Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Main GNU source repository server compromised

savannah.gnu.org

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Main GNU source repository server compromised

#21

Post by pjscott »

tjarratt wrote: post #17
konad wrote: post #15

Earlier quoted context omitted.

lol, pwned twice in 7 years, "incredibly talented hackers" lololololo

I believe it's more that they are a visible target, being in the media and spreading their message as much as they do. Were they a small company that hosted internal webapps (for example) they probably wouldn't have been targeted as much. Imagine, for a moment, if these two attacks in seven years were successful, how many unsuccessful attacks there were as well. Most, if not all, software after a certain point of com…

In any sufficiently large group of people, you're going to have assholes. To dismiss the people who've put so much good work into the GNU project would be offensive if it weren't so foolish; it says more about the poster than about the GNU folks. Also, consider the source:

http://news.ycombinator.com/user?id=konad

Two previously banned accounts. It looks like HN is better than this, as a whole.

Re: Main GNU source repository server compromised

#22

Post by [deleted] »

dkarl wrote: post #13
Sandman wrote: post #2

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…

Maybe someone had an idea for putting a vulnerability into a GNU utility. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection. Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs…

[deleted]

Re: Main GNU source repository server compromised

#23

Post by technomancy »

linuxaddict wrote: post #11

I thought more eyes on the source means that OSS is impenetrable. Guess not.

Nobody really cares about helping out with Savannah. On the emacs-devel mailing list every time Savannah is mentioned, it's in the context of "Yeah, we would like to do that but lack the manpower. Any volunteers?" followed by crickets.

Re: Main GNU source repository server compromised

#24

Post by stcredzero »

petrilli wrote: post #14
pluies wrote: post #10

Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.

Actually, no... you have to be pretty ignorant to be subject to them. Use bind variables in your queries and you are done. That it's still one of the top 2-3 exploits tells you how horrible most developers really are.

Not all talented developers are talented or even good at security.

Re: Main GNU source repository server compromised

#25

Post by tptacek »

Sandman wrote: post #2

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…

People in 1997 never expected that could be vulnerable to an attack as simple as a buffer overflow; after all, all it takes to not be vulnerable to overflows is "counting", and who has problems counting with a computer? Tens of billions of dollars in losses later: do you feel safe hitting arbitrary pages with your web browser?

Re: Main GNU source repository server compromised

#26

Post by tptacek »

petrilli wrote: post #14
pluies wrote: post #10

Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.

Actually, no... you have to be pretty ignorant to be subject to them. Use bind variables in your queries and you are done. That it's still one of the top 2-3 exploits tells you how horrible most developers really are.

No. You are not done with SQL injection just because you use "bind variables". Plenty of things can't be parameterized that are nonetheless subject to user influence. Click the top of any reverse-sortable column in a web user interface to see one obvious example.

Parameterized queries are a good thing, and you should use them, but I feel like I've had to be a broken record about this over the last week: they are not magic anti- SQL injection fairy dust. Our whole team spends most of its time looking at smart people's code, and we routinely find SQL injection.

Plenty of people who aren't ignorant of SQL injection manage to let SQL injection slip through. Knowing how SQL injection works and being able to devise and implement engineering procedures to reliably prevent them are two very different things.

Re: Main GNU source repository server compromised

#27

Post by btilly »

tptacek wrote: post #26
petrilli wrote: post #14

Earlier quoted context omitted.

Actually, no... you have to be pretty ignorant to be subject to them. Use bind variables in your queries and you are done. That it's still one of the top 2-3 exploits tells you how horrible most developers really are.

No. You are not done with SQL injection just because you use "bind variables". Plenty of things can't be parameterized that are nonetheless subject to user influence. Click the top of any reverse-sortable column in a web user interface to see one obvious example. Parameterized queries are a good thing, and you should use them, but I feel like I've had to be a broken record about this over the last week: they are not…

Click the top of any reverse-sortable column in a web user interface to see one obvious example.

People don't do those in JavaScript?

