A Big Case of Oops

http://www.communities.hp.com/securitysoftware/blogs/rafal/archive/2010/02/25/a-big-case-of-oops.aspx

by wglb • 16 years ago

395 99 16 years ago

communities.hp.com

vital101• 16 years ago

It's easy to tell someone about security, but actually demonstrating vulnerabilities really drives the problem home. That said, something as simple as NOT trusting any input and sanitizing it would solve 90% of these problems.

by4• 16 years ago

"Screw input validation, love output normalization."

http://news.ycombinator.com/item?id=785549

generalk2• 16 years ago

Output normalization: solves various problems like log injection and XSS

Input validation: solves SQL and other injection issues.

If you're not doing both, you're probably vulnerable somewhere. There is no magic bullet.

dstorrs• 16 years ago

Not always. A few years ago, I demonstrated for a business owner a simple set of breaks to his website that allowed me to download, install, and execute code on his server and then use it to look and and download every file on the system. He understood that his source code (the "crown jewels" as he called it) was therefore vulnerable, but never did anything about it.

wheaties• 16 years ago

Damn, that's a "well done sir" type of article.

ballpark• 16 years ago

Yeah. He should have titled it "I'm the man"

lenni2• 16 years ago

Funny. This is like shooting fish in a barrel.

What are the chances of getting this SQL injection attack vector served on a silver plate right when he needed it?

MrFoof2• 16 years ago

What are the chances of getting this SQL injection attack vector served on a silver plate right when he needed it?

In my experience? Frighteningly real. You could also ask, "What are the chances of finding an application that has quadratic, cubic, or exponential scaling problems served on a silver plate right when he needed it?", and I'd also have the same reply - frighteningly real.

The most fun I've had in my days was not only demonstrating such security holes, but also finding laughably bad scaling issues while I was running amok. The most frightening thing is, I'm not referring to podunk little companies, but wholesalers or manufacturers with 9 and 10-digit annual revenues. And not small internal apps, but their main presence on the web.

Though I'll say, even as a contractor, these gigs are never enjoyable simply because - despite best trying to avoid it - you've managed to embarrass some people on an epic scale. Once you've fixed what you've been paid for, most places don't look to keep you around much longer unless they truly have a "what's right, not who's right" philosophy.

chrischen3• 16 years ago

I decided to try to inject some SQL to a form--I didn't specially seek it out--and to my surprise it worked. It seems to be really common, especially if the site looks shoddy and ends with .php.

cookiecaper• 16 years ago

Well, I just searched for "salt lake web design", tried three or four sites found on random portfolios, and none of them had an obvious SQL injection. I'm sure it's much, much too common, but I seriously doubt its prevalence constitutes even a simple majority of professional web work.

whyleyc2• 16 years ago

So I did a bit of digging and found the website in question:

http://www.mythaichicago.com/default.asp

Looks like they're still experiencing "issues" - http://www.mythaichicago.com/order.asp?locationid=000004 reports:

  "Sorry, On-line ordering is currently undergoing service."

No clear indicator who the web design company behind it is though.

Quarrelsome• 16 years ago

How did you dig that one backwards... ? As far as I could tell you only had an image of the site.....?

lenni2• 16 years ago

Screenshot + TinEye?

whyleyc2• 16 years ago

Yep just from images (and Google) - I examined one of the images from the post at a higher resolution (by clicking on it) and took a look at the map on the right-hand side.

It was a map of Thailand, so that gave me the type of restaurant. From there it was just a simple Google query combining that knowledge with the URL structure revealed in the blog post:

http://www.google.co.uk/search?q=thai+restaurant+locationid%...

Then it was just a case of working through the list of possibilities (it was second on that list) :-)

BigZaphod• 16 years ago

Obviously he just zoomed in and kept saying "enhance image" to his computer until the answer was revealed in a tiny shadow on one of the pixels...

RyanMcGreal• 16 years ago

>No clear indicator who the web design company behind it is though.

At least the content isn't hidden behind a wall of Flash.

jrockway2• 16 years ago

Very interesting. This is one of my favorite lunch spots; the people that actually run the restaurant are a friend of a friend, and they are super-nice. Too bad they got caught up in this.

tptacek15• 16 years ago

The one by DePaul is a block away from our office.

rm-rf2• 16 years ago

How history repeats itself.

