MySQL.com compromised via (guess what?) SQL injection

http://blog.sucuri.net/2011/03/mysql-com-compromised.html

by sucuri2 • 15 years ago

303 110 15 years ago

blog.sucuri.net

riffraff2• 15 years ago

while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ?

(I'm aware this may make impossible to use some web frameworks which rely on rdbms reflection, but I have the feeling this is not the case)

m0nastic• 15 years ago

SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is".

Aside from implementing bound parameters (which is useful for more than just preventing sql injection), we usually recommend using stored procedures if at all possible.

It's really suboptimal to rely on the user to specify what table they're accessing.

wulczer2• 15 years ago

Absolutely. The web application should be logging to the database as an unpriviledged user. Seems that by now most people have learned that running web services as root is a bad idea, but they still forget that they should also have an unpriviledged database user for them.

seldo• 15 years ago

If you're using a web framework which is constantly querying the database to determine table structure, then you have two problems.

kprobst3• 15 years ago

The database in this case has to share some of the blame. For years MySQL did not support parametrized queries or stored procedures (or did not promote them), and many of the people coding against it consistently claimed that they didn't need that kind of "enterprise crap" polluting their favorite DB. This gave way to a MASSIVE code base that is inherently vulnerable to injection attacks.

So yeah, it's the fault of the developers but it's also the fault of the people who aggressively marketed and evangelized MySQL and helped create the ditch they're just now digging themselves out of. It's a bit like the VB/Access culture Microsoft promoted back in the day, which generated some of the most hideous corporate apps I've ever seen. Yes, some developers are bad, but the company or group doing the evangelizing/marketing also needs to share some responsibility.

FooBarWidget2• 15 years ago

You don't need parameterized queries or stored procedures for protection against injection. In fact they're not injection protection mechanisms at all. What you actually mean is that the database libraries should provide parameterized-style APIs. There's no need for the database's native wire protocol to explicitly support parameterization to implement this. For example Ruby on Rails's ActiveRecord provides an API that looks a lot like it uses parameterization under the hood:

  BlogComment.find(:all, :conditions => ['email = ?', 'foo@bar.com'])

But if you look at the source code you'll see that it just constructs a normal SQL query by internally substituting the '?' with the escaped version of 'foo@bar.com'. It does not utilize the database parameterization APIs at all.

If you think stored procedures protect you against SQL injection, consider the following code snippet:

  sql_exec("CALL InsertBlogComment('" + get_parameter("text") + "')")

xd7• 15 years ago

Sorry, but how is PHP at fault? You can shoot yourself in the foot with ANY programming language.

Natsu• 15 years ago

PHP has been known to provide convenient footguns in the past (e.g. register_globals, mercifully depreciated), so it's not surprising that security-minded people give it a hard time.

Think of it as the difference between the language keeping loaded footguns under its pillow with the safety off and keeping unloaded footguns in a locked gun safe. One is a lot less likely to get used than the other, even if either one will shoot your foot just as well.

sausagefeet• 15 years ago

In a language like Ocaml or Haskell a SQL library can make it impossible to query the DB with unsanitized queries.

OstiaAntica• 15 years ago

Here's some background info on Blind SQL Injection:

http://www.owasp.org/index.php/Blind_SQL_Injection

rrrhys• 15 years ago

Thanks, great read (and interesting eye opener!)

albertzeyer8• 15 years ago

I wonder a bit that there isn't a real binary protocol for SQL.

Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa...

I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble.

Edit: If all client-side libs (for PHP, Python, etc.) would just use those [prepared statements](http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statem...), it would be like what I mean.

Edit: Ah, I was wrong (as I hoped): For Python: https://launchpad.net/oursql

xd7• 15 years ago

SQL is a human readable language .. what do you mean by "real binary protocol" ?

albertzeyer8• 15 years ago

The language itself doesn't matter at all. Everybody would be fine to use some construct like:

    Select(args=["name", "id"], from="students")

And maybe "name", "id" and "students" also could be replaced my some reference pointers.

But in case someone really wants to keep the language, you could still do the parsing inside of the lib and thus for example disallow multiple commands in one statement and then only send some binary representation to the server (mostly like Prepared Statements in MySQL). Whereby I think that this step is obsolete and would in any way produce further problems.

Btw., this is not exactly like NoSQL what I am talking about here.

xd7• 15 years ago

Reply to your edit.

