Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why NoSQL Equals NoSecurity

informationweek.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Why NoSQL Equals NoSecurity

#21

Post by ZephyrP »

jmillikin wrote: post #18
ZephyrP wrote: post #6

I'm the author of a (very) new NoSQL datastore called Artifact ( http://zv.github.com/artifact/ ), that, admittedly, is very prototypical and is not representative of MongoDB, Couch, Riak or any of the other major players. I'm also a vulnerability researcher who makes his way in the world finding and dissecting security bugs and holes in network infrastructure. I feel this article misrepresents a lot of facts about s…

Serious question -- was your post generated by a Markov chain? While the sentences and paragraphs are basically grammatical, they make no sense at all.

I'm sorry my green ideas are not to your furious sleep specifications. Forgive me Strunk and White.

Re: Why NoSQL Equals NoSecurity

#22

Post by perlgeek »

ZephyrP wrote: post #6

I'm the author of a (very) new NoSQL datastore called Artifact ( http://zv.github.com/artifact/ ), that, admittedly, is very prototypical and is not representative of MongoDB, Couch, Riak or any of the other major players. I'm also a vulnerability researcher who makes his way in the world finding and dissecting security bugs and holes in network infrastructure. I feel this article misrepresents a lot of facts about s…

> The fact that query strings are safe in every major NoSQL datastore is such a massive advantage over SQL DBs that, even if you're using prepared statements, NoSQL is almost assuredly more secure in a day to day context, except against zero-days

In what way is my SQL DB (which I use with prepared statements and placeholders) more vulnerable than any NoSQL thing?

> It's not unreasonable to trust major commercial firewalls for anything you'd trust SSH for. It's not reasonable to trust C/C++ applications in general

So the major commercial firewalls aren't written in C or C++? I find that mildly surprising, since I know only of netfilter and pf, and both are written in C

Re: Why NoSQL Equals NoSecurity

#23

Post by tptacek »

ZephyrP wrote: post #20
tptacek wrote: post #17

Earlier quoted context omitted.

All firewalk did was port scan through firewalls. It wasn't some magic trick that got you root on them. I don't know what you're trying to say with regards to SSL, or how it can be reasonably compared to runtime hardening.

Most firewalls can be configured to block packets with a TTL greater than the route hop count back or simply never allow traffic through even if the TTL is the hop count + X (where X is distance to internal host, presumably 1) I didn't mean to imply TTL incrementation was magic remote root. As far as SSL, you're right in that it is a bit tangential. I'm just trying to illustrate the huge security flaws that, in my ey…

What huge security flaws in TLS are you referring to?

(One of my business partners is the author of firewalk).

Re: Why NoSQL Equals NoSecurity

#24

Post by thezilch »

nupark2 wrote: post #19
thezilch wrote: post #7

WTF? If you can't trust your network, OS, and user level access, how are you going to trust a DB ACL? I'll put everything up against Information Week using a caching layer (Re: memcached), which has unfettered access without security from an external layer. Non-NoSQL don't magically make security a non-issue; what a joke; in all cases, equally, one has to be aware and diligent about securing your network.

> WTF? If you can't trust your network, OS, and user level access ... You can't trust them all equally, and allow for a failure in any one of them to result in a total failure of all security. That's the M&M security model -- crunchy on the outside. This is one (of several reasons) I wouldn't use memcached without authentication if it could lead to a privilege increase: It completely breaks defense-in-depth. Compromi…

The article's author/etc simply has an axe to grind with NoSQL. Are we going to throw out our *nix flavors that have us disable root SSH? Our FSes that don't have or disable-by-default block encryption? Security should definitely be championed, full stop, but I'm not convinced by this article that NoSQL or relational DBs have any reason to be implementing the secure layers on my systems.

A big draw to NoSQL is not only the ease of use. One advantage is the separation of working parts. Not jack of all trades, master of none architectures.

Re: Why NoSQL Equals NoSecurity

#25

Post by ZephyrP »

tptacek wrote: post #23
ZephyrP wrote: post #20

Earlier quoted context omitted.

Most firewalls can be configured to block packets with a TTL greater than the route hop count back or simply never allow traffic through even if the TTL is the hop count + X (where X is distance to internal host, presumably 1) I didn't mean to imply TTL incrementation was magic remote root. As far as SSL, you're right in that it is a bit tangential. I'm just trying to illustrate the huge security flaws that, in my ey…

What huge security flaws in TLS are you referring to? (One of my business partners is the author of firewalk).