Years ago I struggled to convince a group of sysadmins that server hardening, firewalls and patching were essential for any Internet connected system. I heard things like "there's a million computers on the Internet, why would anyone bother mine" [unless they wanted to use your server to hack someone else or store their porn|warez]" and "nobody can port scan the entire Internet, they'll never find my server" [unless they control an army of scanners].

I made significant progress by having my group perform live IIS5 directory traversal & telnet MTIM attacks at a conference of local sysadmins. (yep, this was a long time ago)

Similarly, today we have a significant number of web developers who don't think it can happen to them, until it does.

tptacek15• 16 years ago

Unfortunately, server hardening, firewalls, and patching wouldn't have prevented this problem; it's buried in the actual application code.

rm-rf2• 16 years ago

I fully understand that. It was intended to be an analogy.

Let me try again.

A decade ago, clueless sysadmins put unpatched servers directly on the Internet with no firewall protecting ports that didn't need to be exposed, with no hardening, no patching, etc. An hour later, after their shiny new server got rooted, the clueless sysadmins stood there with the classic deer-headlights look, wondering what just happened.

Today, with OS's that have reasonable default configs on as-shipped, and with firewalls the norm, it's the application developers that are clueless id10t's standing around with the deer-headlights look.

cake• 16 years ago

Any details on this ? : "After getting permission to use a tool we here at the ASC lovingly refer to as the SQL Injector"

What's the tool ?

PonyGumbo• 16 years ago

I'd love to know this too.

Edit: looks like Webinspect: https://h10078.www1.hp.com/cda/hpms/display/main/hpms_conten...

fragmede• 16 years ago

WebInspect looks interesting, but for this usage, does it actually offer anything above Metasploit?

(The marketing copy for it doesn't give much detail, though it does claim you can use this for hipaa compliance, among other things https://h10078.www1.hp.com/cda/hpdc/fetchPDF.do)

imajes2• 16 years ago

Lovely to know they aren't smart enough to check their other urls:

http://www.mythaichicago.com/menu.asp?locationid=000004%20OR...

also, the site was built with dreamweaver. Telltale JS markers. Makes me think it's a web agency/ad agency type.

EDIT:

these are the people responsible:

http://www.orangefuse.com/ - who built www.linusinc.com. I chose another orangefuse site at random and produced an XSS error and a potential path disclosure error (i.e. read other things on the server).

ahi• 16 years ago

You were able to figure out the orangefuse site? It's flash hell. Only half my clicks are even registering.

edit: christ they suck. Check out justlines.com (warning: autoplay sound). Click on portfolio and try to actually use the scrolly thing on the left.

cmelbye• 16 years ago

I can not see how it's possible for people to produce such crap and be okay with it. I couldn't work there without having my perfectionist tendencies causing me to go insane.

tptacek15• 16 years ago

Be careful! People are not always reasonable about security testing, and if they're in the middle of an active investigation about a compromise, you can get slurped up into it by poking at them. That's a time suck and a hassle you do not want.

imajes2• 16 years ago

A good point. My gut tells me these people haven't truly gotten it yet. It doesn't take much to go, "hmm, i wonder if any other part of my application might be vulnerable" and these people certainly haven't done that.

jrockway2• 16 years ago

Tor++.

clickguy13• 16 years ago

Could you delete that link? I clicked on it out of habit, but tptacek's comment has me paranoid that my IP is going to end up in an investigation. I'm guessing other people would prefer to just not have the option to click on it.

Jeema3000• 16 years ago

Eh I think you're ok - if they're tracking visitors that closely, they'd know that you came to that link from here after it was already made public. Plus ycombinator.com gets a ton of traffic so I'm sure you're not the only one. :)

But yea, probably not a bad idea to delete that link anyway...

