The game ships a libmysql library. Unless they got a commercial license for it, that's a GPL violation in the wild.
Super Meat Boy leaves database wide open
51–60 of 99 posts
Re: Super Meat Boy leaves database wide open
#52The game ships a libmysql library. Unless they got a commercial license for it, that's a GPL violation in the wild.
It isn't a GPL violation because the game is just interfacing with a master MySQL database, not using one to store local content.
Re: Super Meat Boy leaves database wide open
#53So what would be the solution? He used a password protected database connection and put the password compiled in binary. If I was doing it I would have probably done the same. How else can it be done? Use web service? That would still look "open" to someone digging inside the compiled binary and getting the keys.
I can't believe how many people here think this is okay. YES, a web service! Please never apply to a company that I am working for!
The less one knows about a system the more layers of firewall he will put up to protect it.
People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work."
> Please never apply to a company that I am working for!
Sure. Thanks.
Re: Super Meat Boy leaves database wide open
#54Re: Super Meat Boy leaves database wide open
#55Earlier quoted context omitted.
Fair question. A web service would indeed be a better solution. With a web service, you have a server-side application layer, and all database reading and writing is done by that layer. Sure, you might be able to authenticate and send bogus info to the web service. Even that can be made very difficult, e.g. by cryptographically signing requests or encrypting the data on the wire. So if you do that, worst case scenari…
There is a misunderstanding. Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run and only on those database and tables where the admin has granted him access. Not too different from a web service. Also no amount of encryption will secure the system because it's not about man in the middle attack. It's about decompi…
"Someone connecting to a "open" MySQL server will only be able to run those type of queries (select,update or delete) that he is explicitly permitted to run"
... bar any security vulnerability in your sql engine, which is bound to exist -- relational databases are historically less hardened than web servers, because they're less subject to abuse (they mostly run in safe intranets, not on the big bad Internet).
An application layer inbetween malicious users and your databases will provide proper input validation and security in addition to flaky db security, and (in most cases) it will guarantee that your database will remain intact should malicious users crash your front-end code -- which, when properly secured, will also have minimal rights on the schema, hence insuring that attackers don't get more rights than absolutely necessary for the app to run. At the very minimum, it will provide an additional barrier that malicious users will have to overcome before getting at your data goodies, giving you additional time to get on top of things.
The internet is a permanent war zone. Running an open relational database on the internet is like having an HQ not surrounded by tanks, because "after all, nobody can get through our glass doors unless they have the right papers".
Re: Super Meat Boy leaves database wide open
#56Earlier quoted context omitted.
I can't believe how many people here think this is okay. YES, a web service! Please never apply to a company that I am working for!
The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…
I'd honestly like to know how you can "safely copy files" with Explorer.
You know a lot of viruses, you don't know all the viruses. How can you discount the possibility that, one day, the USB interface itself will be subverted to spread viruses ?
Re: Super Meat Boy leaves database wide open
#57Earlier quoted context omitted.
Asking the database administrator in you, what's the most efficient way to do it? Queue and push updates every 10 minutes?
One is: don't use the database for this. Lock/read/write/unlock is very slow when you need a round-trip over the Internet for each phase. (Remember, with optimistic locking, many transactions are in the Lock/read state as the same time. When someone writes the new death count, all transactions in the lock/read state are rolled back and started from the beginning, as the data read is now invalid. And that's assuming M…
[deleted]
Re: Super Meat Boy leaves database wide open
#58Earlier quoted context omitted.
Sorry, if you read the page linked you'd see that that is not the case. It is open to SELECT, UPDATE, and INSERT. if it were SELECT only that would be read-only. As it is, that's just stupid as any user can wantonly edit anything. I could trivially edit every level's author to be myself or do intensive operations which result in a DOS. The only smart way to give clients access to a database is through some sort of fr…
> The only smart way to give clients access to a database is through some sort of frontend entirely under your control which prevents them from having the user/pass and sanitizes the queries. MySQL maybe, but enterprise DBs (think Oracle, DB2, Postgres) support a very fine-grained access model.
I'd argue that even then, they are less hardened against network-layer exploits than your average webserver. Network security is bread & butter for a webserver, not for your enterprise DB running in safe intranets with only cursory penetration testing.
Re: Super Meat Boy leaves database wide open
#59So what would be the solution? He used a password protected database connection and put the password compiled in binary. If I was doing it I would have probably done the same. How else can it be done? Use web service? That would still look "open" to someone digging inside the compiled binary and getting the keys.
I think your question is very valid and I think the answer is that the "solution" depends on what your goals are. The author may even consider it to be perfectly fine if he has to reset these statistics regularly, or even move to a more protected system in a later version if it gets hacked. His main goal was probably something like "put a system in to send me some analytic information, but spend as little time as pos…
a "story" that doesn't consider security over the internet is doomed to get your rooted sooner or later.
Re: Super Meat Boy leaves database wide open
#60Earlier quoted context omitted.
I can't believe how many people here think this is okay. YES, a web service! Please never apply to a company that I am working for!
The less one knows about a system the more layers of firewall he will put up to protect it. People get astonished when I insert a virus infected USB disk into my Windows machine and use Explorer to safely copy files from it. And when they ask what anti-virus I use, I say "None, never used any anti-virus in my life. I reversed engineered a lot of viruses and I know how they work." > Please never apply to a company tha…
Yeah, so if you had an USB stick with one of those WMF exploits before the patch was out you'd be toast.