Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MySQL.com compromised via (guess what?) SQL injection

blog.sucuri.net

Post reply on HN
Print view View original

101–110 of 117 posts

Re: MySQL.com compromised via (guess what?) SQL injection

#101

Post by wladimir »

jschrf wrote: post #98
nbpoole wrote: post #92

Earlier quoted context omitted.

From elsewhere (with context): http://news.ycombinator.com/item?id=2375985

IMHO choosing between ASC and DESC isn't exposing an input into the query in the same way that accepting arbitrary text (escaped or not) into the query is, but thanks for clarifying.

And with regard to LIMIT, it's a bad idea to allow the user to pass in any values without validation, even if you restrict it to integers.

Parametrized queries help resolve the most common kinds of SQL injection, all the "yes but..." argue that it's not a blanket instrument that instantly should make you feel safe and no longer think about security/robustness. That's also true. Such a thing doesn't exist anyway.

Re: MySQL.com compromised via (guess what?) SQL injection

#103

Post by _b8r0 »

tptacek wrote: post #45
fmavituna wrote: post #22

Earlier quoted context omitted.

Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities. Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.

You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering. Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?

Disclaimer: I use Metasploit on a more or less daily basis, as well as Burp Suite Pro and more recently have been evaluating NetSparker Community Edition as our Canvas D2 subscription is up for renewal, and we've been considering switching to NetSparker. I've met Ferruh once at DC4420[1] and he seemed like a sound guy to have a beer with.

Ferruh was simply responding to a direct question about how it was different. Sure, he's the author but a) he was asked. b) he's probably best suited.

Ferruh isn't running a matasano scale operation, he's doing it on his own, peldi style.

It's not inappropriate for him to discuss his product, nor to answer questions on it - this is a startup community after all. At what point did you become the HN comment police?

[1] http://www.dc4420.org

Re: MySQL.com compromised via (guess what?) SQL injection

#104

Post by _b8r0 »

bjg wrote: post #17
fmavituna wrote: post #9

Same guys hit Sun.com via SQL Injection as well - http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulne... Shameless self plug: Netsparker ( My startup: http://www.netsparker.com/ ) could have identified both of these vulnerabilities.

That product looks awfully similar to Metasploit ( http://www.metasploit.com/ ) , no? How is it different? I watched the demo video and couldn't really tell.

As someone who uses Metasploit, Canvas, Burp Suite Pro and am currently evaluating Netsparker I might be able to offer an unbiased view.

Metasploit is an exploitation framework. There's different versions available (community, pro etc.). The community version has a web app scanner and is reasonably ok, but it tends to be caught by intrusion detection systems fairly easily and it's payloads often don't clean up properly. It's better suited to infrastructure exploitation, but can be used in a web app context.

Canvas[1] has some limited web app scanning capability but has more of a core focus on infrastructure exploitation.

Burp Suite Pro[2] is a framework for testing web applications. It's probably the best tool out there for testing web apps (if you know what you're doing). It's also ludicrously cheap and there is a free version for non-commercial use. It comes with a fairly comprehensive web app scanner.

NetSparker is a web application scanner. From what I can tell it's mainly competing with things like Accunetix. It has some features that are similar to Metasploit Pro but focuses primarily on the application layer. It sits more between Burp Suite Pro and Canvas for my purposes. You can download an eval from http://www.mavitunasecurity.com/ or the community edition.

[1] http://www.immunityinc.com

[2] http://www.portswigger.net

Re: MySQL.com compromised via (guess what?) SQL injection

#105

Post by _b8r0 »

marcamillion wrote: post #100
tptacek wrote: post #72

Earlier quoted context omitted.

It's one of a large variety of tools that addresses this problem, which begs for a response clarifying where his product fits in and what its strengths and weaknesses are. Now we're no longer talking about SQLI on MYSQL.COM; we're talking about scanners... because a vendor wants us to. But, more to the point, how annoying would it be if every time I responded to a comment on HN, I added "this is one of the many thing…

Ahh...now I get it. I was wondering why this plug peeved you so much. You compete with that guy. Wow...talk about having a vested interest. This is so unfortunate because now I have to double check grievances on HN to see who has a vested interests - which degrades the integrity of the community. For someone with such high karma...this is so disappointing.

It may have been (to paraphase an earlier tptacek ranty comment) 'disingenious' of him not to disclose that he does web app security, but it's not necessarily his vested interest at fault.

For what it's worth, I often disagree with tptacek and while I lack the HN celebrity status, I don't really care because in the real world he's just another guy on the other side of the world arguing on the Internet. I do think that he's not motivated by commercial greed in his commentary though, and on the whole his comments (while I've never met him personally) display a good level of honesty, integrity and community spirit.

Unfortunately in this case he's gone after someone who in my experience is the epitome of what HN should be encouraging - a guy in an industry, who's set up on his own, who has written and sells a product more or less solo that helps address the specific problem being discussed. If this was bingo cards noone would give patio11 any grief for talking about BCC. What's worse is that tptacek's company is several orders of magnitude bigger than Ferruh's and his services directly compete, but I don't think tptacek was thinking of this at the time of his post, and certainly not looking for any commercial advantage.

Re: MySQL.com compromised via (guess what?) SQL injection

#106

Post by _b8r0 »

tptacek wrote: post #32
awj wrote: post #25

Earlier quoted context omitted.

