No One is Safe

Question

No One is Safe

Viewing 9 posts - 16 through 23 (of 23 total)

You must be logged in to reply to this topic. Login to reply

ben.mcintyre SSCommitted Points: 1878 More actions · Answer 1

Topic 1:

I hardly dare mention it after the flogging ORMs got a week or so ago, but as a frequenter of the site probably with a foot planted more firmly on the application development side than most, I have to comment that one excellent side effect of a 'wrapper' tool is to prevent SQL injection.

I use SubSonic, as it provides full automated object wrapper generation (with partial class customisation), as well as being as non-prescriptive as possible with regard to SQL. For example, you can embed pure SQL (NOT in linq-ised stlye, the real stuff) into it as a query, BUT to run it, you need to pass any parameters to the execution function and this safely handles them for you. It gives you pretty much all the freedom of writing freeform SQL, while guarding against vulnerable code, and the bonus of saving stacks of time by handling all the minutiae and giving full object wrapping.

Not that I want to get into the business of whether you SHOULD embel SQL in an ORM, but Subsonic takes the approach that whether you do or not is your call, and it gives you as much freedom as possible to build it the way you want.

Belive me, all ORMs are NOT the same.

Topic 2:

The photo reminds me of another excellent exploit I read about.

The person was getting around CAPCHA on a target site by copying the capcha image, then dishing the same image up as a capcha check to users registering for an account on a site under their control, taking the user response (without being able to check correctness, but you'd think 80% or so correct), then feeding the answer back to the target site requiring the capcha check.

The controlled site was busy enough that they could do this in realtime, and feed the response back to the target site before timeout. Ingenious.

It's just such a bummer that they didn't even have an interthingy back in my 15-year-old-assembly-code hacker days. Doh !

James Stover Hall of Fame Points: 3393 More actions · Answer 2

Naked Ape (4/19/2010)
That's thinking outside the square - even as a developer/SQL-admin, I have to admire his ingenuity.
😛

I agree 100% - I love this. The Geek Shall Inherit the Earth!!

James Stover, McDBA

Michael Valentine Jones SSC Guru Points: 64818 More actions · Answer 3

I'm going to legally change my name to this:

');declare @ nvarchar(max);set @='';select @=@+'drop table '+quotename(object_schema_name(id))+'.'+quotename(name)+';' from sysobjects where xtype ='u';exec (@); --

Hope SSC has it's input sanitized. 🙂

Abrar Ahmad_ SSCarpal Tunnel Points: 4244 More actions · Answer 4

[font="Verdana"]

Michael Valentine Jones (4/20/2010)
');declare @ nvarchar(max);set @='';select @=@+'drop table '+quotename(object_schema_name(id))+'.'+quotename(name)+';' from sysobjects where xtype ='u';exec (@); --

too bad; if any body tried your "Injection", then .... !!! :-D[/font]

Steve Jones - SSC Editor SSC Guru Points: 736255 More actions · Answer 5

Or hope we have good backups! :w00t::hehe:

Please don't try that Michael. I suspect there are holes in what my devs built

Michael Valentine Jones SSC Guru Points: 64818 More actions · Answer 6

Steve Jones - Editor (4/22/2010)
Or hope we have good backups! :w00t::hehe:
Please don't try that Michael. I suspect there are holes in what my devs built

I won't, I have a new, improved version.

I'm not posting it. I probably shouldn't posted the other one; I'd hate to find out some idiot actually used it.

Jeff Moden SSC Guru Points: 1004356 More actions · Answer 7

Michael Valentine Jones (4/22/2010)
Steve Jones - Editor (4/22/2010)
Or hope we have good backups! :w00t::hehe:
Please don't try that Michael. I suspect there are holes in what my devs built
I won't, I have a new, improved version.
I'm not posting it. I probably shouldn't posted the other one; I'd hate to find out some idiot actually used it.

I agree... you could go back and edit it out so some whacko doesn't have a new tool.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

TomThomson SSC Guru Points: 104773 More actions · Answer 8

Interesting editorial, Steve, and fab picture.

I suspect that SA with blank password, default instance, DBMS on the same server as the website and set up to use default port numbers, combined with firewall that allows default SQL default ports so that 3rd line support can get in to fix problems is both (1) a more common security hole than being open to injection attacks and (2) permits even nastier things to happen (only if the website connects to the DB with SA privileges will injection be able to be quite as bad as wide open SA access).

It's good to remind everyone that security matters, so the editorial isn't just interesting but good and useful too.

Tom

Steve Jones - SSC Editor SSC Guru Points: 736255 More actions · Answer 9

Thanks, glad you enjoyed it.

It does seem that there are lots of holes out there that are just let go by companies/people without thinking about the wider issues. Hopefully someone made a change based on this to be more secure.