I'm a mere pup in San Francisco, you're Thomas Ptacek. You probably have a wikipedia page and personal islands. I could suffer an untimely fate if you so much as looked at me wrong.

What I mean to say is that your authority is better than mine on this - so if you think SSL is secure, then I'll start telling people SSL is secure. I just think the numerous vulnerabilities unearthed so far, ranging from the eminently practical (Compromise a CA!) to the blindingly obvious (SSLStrip) constitute a poor record.

Re: Why NoSQL Equals NoSecurity

#26

Post by tptacek »

ZephyrP wrote: post #25
tptacek wrote: post #23

Earlier quoted context omitted.

What huge security flaws in TLS are you referring to? (One of my business partners is the author of firewalk).

I'm a mere pup in San Francisco, you're Thomas Ptacek. You probably have a wikipedia page and personal islands. I could suffer an untimely fate if you so much as looked at me wrong. What I mean to say is that your authority is better than mine on this - so if you think SSL is secure, then I'll start telling people SSL is secure. I just think the numerous vulnerabilities unearthed so far, ranging from the eminently pr…

Not the response I was going for; just wondering if you meant policy stuff like CA's or protocol stuff.

Re: Why NoSQL Equals NoSecurity

#27

Post by viraptor »

jmillikin wrote: post #18
ZephyrP wrote: post #6

I'm the author of a (very) new NoSQL datastore called Artifact ( http://zv.github.com/artifact/ ), that, admittedly, is very prototypical and is not representative of MongoDB, Couch, Riak or any of the other major players. I'm also a vulnerability researcher who makes his way in the world finding and dissecting security bugs and holes in network infrastructure. I feel this article misrepresents a lot of facts about s…

Serious question -- was your post generated by a Markov chain? While the sentences and paragraphs are basically grammatical, they make no sense at all.

I found the post very clear and interesting. Maybe it was written like a rant that you'd normally say out loud rather than write down, but it was good nevertheless. What did you find confusing?

Re: Why NoSQL Equals NoSecurity

#28

Post by hartror »

jmillikin wrote: post #18
ZephyrP wrote: post #6

I'm the author of a (very) new NoSQL datastore called Artifact ( http://zv.github.com/artifact/ ), that, admittedly, is very prototypical and is not representative of MongoDB, Couch, Riak or any of the other major players. I'm also a vulnerability researcher who makes his way in the world finding and dissecting security bugs and holes in network infrastructure. I feel this article misrepresents a lot of facts about s…

Serious question -- was your post generated by a Markov chain? While the sentences and paragraphs are basically grammatical, they make no sense at all.

Made sense to me.

Re: Why NoSQL Equals NoSecurity

#29

Post by shuzchen »

thezilch wrote: post #7

WTF? If you can't trust your network, OS, and user level access, how are you going to trust a DB ACL? I'll put everything up against Information Week using a caching layer (Re: memcached), which has unfettered access without security from an external layer. Non-NoSQL don't magically make security a non-issue; what a joke; in all cases, equally, one has to be aware and diligent about securing your network.

Honestly, I don't think the ACL really provides much in terms of security. I mean, your db username and passwords are stored (in plain text) in your settings.py, config.php, database.yaml, etc. I've seen a few times where master passwords have shown up in a user's bash history due to carelessness. Also consider that your backup script contains read access credentials for all your data.

IMO the main benefit of having an ACL is to compartmentalizes your database so that a SQL injection against one app (maybe) won't spill over to a different app. That's not something that makes me feel good at all.

Re: Why NoSQL Equals NoSecurity

#30

Post by methodin »

NyxWulf wrote: post #12
methodin wrote: post #11

I would tend to think financial/banking/ would be insecure no matter what data store they use. It seems to just be part of the game - ask anyone that's developed for one. One would assume that by adopting NoSQL that would mean a refresh of code/architecture/security but only a small part of me actually believes that. I also do not really understand the point of this article ad it did not provide me with anything usef…

I'll play. I worked at a financial institution for several years. On the one hand you'd think we were secure because we used a relational database, but we also had a heavily segmented network with all of the databases in their own VLAN's with highly restrictive permissions. On top of that each application was locked down to exactly which data it could use and what could be done with that data. So if you buy the premi…

Did your institution go the seldom traveled route of encrypting sensitive information? Typically all the effort is spent trying to avoid breaches instead of protecting against them when they occur.
Post reply on HN