You're arguing against the periphery of his point. By waiting so long to provide parameterized queries, MySQL helped foster the attitude that they were "useless enterprise bloat". The lack of parameterized queries was likely an influencing factor in the non-support or non-advertisement of parameterized-style APIs. MySQL is a crucial part of its own community. You cannot hold the community responsible for this situati…

I have never heard someone say parameterized queries were "useless enterprise bloat". Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test. Your reaction here sounds hyperbolic, and the parent commenter is right: parameterized queries, while helpful, are neither required nor sufficient for defense against SQLI.

> Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test

I'll resist the pot/kettle/colour connection here about plugging your own stuff on HN in a web app security thread. Agh, too late.

On a more serious note, if all the Internet apps Matasano test are using parameterized queries then:

a) Matasano never tests a MySQL-based app

AND

i) Matasano does very little web app testing these days

OR

ii) You're not quite telling us the truth

Seriously, parameterized queries while being a best practice so to speak are not a one size fits all solution and is not something implemented by everyone. The amount of shonky development practices we come across at my unnamed and unplugged company far outweighs the instances of the security aware, certainly on the first, second and sometimes third time round.

Today I'm testing a wordpress-based web app. A beer says that it's not using parameterized queries.

Re: MySQL.com compromised via (guess what?) SQL injection

#107

Post by jonursenbach »

albertzeyer wrote: post #4

I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (…

You might be interested in Handler Socket.

https://github.com/ahiguti/HandlerSocket-Plugin-for-MySQL

Re: MySQL.com compromised via (guess what?) SQL injection

#108

Post by marcamillion »

_b8r0 wrote: post #105
marcamillion wrote: post #100

Earlier quoted context omitted.

Ahh...now I get it. I was wondering why this plug peeved you so much. You compete with that guy. Wow...talk about having a vested interest. This is so unfortunate because now I have to double check grievances on HN to see who has a vested interests - which degrades the integrity of the community. For someone with such high karma...this is so disappointing.

It may have been (to paraphase an earlier tptacek ranty comment) 'disingenious' of him not to disclose that he does web app security, but it's not necessarily his vested interest at fault. For what it's worth, I often disagree with tptacek and while I lack the HN celebrity status, I don't really care because in the real world he's just another guy on the other side of the world arguing on the Internet. I do think tha…

I understand and appreciate that line of reasoning - had it been for a one off comment and had it been someone else.

We are talking about the guy with the most karma points on HN - so he knows the culture - and we are talking about (presumably) someone that owns & runs his own company. So at the very least, ignoring that this guy is his competitor, given that he is the highest ranking member on HN (karma-wise aside from PG), he should be applauding someone that has taken the road he travelled earlier and built his wonderful firm that he is running today.

Yet he tears him a part, not on one instance - i.e. in a reply to one comment, but if you look through the thread there are MANY comments when he jumps on the guys back.

It's totally and completely unacceptable, for any HN member to deal with any non-trolling HN member like that. Regardless of karma points.

What makes it worse is that he has a vested interest. So the only rational excuse is that 2 + 2 = 4.

Why else would he betray the ethos & spirit of HN so blatantly ? Let the truth be told, it could very well be just that he was having a bad day or whatever it is - but given that this is a story closely related to his main bread and butter you would think that he would be extra cautious.

What he has done here, is the equivalent of PG ripping apart a plug by someone from TechStars or any of the other incubators (e.g. the program in Chile that I see pop-up here from time to time, or the one in Ireland or the UK most recently) when they come here to post a 'shameless plug'.

That would be very irresponsible for PG to do.

As I said, if it were someone else that was new to the community I could let it slide...but not for someone that is CLEARLY the most karma'd person here.

Re: MySQL.com compromised via (guess what?) SQL injection

#109

Post by kahawe »

marcamillion wrote: post #108
_b8r0 wrote: post #105

Earlier quoted context omitted.

It may have been (to paraphase an earlier tptacek ranty comment) 'disingenious' of him not to disclose that he does web app security, but it's not necessarily his vested interest at fault. For what it's worth, I often disagree with tptacek and while I lack the HN celebrity status, I don't really care because in the real world he's just another guy on the other side of the world arguing on the Internet. I do think tha…

I understand and appreciate that line of reasoning - had it been for a one off comment and had it been someone else. We are talking about the guy with the most karma points on HN - so he knows the culture - and we are talking about (presumably) someone that owns & runs his own company. So at the very least, ignoring that this guy is his competitor, given that he is the highest ranking member on HN (karma-wise aside f…

I am afraid being the person with the most karma doesn't make him an epitome of hacker ethics or shining beacon of hope but mostly a guy who knows very well how to work it. They have those "superstars" on reddit as well (just look for andrewsmith) and well, we also have them here, even if that leaves a bad taste in some mouths... looks like it is a very human thing after all.

Re: MySQL.com compromised via (guess what?) SQL injection

#110

Post by kalleboo »

albertzeyer wrote: post #64
tptacek wrote: post #57

Earlier quoted context omitted.

You've made "SQL injection" impossible by inventing "albertzeyerql", which will inevitably be vulnerable to "AZQL injection". Many of the NoSQL's have similar problems; expect to hear more about them in Blackhat presentations yet to come. It's not pointless to discuss how query languages can be made simpler to parse and thus less susceptible to injection, but the technique isn't foolproof and is (obviously) expensive…

I am not really talking about a language at all (at least not on a byte-alphabet). Maybe we misunderstood a bit. For example, take a look at the [new Redis 2.0 protocol]( http://redis.io/topics/protocol ). In this protocol, injections are simply impossible. This may not be the best example because you don't really have more complicated queries but you could just do the same for tree-like structures.

I don't see why you couldn't inject a CR LF? Sure it might not be that dangerous (although it could be depending on what validation the server does on # of args), but you're still modifying the query.
Post reply on HN