ErrantX5• 16 years ago

Nothing they would be able to do about it particularly. A large number of people probably clicked that link. Getting warrants (or the police) to track up all of the IP's isnt going to happen :)

Also: im not sure what they could do. Certainly it breaks no laws I know of.

swombat• 16 years ago

I bet the report will say "it was hacked after a large number of people visited it, coming from a site called 'Hacker News'".

dbz• 16 years ago

I'll be next time he gives a talk he will already scope out a website so he'll be prepared to just show them and make them believers.

wglb• 16 years ago

The interesting part of the article is that someone in the audience with a web site gave him a URL that he had not seen before and he did this exercise real-time.

njharman• 16 years ago

I've read many instances where this story continues with the room becoming convinced that the "messenger" hacked the site and calling the police who by default listen to the guys in suits over the technical expert.

jerf3• 16 years ago

The interview I feel worst about was when we had a "web programmer" coming in, and he linked his personal website as an example of what he could do. So, I found an XSS in his login form (first try, first field I tried...), showed it to him, and asked him what just happened. He did eventually get around to it, after two other wrong suggestions, but it took him some time.

Arguably, it was a kick-ass interview question, but I still feel sort of bad about it.

spoondan• 16 years ago

What do you mean you found an XSS "in his login form"?

The things you enter into a login form aren't normally displayed to any other users. If you mean you can run arbitrary JavaScript in your own browser, there are much easier ways to do that and you didn't find a vulnerability.

jerf3• 16 years ago

He displayed the value you entered as the user as part of the error message when your login failed, as in "User jerf does not exist." No escaping. Login form used GET, not POST. (Not that that fixes it, but the querystring is that much easier to exploit.) Classic XSS.

dailo10• 16 years ago

I feel obliged to post the related XKCD comic (Bobby Tables): http://xkcd.com/327/

ryoshu• 16 years ago

I've actually pulled out that comic twice in the last few months -- one time was last week doing a code review of a custom CMS. The progression on the developers' faces was something along the lines of: confusion (why are we looking at a web comic?); amusement (that's pretty funny); horror (our code has SQL injection problems!).

dm_mongodb4• 16 years ago

a nice side-benefit of nosql databases is this massively underestimated problem (usually, depends on the product) going away

tptacek15• 16 years ago

There is a huge "maybe" attached to that statement. It's also possible that several of the popular NoSQL databases could have key patterns that will corrupt memory in their C-code runtimes. There are good reasons to consider NoSQL databases, but security isn't one of them yet.

dm_mongodb4• 16 years ago

trying to understand what you just said: do you mean they may have buffer-overrun vulnerabilities, just as they are new projects? a lot of nosql projects are written in erlang and java btw.

chrischen3• 16 years ago

I'm pretty sure couchdb has a query language which can receive injections. If you pass JavaScript into mongodb theoretically you could open an injection problem if you don't use parametrization. But unless your nosql database has a native API, it still probably is vulnerable to command injection in the same way SQL databases are. Nothing really special about nosql itself that prevents this.

dm_mongodb4• 16 years ago

Preferred and typical use of MongoDB is with no javascript in the queries. There really is a huge reduction of risk for this one particular attack.

dm_mongodb4• 16 years ago

you may be right that i've overgeneralized to the other products based on my experience with mongodb; all i know for sure is mongodb has some nice properties here.

jasonkester2• 16 years ago

That's the same side benefit that every SQL database has built in too, right? Pretty much every relational database has supported parameterized queries for, like, ten years. They're uninjectable and actually less work than constructing strings.

It's amazing that people are still constructing SQL queries as strings in 2010.

ars• 16 years ago

Sometimes you also need to change the query itself, i.e. the tables that are joined, or the sort order.

sh1mmer• 16 years ago

Rasmus built a tool while he was at Y! called Scanmus which doing automated probing. I've seen him demo it to students while we were giving classes at universities. It's amazing how eye opening that experience can be.

P.s. no you can't have a copy of Scanmus P.p.s if you are really curious just Google the name

Disclaimer: I still work for Y! :) and I'm proud of our security guys

P.p.p.s no that wasn't a challenge

tptacek15• 16 years ago

If you have enough money to keep a single developer on staff, you have orders of magnitude more budget than it takes to license a copy of Burp Suite. Burp is the de facto pen testing industry standard, and it's a fantastic QA tool in general. If you have a product and you don't know about Burp, you should buy it pretty much immediately.

ggrot• 16 years ago

This is certainly embarrassing, but it's becoming really common. I wonder if there is anything that can be done to really make a dent in this problem across the web, I don't mean just fixing it on the site that you/I own, but ways of making it drop dead easy for an owner to spot SQL injection or XSS issues, or maybe software layers (proxies, browser standards, etc) that make it harder for a vulnerability to be exploited.

A Big Case of Oops

Related Stories