Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MySQL.com compromised via (guess what?) SQL injection

blog.sucuri.net

Post reply on HN
Print view View original

1–10 of 117 posts

Re: MySQL.com compromised via (guess what?) SQL injection

#2

Post by riffraff »

while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ?

(I'm aware this may make impossible to use some web frameworks which rely on rdbms reflection, but I have the feeling this is not the case)

Re: MySQL.com compromised via (guess what?) SQL injection

#4

Post by albertzeyer »

I wonder a bit that there isn't a real binary protocol for SQL.

Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa...

I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble.

Edit: If all client-side libs (for PHP, Python, etc.) would just use those [prepared statements](http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statem...), it would be like what I mean.

Edit: Ah, I was wrong (as I hoped): For Python: https://launchpad.net/oursql

Re: MySQL.com compromised via (guess what?) SQL injection

#5

Post by drinian »

Doesn't really seem responsible to post the vulnerability details to the public list like that, all necessary shaming on weak passwords aside.

I wonder if the timing on this has anything to do with Oracle's continued dismantling of the useful parts of the MySQL website.

Re: MySQL.com compromised via (guess what?) SQL injection

#6

Post by m0nastic »

riffraff wrote: post #2

while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ? (I'm aware this may make impossible to use some web frameworks which rely on…

SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is".

Aside from implementing bound parameters (which is useful for more than just preventing sql injection), we usually recommend using stored procedures if at all possible.

It's really suboptimal to rely on the user to specify what table they're accessing.

Re: MySQL.com compromised via (guess what?) SQL injection

#7

Post by wulczer »

riffraff wrote: post #2

while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ? (I'm aware this may make impossible to use some web frameworks which rely on…

Absolutely. The web application should be logging to the database as an unpriviledged user. Seems that by now most people have learned that running web services as root is a bad idea, but they still forget that they should also have an unpriviledged database user for them.

Re: MySQL.com compromised via (guess what?) SQL injection

#8

Post by xd »

albertzeyer wrote: post #4

I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (…

SQL is a human readable language .. what do you mean by "real binary protocol" ?

Re: MySQL.com compromised via (guess what?) SQL injection

#10

Post by xd »

albertzeyer wrote: post #4

I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (…

Reply to your edit.

SQL is text. Also no one is sending a query to the server. It's a value that is embedded into the SQL query that circumvents it.

Post reply on HN