Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MySQL.com compromised via (guess what?) SQL injection

blog.sucuri.net

Post reply on HN
Print view View original

111–117 of 117 posts

Re: MySQL.com compromised via (guess what?) SQL injection

#111

Post by kalleboo »

albertzeyer wrote: post #4

I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (…

Binary protocols aren't magically immune to injection-style attacks, just look at the decades of buffer overflow vulnerabilities.

Re: MySQL.com compromised via (guess what?) SQL injection

#112

Post by vog »

jedsmith wrote: post #27

Actual information with more details, minus zero-content blog: http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t... http://pastebin.com/BayvYdcP

I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication:

http://news.ycombinator.com/item?id=2377013

Re: MySQL.com compromised via (guess what?) SQL injection

#113

Post by sathyabhat »

vog wrote: post #112
jedsmith wrote: post #27

Actual information with more details, minus zero-content blog: http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t... http://pastebin.com/BayvYdcP

I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication: http://news.ycombinator.com/item?id=2377013

Because it was submitted ~10 hours prior to the link you posted.

Re: MySQL.com compromised via (guess what?) SQL injection

#114

Post by TimJYoung »

nbpoole wrote: post #92
jschrf wrote: post #90

Earlier quoted context omitted.

Can you elaborate on this? Given a properly parameterized query, where none of the parameters are ever evaluated, how do any user inputs remain unseperated from query structure?

From elsewhere (with context): http://news.ycombinator.com/item?id=2375985

I'm failing to see how ASC and DESC would apply here, unless someone is simply passing them on directly from a URL or input form into the SQL, which is almost the equivalent of just letting the user type in the SQL directly. Also, the worst thing that can happen to an extension like LIMIT is that more rows show up than expected, but that wouldn't change the context of the original query to return data that wasn't originally intended to be shown. Plus, it would be very difficult to tag on more SQL to a direct LIMIT number being passed in unless the back-end application was totally brain-dead about how it converted strings to integers.

One other thing - extensions like LIMIT can be parameterized also (shameless plug: our product ElevateDB can do it with its RANGE clause). It's a nice way of getting rid of this type of issue, and allows for easier pagination without having to force the database engine to constantly re-prepare the same query over and over again.

Re: MySQL.com compromised via (guess what?) SQL injection

#115

Post by albertzeyer »

kalleboo wrote: post #110
albertzeyer wrote: post #64

Earlier quoted context omitted.

I am not really talking about a language at all (at least not on a byte-alphabet). Maybe we misunderstood a bit. For example, take a look at the [new Redis 2.0 protocol]( http://redis.io/topics/protocol ). In this protocol, injections are simply impossible. This may not be the best example because you don't really have more complicated queries but you could just do the same for tree-like structures.

I don't see why you couldn't inject a CR LF? Sure it might not be that dangerous (although it could be depending on what validation the server does on # of args), but you're still modifying the query.

Because you are sending the byte-size of the key/value. So whatever there comes, it will be covered, you can just pass any possible binary string.

Re: MySQL.com compromised via (guess what?) SQL injection

#116

Post by tptacek »

marcamillion wrote: post #100
tptacek wrote: post #72

Earlier quoted context omitted.

It's one of a large variety of tools that addresses this problem, which begs for a response clarifying where his product fits in and what its strengths and weaknesses are. Now we're no longer talking about SQLI on MYSQL.COM; we're talking about scanners... because a vendor wants us to. But, more to the point, how annoying would it be if every time I responded to a comment on HN, I added "this is one of the many thing…

Ahh...now I get it. I was wondering why this plug peeved you so much. You compete with that guy. Wow...talk about having a vested interest. This is so unfortunate because now I have to double check grievances on HN to see who has a vested interests - which degrades the integrity of the community. For someone with such high karma...this is so disappointing.

What a mean thing to say. How often have I ever plugged our services on HN? I go out of my way not to do that here.

Re: MySQL.com compromised via (guess what?) SQL injection

#117

Post by marcamillion »

tptacek wrote: post #116
marcamillion wrote: post #100

Earlier quoted context omitted.

Ahh...now I get it. I was wondering why this plug peeved you so much. You compete with that guy. Wow...talk about having a vested interest. This is so unfortunate because now I have to double check grievances on HN to see who has a vested interests - which degrades the integrity of the community. For someone with such high karma...this is so disappointing.

What a mean thing to say. How often have I ever plugged our services on HN? I go out of my way not to do that here.

I understand that it might come across as mean...but that doesn't change that it is the truth.

I think it is fair to say that Matasano is well known on HN - based on your valuable contributions to the community.

That is also why it was so disappointing to me - who has watched you add value to the community over the years - to see how you handled a seemingly 'innocuous' plug.

The modus operandi for dealing with those things is downvote and maybe one comment. But you not only likely downvoted but made MANY comments. Constantly attacking the guy.

It was clear that there was something else below the surface. I just didn't know what. I thought that perhaps you guys might have had beef or perhaps the OP might have been a known troll or something, but nothing in his history would indicate that he was trolling. He seemed to be legit.

So it was only when I looked at your profile that I was reminded of your affiliation with his competitor that it jumped out at me.

It was as if Bill Gates was here criticizing someone else for plugging their own OS - because it was 'inappropriate', when it was fully appropriate.

So I apologize if my calling it out offended you, but your conduct offended me and the sensibilities of this community.

I would be doing as much disservice to the community, if I sat on the sidelines and didn't say anything.

Post reply on HN