That's what I did a decade ago. Well, then I moved it back to the server after we got tired of the performance problems that JavaScript had back then. But today it wouldn't be an issue. And when we moved it back, we were careful not to have an SQL injection attack. If memory serves we actually did the resort in Perl. (In our defense, much of the data we were serving lived in flat files, or were generated on the fly from a compute server, instead of coming from a database.) However at another company I had the same problem, and I did the obvious "process CGI parameter, insert appropriate ORDER BY statement". Where the definition of appropriate was by column position, from which I worked out the field to sort by, so I didn't have to trust the client for the name of that column.

I should back up. We didn't have any SQL injection attacks that I knew of and were reasonably careful. But that code base did not get audited, so I can't really know that. However after the next company that I worked for got bought by eBay, they did a penetration test on us. The worst thing that they found was an open redirect that could be used to let a spammer construct a link to any web page with us as the referer.

I'm happy to use this as a testament that programmers really can avoid SQL injections. However their surprise that they didn't find any SQL injections in our code supports your claim that most teams fail to do so successfully.

Re: Main GNU source repository server compromised

#28

Post by tptacek »

btilly wrote: post #27
tptacek wrote: post #26

Earlier quoted context omitted.

No. You are not done with SQL injection just because you use "bind variables". Plenty of things can't be parameterized that are nonetheless subject to user influence. Click the top of any reverse-sortable column in a web user interface to see one obvious example. Parameterized queries are a good thing, and you should use them, but I feel like I've had to be a broken record about this over the last week: they are not…

Click the top of any reverse-sortable column in a web user interface to see one obvious example. People don't do those in JavaScript? That's what I did a decade ago. Well, then I moved it back to the server after we got tired of the performance problems that JavaScript had back then. But today it wouldn't be an issue. And when we moved it back, we were careful not to have an SQL injection attack. If memory serves we…

I'm not sure what you think I'm arguing; that it's impossible to avoid SQLI? Of course not. All I'm saying is that parameterized queries aren't the end of the story; the teams that believe they don't have SQLI because they use parameterized queries are the ones that are going to lose their apps to SQLI.

Re: Main GNU source repository server compromised

#29

Post by btilly »

tptacek wrote: post #28
btilly wrote: post #27

Earlier quoted context omitted.

Click the top of any reverse-sortable column in a web user interface to see one obvious example. People don't do those in JavaScript? That's what I did a decade ago. Well, then I moved it back to the server after we got tired of the performance problems that JavaScript had back then. But today it wouldn't be an issue. And when we moved it back, we were careful not to have an SQL injection attack. If memory serves we…

I'm not sure what you think I'm arguing; that it's impossible to avoid SQLI? Of course not. All I'm saying is that parameterized queries aren't the end of the story; the teams that believe they don't have SQLI because they use parameterized queries are the ones that are going to lose their apps to SQLI.

What is the full story?

It seems to me that two tricks nail it. First use parametrized queries. And secondly if you have information you need to send/receive from the client that isn't easily parametrized, have a limited list of possible things that can be accepted back, which is checked in code while building the query.

If you're doing those two things, I don't see how much work it is to avoid SQLI. Furthermore if you're using a reasonable ORM, then you should get both of those pretty much for free. (Well you have the overhead of learning the ORM itself.)

Re: Main GNU source repository server compromised

#30

Post by tptacek »

btilly wrote: post #29
tptacek wrote: post #28

Earlier quoted context omitted.

I'm not sure what you think I'm arguing; that it's impossible to avoid SQLI? Of course not. All I'm saying is that parameterized queries aren't the end of the story; the teams that believe they don't have SQLI because they use parameterized queries are the ones that are going to lose their apps to SQLI.

What is the full story? It seems to me that two tricks nail it. First use parametrized queries. And secondly if you have information you need to send/receive from the client that isn't easily parametrized, have a limited list of possible things that can be accepted back, which is checked in code while building the query. If you're doing those two things, I don't see how much work it is to avoid SQLI. Furthermore if y…

There's almost nothing wrong with your second "trick" (when we write recommendations, we usually suggest people never allow users to directly write syntax, and that they structure their app so that the parameters the user sees couldn't possibly land in SQL; use "1" for "ASC" and "0" for "DESC", etc).

But it's not nearly as powerful a statement to say "use parameterized queries and then do everything else right" as it is to say "just use parameterized queries and you won't have this problem", is it?

Post reply on HN