in self-built "everything" and I say everything, as you would not believe what people are trying to build and push it to our hosting.

The most popular at the moment are self-built CRM's to replace paying for their current paying solutions, but once again, from our perspective as a hosting provider we suddenly getting this influx of unsecure solutions people have built using AI and when they dont work or get hacked its suddenly our issue and our systems that have issues. People never want to believe that what they have built could be the problem, as it was built with "AI" and must be correct. There have been times when the team has spent countless hours investigating an issue with a self-built AI system so that we can prove that its the client's fault and not ours. Time that could be used better for assisting with other issues. I have heard that some international hosting providers who are having the same issues just on a much larger scale are adding clauses to their T&C's that if the investigation turns out to be the clients fault/AI issue like above they will charge the client an admin fee
 
Domains.co.za (Wayne) said:
I'll try answer some of your questions, as it was my post that MyBB wrote this article on. (To be honest, I was very surprised to see the article this morning in MyBB as I had no idea it was even going to be written)

1) The client built some sort of admin section that had a login and password that controlled his site was in the HTML code.

2) The post is based on what happened with a real client and what was explained to me by the support team when having a weekly debrief and discussion of what we need to look out for or possible support issues that may appear going forward. We try look at what is happening and look at future scenarios that the team needs to be aware of.

3) Quite correct, our website builder does allow you to create a website or adjust website pages with the assistance of AI, but this is a professional website builder and has guardrails. The average person using AI to build anything would not even think that a password was even in the code.
Click to expand...

Odd that an admin section was attached. Did the client want something like a portal to do ecommerce (incl. services) or something like a gallery?

It is easy to use anything like Hermes Agent, Claude Code, Codex, Cursor, etc,. to build and upload an HTML site. When it does have access, it tends to leave a markdown in the root and all directories, depending on the model, tool calling, and harness. This is a simple example. There are better ways to go about this, but in your case it is a user error.

AI hype makes things seem easier than they are. Using AI still requires structural procedures, and Claude Code can't do it all. Though MCP servers are quite advanced now, it is still a technical challenge. Last night I had an issue with incorrect tool call.
 
Domains.co.za (Wayne) said:
The most popular at the moment are self-built CRM's to replace paying for their current paying solutions, but once again, from our perspective as a hosting provider we suddenly getting this influx of unsecure solutions people have built using AI and when they dont work or get hacked its suddenly our issue and our systems that have issues.
Click to expand...

I hope those CRMs are correctly hardened. There are so many open-source CRMs available, some that don't have an issue even running on shared hosting. Just take one that is modular and add-on???

This is what I am doing. No need to maintain; all I need are secure connectors.
 
Fulcrum29 said:
Odd that an admin section was attached. Did the client want something like a portal to do ecommerce (incl. services) or something like a gallery?

It is easy to use anything like Hermes Agent, Claude Code, Codex, Cursor, etc,. to build and upload an HTML site. When it does have access, it tends to leave a markdown in the root and all directories, depending on the model, tool calling, and harness. This is a simple example. There are better ways to go about this, but in your case it is a user error.

AI hype makes things seem easier than they are. Using AI still requires structural procedures, and Claude Code can't do it all. Though MCP servers are quite advanced now, it is still a technical challenge. Last night I had an issue with incorrect tool call.
Click to expand...
@Fulcrum29, all I know is that the client built some sort of admin section but have no idea of what was built or what they wanted to do with it.

Most of these issues we are asked to investigate are not from developers, as they know what they are doing, most of the issues are from the average person in the street who has heard what AI can do, probably heard from a friend who has built something, and now they want to do that as well.
 
Domains.co.za (Wayne) said:
Most developers who use AI to assist with coding know what they doing, for our perspective as a hosting provider we are seeing a massive increase in self-built "everything" and I say everything, as you would not believe what people are trying to build and push it to our hosting.

The most popular at the moment are self-built CRM's to replace paying for their current paying solutions, but once again, from our perspective as a hosting provider we suddenly getting this influx of unsecure solutions people have built using AI and when they dont work or get hacked its suddenly our issue and our systems that have issues. People never want to believe that what they have built could be the problem, as it was built with "AI" and must be correct. There have been times when the team has spent countless hours investigating an issue with a self-built AI system so that we can prove that its the client's fault and not ours. Time that could be used better for assisting with other issues. I have heard that some international hosting providers who are having the same issues just on a much larger scale are adding clauses to their T&C's that if the investigation turns out to be the clients fault/AI issue like above they will charge the client an admin fee
Click to expand...
Yes this isn't a provider issue. It's people pushing AI slop and they don't know what the hell their AI code is doing...
 
These threat actor AI engines reveal the code that built these websites, giving criminals backdoors into company systems.
Click to expand...
Indeed, very accurately said - others using backdoors include CIA, NSA, gov, etc.
 
Fulcrum29 said:
I hope those CRMs are correctly hardened. There are so many open-source CRMs available, some that don't have an issue even running on shared hosting. Just take one that is modular and add-on???

This is what I am doing. No need to maintain; all I need are secure connectors.
Click to expand...

There are still local shared hosting companies that have directory listing enabled by default. Not pointing fingers.

Open-source doesn't always mean secure either.

Besides, any of the big frontier models, if pointed at a project/repo, will very quickly figure out you're pushing code to a server that's wide open and warn you.

The sheit starts with people using basic web UI models like ChatGPT to blindly copy paste code snippets/files without understanding the environment.
 
Vibe-coding business analysts.
These are the morons who switch on auto-mode and then go and play golf.
Herding Goldfish.
 
Adenoid Hynkel said:
Vibe coding didn't hack the site. Bad deployment did. Hardcoding secrets into frontend code is a human amateur hour mistake as old as the web. Classic PR tactic by domains, ROFL. blame the tool, sell the website builder.
Click to expand...
Hold up, you're all over the place.
It wasn't vibe coding you say, it was human error to hardcode secrets into the front end? What does that have to do with bad deployment?
 
Adenoid Hynkel said:
Open-source doesn't always mean secure either.
Click to expand...

It is not about being secure. Hardening goes beyond that, but people new to this are expecting AI to handle it as an SaaS. You are expected to handle your own security and to trust your hosting provider. Allowing a service to be public varies, and that scales.

What helps with open source, and also requires research, is to see what is being maintained and advanced, then what is being contributed to. Not all popular open-source tools are community-driven.

Still, though not everything open-source is lean and mean. AI can help with that IF so required. Just be sure about the licensing target. I look at AGPLv3 and MIT.

As I said, most LLMs and harnesses, today, that I worked with deploy with visible MDs readable. This isn't about the AI; it is because the "prompt engineer" does not understand process. Some harnesses do attempt to guide this.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X