Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MySQL.com compromised via (guess what?) SQL injection

blog.sucuri.net

Post reply on HN
Print view View original

91–100 of 117 posts

Re: MySQL.com compromised via (guess what?) SQL injection

#91

Post by randallsquared »

tptacek wrote: post #75
fmavituna wrote: post #73

Earlier quoted context omitted.

I'm not comparing, I'm telling the difference. Just like Netsparker will not do port scanning, possibly Metasploit will not do full web app stuff. You can talk with someone from Rapid7 and they'll tell you the same thing. And for the record I love Metasploit, it's a fantastic tool. We have a good relationship with Rapid7 guys, they even has a module to import Netsparker results into Metasploit and we keep getting syn…

Metasploit isn't web application penetration tool. W3af, the other open source security tool Rapid7 sponsors, is. Meanwhile, Rapid7's commercial offering, Nexpose, also crawls Ajax applications and, if this flaw is as simple as people seem to think it is, would likely have found it... as would OWASP WebScarab or Burp (a tool that costs a fraction of what your tool does and belongs in the back pocket of every web deve…

I found your comparison of Netsparker to Metasploit disingenuous

I have no position on whether he should mention his product in a news thread about SQLI, but he was responding directly to bjg, who said:

That product looks awfully similar to Metasploit ( http://www.metasploit.com/ ) , no?

How is it different?

So, his "comparison" was just responding to someone saying "Hos is it different?", literally.

Re: MySQL.com compromised via (guess what?) SQL injection

#92

Post by nbpoole »

jschrf wrote: post #90
tptacek wrote: post #70

Earlier quoted context omitted.

If parameterized queries guaranteed a total separation between user input and query structure, you'd be right. But they don't. They guarantee a separation between some user inputs and query structure.

Can you elaborate on this? Given a properly parameterized query, where none of the parameters are ever evaluated, how do any user inputs remain unseperated from query structure?

From elsewhere (with context): http://news.ycombinator.com/item?id=2375985

Re: MySQL.com compromised via (guess what?) SQL injection

#93

Post by marcamillion »

tptacek wrote: post #72
metachris wrote: post #71

Earlier quoted context omitted.

Why? It's a pretty relevant plug -- I think that's ok!

It's one of a large variety of tools that addresses this problem, which begs for a response clarifying where his product fits in and what its strengths and weaknesses are. Now we're no longer talking about SQLI on MYSQL.COM; we're talking about scanners... because a vendor wants us to. But, more to the point, how annoying would it be if every time I responded to a comment on HN, I added "this is one of the many thing…

I disagree with you sir. I think the plug was fully appropriate given that others reading this story might want to scan their own sites/app and not want to look around for something.

If you don't like it, downvote it...but given that it has been upvoted some 15 times as of this writing, I think the community agrees that it provides some value.

Re: MySQL.com compromised via (guess what?) SQL injection

#94

Post by marcamillion »

tptacek wrote: post #45
fmavituna wrote: post #22

Earlier quoted context omitted.

Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities. Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.

You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering. Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?

I don't know when HN became a place where hackers felt afraid of plugging their products - given that we are all hackers trying to build/sell products - where appropriate.

I don't get the big fuss.

If it was a story about Bingo Cards, and patio11 plugged bcc.com I am pretty sure you wouldn't be all worked up about this.

Let's just calm it down a notch and not try to be kingmaker's here.

If the community found the plug abhorrent, they would downvote it. He would get the point.

Although, to be quite honest, now you have given his product even more promotion and visibility so it's a net positive for him - not sure it's the result you wanted in the first place.

And given that I would likely do something similar, kudos to him for every extra dollar he has earned from your rant.

Re: MySQL.com compromised via (guess what?) SQL injection

#95

Post by prodigal_erik »

xd wrote: post #29
Natsu wrote: post #28

Earlier quoted context omitted.

PHP has been known to provide convenient footguns in the past (e.g. register_globals, mercifully depreciated), so it's not surprising that security-minded people give it a hard time. Think of it as the difference between the language keeping loaded footguns under its pillow with the safety off and keeping unloaded footguns in a locked gun safe. One is a lot less likely to get used than the other, even if either one w…

Rehashing old design floors is not an excuse to blame PHP for programmer error.

It doesn't seem fair to call a defect "old" if it wasn't seriously addressed between then and now. I had to pick up PHP (presumably because of heinous sins in a past life) and every tutorial I saw was still pasting user input into non-parameterized queries. There are apparently several different MySQL clients, and our production boxes still had the original (inexplicably still in existence) which didn't even support parameterized queries. And that was in 2007!

Re: MySQL.com compromised via (guess what?) SQL injection

#97

Post by damncabbage »

prodigal_erik wrote: post #95
xd wrote: post #29

Earlier quoted context omitted.

Rehashing old design floors is not an excuse to blame PHP for programmer error.

It doesn't seem fair to call a defect "old" if it wasn't seriously addressed between then and now. I had to pick up PHP (presumably because of heinous sins in a past life) and every tutorial I saw was still pasting user input into non-parameterized queries. There are apparently several different MySQL clients, and our production boxes still had the original (inexplicably still in existence) which didn't even support…

Just hit the same issue here in 2011. Plesk, a popular package for managing shared hosting used by hosting companies, doesn't include the MySQL drivers for PDO (what's meant to be PHP's "standard" database library).

Last week I had to rewrite an import script to use mysql_query(), with mysql_real_escape_string() and quotes for every query variable.

Re: MySQL.com compromised via (guess what?) SQL injection

#98

Post by jschrf »

nbpoole wrote: post #92
jschrf wrote: post #90

Earlier quoted context omitted.

Can you elaborate on this? Given a properly parameterized query, where none of the parameters are ever evaluated, how do any user inputs remain unseperated from query structure?

From elsewhere (with context): http://news.ycombinator.com/item?id=2375985

IMHO choosing between ASC and DESC isn't exposing an input into the query in the same way that accepting arbitrary text (escaped or not) into the query is, but thanks for clarifying.

Re: MySQL.com compromised via (guess what?) SQL injection

#99

Post by tyler_ball »

AmrMostafa wrote: post #43
mattmanser wrote: post #33

What really pisses me off about this is that you had to register just to be able to download the files. So they unnecessarily had a lot of people's username/passwords for absolutely no good reason.

Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.

It's not in a very obvious place. Downloading the mysql source is one of the most annoying experiences I've had on an OSS site. Iframes, select boxes, login forms! Just give me a list!

Re: MySQL.com compromised via (guess what?) SQL injection

#100

Post by marcamillion »

tptacek wrote: post #72
metachris wrote: post #71

Earlier quoted context omitted.

Why? It's a pretty relevant plug -- I think that's ok!

It's one of a large variety of tools that addresses this problem, which begs for a response clarifying where his product fits in and what its strengths and weaknesses are. Now we're no longer talking about SQLI on MYSQL.COM; we're talking about scanners... because a vendor wants us to. But, more to the point, how annoying would it be if every time I responded to a comment on HN, I added "this is one of the many thing…

Ahh...now I get it. I was wondering why this plug peeved you so much. You compete with that guy.

Wow...talk about having a vested interest.

This is so unfortunate because now I have to double check grievances on HN to see who has a vested interests - which degrades the integrity of the community.

For someone with such high karma...this is so disappointing.

Post reply on HN