Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websmart, Inc. and 100,000 Vulnerable Websites

samsclass.info

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#61

Post by calhoun137 »

jcrites wrote: post #54

Is there really a SQL injection vulnerability? Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection. For it to be an injection vulnerability, the server needs to execute the query (not f…

One problem is that the SQL error messages are being displayed. That is really bad, since being able to read the error messages can be used to systematically find vulnerable queries.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#62

Post by rhizome »

jcrites wrote: post #54

Is there really a SQL injection vulnerability? Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection. For it to be an injection vulnerability, the server needs to execute the query (not f…

The fix could be as simple as a digits-only regex on page ids and redirects on db exceptions.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#63

Post by SchizoDuckie »

jcrites wrote: post #54

Is there really a SQL injection vulnerability? Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection. For it to be an injection vulnerability, the server needs to execute the query (not f…

Please goto http://sqlmap.org . Watch the video. And weep. If you have really simple sql exception like this, you can craft queries that will dump the entire database including it's schema and users byte-by-byte with an automated script.

SQL Injections are the basis of escalating further and possibly even hacking into the whole underlying system.

I know for a fact that I can dump any of these databases within hours. I do not know what's in them, but I'm guessing it's not information that any of these 100.000 business owners will want to disclose of their clients.

I also know it's illegal, but then agian, will that bother any 13 year old kid that feels himself a 1337 h4xx0r? Any Russian delegation? I think not.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#64

Post by ibudiallo »

jcrites wrote: post #54

Is there really a SQL injection vulnerability? Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection. For it to be an injection vulnerability, the server needs to execute the query (not f…

After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same people) and passwords are stored in plain text.

So No it is not just syntax error.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#65

Post by joe_computer »

rallison wrote: post #38
orf wrote: post #21

Earlier quoted context omitted.

Its sad that this is 2013 and these basic fucking issues still plague websites (and the people who make them). I wonder if the root of these issues is in education or the tools used? Or both?

It seems to be a combination of both a lack of knowledge with respect to security and often a lack of respect. With many smaller companies, it is often ignorance. With many others, it is still too often the case that security concerns end up getting thrown in the "yeah, we should fix that eventually" pile of bugs. Another issue is that security issues are often not visible to normal users. In the websmart example, a…

> With many smaller companies, it is often ignorance.

I think that's an unfair statement about smaller companies. Just two months ago a SQL vulnerability was discovered on the website of NASDAQ.

I think the solution is to use frameworks that promote safe behaviour and have idioms for dealing with common cases. Make someone go out of their way to do the dangerous thing.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#66

Post by emilv »

columbo wrote: post #43

My personal advice to all small-business-owners: Don't get into pissing matches! Yeah, I don't like Sam Bowne's approach. His initial email read as someone looking to make a name for himself (this is the biggest security flaw I've ever found! You have 6 days to respond!). Despite this, if I had received an email like this I would have sent back a personal thank you followed with an outline of action steps. If I get a…

That domain name sure looks like a phishing scam.

Six days to take down the websites and start bugfixing is a lot of time for this kind of vulnerability.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#67

Post by jcrites »

ibudiallo wrote: post #64
jcrites wrote: post #54

Is there really a SQL injection vulnerability? Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection. For it to be an injection vulnerability, the server needs to execute the query (not f…

After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same people) and passwords are stored in plain text. So No it is not just syntax error.

Would you mind sharing an example query string that injects and passes validation? I'd be interested to see what technique enables it to be valid.

(It's obvious to me that the site is under high risk since user-provided strings show up in SQL validation errors, which includes the rest of a real query, but simple injections like using ' and " to break out did not work in my few minutes of trying, so I'm interested to learn what worked.)

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#68

Post by ibudiallo »

jcrites wrote: post #67
ibudiallo wrote: post #64

Earlier quoted context omitted.

After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same people) and passwords are stored in plain text. So No it is not just syntax error.

Would you mind sharing an example query string that injects and passes validation? I'd be interested to see what technique enables it to be valid. (It's obvious to me that the site is under high risk since user-provided strings show up in SQL validation errors, which includes the rest of a real query, but simple injections like using ' and " to break out did not work in my few minutes of trying, so I'm interested to…

I will send you a generic example on your email.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#69

Post by markdown »

adriancooney wrote: post #31
markdown wrote: post #27

Earlier quoted context omitted.

And now, realizing the danger they are in, they fix the door or harass their vendor into doing it. Finally, thanks to the efforts of one good samaritan, they're safe.

Who each have to go through the contractor to get them fixed resulting in a bottleneck. Thieves are already running rampant at the disclosure while the contractor is frantically fixing the windows.

An unfortunate series of events, but the poor homeowners are glad it happened, because now they see their contractor for the careless, incompetent fool that he is.

They vow never again to put their families at risk by letting him near their house.

They find a better contractor.

Re: Websmart, Inc. and 100,000 Vulnerable Websites

#70

Post by markdown »

gk1 wrote: post #29

Wow. Just wow. I used to manage client accounts at an agency. Here's how I'm seeing this: - Author sends a condescending, threatening, passive-aggressive, and shaming email to a vendor and its clients. - Vendor respectfully explains that it was an unprofessional thing to do, because their client relationships were put at risk without them having a chance to correct their mistake. - Author completely fails to understa…

An understandable opinion coming from a client accounts manager.

Now try and see it from the viewpoint of the poor sods who have the unfortunate fate of being this incompetent fools clients.

Post reply on HN