SQL is text. Also no one is sending a query to the server. It's a value that is embedded into the SQL query that circumvents it.

tptacek19• 15 years ago

I don't understand this (or, to be honest, the parent). MySQL has a binary protocol. The MySQL binary protocol does, in fact, allow you to parse a query template and use it in subsequent calls with bound variables; that's how "parameterized queries" work.

wulczer2• 15 years ago

At least in PostgreSQL you can use binary parameters: http://www.postgresql.org/docs/9.0/static/libpq-exec.html

Of course that does not help if you construct the entire query string as text before sending it to the server, which is how SQL injection most commonly happens.

xd7• 15 years ago

Reply to your further edit (let't hope this is the last one ;)

Prepared statements should afford you a clean conscience because the values never make up part of the SQL query .. unless you are using a library that emulates it, and there are libraries out there that do, so don't assume anything.

tptacek19• 15 years ago

Prepared statements do not afford you a "clean conscience". You still need to be careful with your inputs in parameterized queries, because not every input to every query can be bound as a variable. Some operations do require dynamic query construction.

jonursenbach• 15 years ago

You might be interested in Handler Socket.

https://github.com/ahiguti/HandlerSocket-Plugin-for-MySQL

kalleboo2• 15 years ago

Binary protocols aren't magically immune to injection-style attacks, just look at the decades of buffer overflow vulnerabilities.

drinian• 15 years ago

Doesn't really seem responsible to post the vulnerability details to the public list like that, all necessary shaming on weak passwords aside.

I wonder if the timing on this has anything to do with Oracle's continued dismantling of the useful parts of the MySQL website.

fmavituna3• 15 years ago

Same guys hit Sun.com via SQL Injection as well - http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulne...

Shameless self plug: Netsparker ( My startup: http://www.netsparker.com/ ) could have identified both of these vulnerabilities.

bjg• 15 years ago

That product looks awfully similar to Metasploit ( http://www.metasploit.com/ ) , no?

How is it different? I watched the demo video and couldn't really tell.

fmavituna3• 15 years ago

Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities.

Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.

_b8r04• 15 years ago

As someone who uses Metasploit, Canvas, Burp Suite Pro and am currently evaluating Netsparker I might be able to offer an unbiased view.

Metasploit is an exploitation framework. There's different versions available (community, pro etc.). The community version has a web app scanner and is reasonably ok, but it tends to be caught by intrusion detection systems fairly easily and it's payloads often don't clean up properly. It's better suited to infrastructure exploitation, but can be used in a web app context.

Canvas[1] has some limited web app scanning capability but has more of a core focus on infrastructure exploitation.

Burp Suite Pro[2] is a framework for testing web applications. It's probably the best tool out there for testing web apps (if you know what you're doing). It's also ludicrously cheap and there is a free version for non-commercial use. It comes with a fairly comprehensive web app scanner.

NetSparker is a web application scanner. From what I can tell it's mainly competing with things like Accunetix. It has some features that are similar to Metasploit Pro but focuses primarily on the application layer. It sits more between Burp Suite Pro and Canvas for my purposes. You can download an eval from http://www.mavitunasecurity.com/ or the community edition.

[1] http://www.immunityinc.com

[2] http://www.portswigger.net

tptacek19• 15 years ago

You're right: that's an annoying plug. Please don't do that.

metachris• 15 years ago

Why? It's a pretty relevant plug -- I think that's ok!

hammock• 15 years ago

6661, is that his ATM pin as well?

kprobst3• 15 years ago

Or the combination on his luggage.

notyourwork• 15 years ago

Or the code to his garage door.

kprobst3• 15 years ago

Wow, someone needs a big hug.

jedsmith• 15 years ago

Actual information with more details, minus zero-content blog:

http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t...

http://pastebin.com/BayvYdcP

jschrf4• 15 years ago

Thanks.

vog• 15 years ago

I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication:

http://news.ycombinator.com/item?id=2377013

sathyabhat• 15 years ago

Because it was submitted ~10 hours prior to the link you posted.

mattmanser• 15 years ago

What really pisses me off about this is that you had to register just to be able to download the files.

So they unnecessarily had a lot of people's username/passwords for absolutely no good reason.

AmrMostafa• 15 years ago

Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.

tyler_ball• 15 years ago

It's not in a very obvious place. Downloading the mysql source is one of the most annoying experiences I've had on an OSS site. Iframes, select boxes, login forms! Just give me a list!

rbanffy2• 15 years ago

Who downloads MySQL from their site?

lwat• 15 years ago

Who downloads MySQL?

riffraff2• 15 years ago

I redownloaded mysql yesterday and while it _seems_ you have to register you doin't actually have too

Groxx• 15 years ago

http://www.bugmenot.com

I hate sites that require logins. Though apparently this one had a way around it, lots don't, and many of them are already in bugmenot. If not, add a mailinator-based account for others :)

viraptor• 15 years ago

Wait, you actually use a real email / password there? I'd like to introduce you to http://bugmenot.com/view/mysql.com and http://sogetthis.com/

d2• 15 years ago

Oracle's security team bear full responsibility for this breach. MySQL's founder Monty Widenius left Sun in 2005. Sun declined, Oracle bought them as a strategic buy and the portal has been neglected to the point of being compromised.

One wonders what internal neglect MySQL is suffering behind the corporate veil.

glenjamin• 15 years ago

You're suggesting that this vulnerability was introduced by Oracle?

morgo• 15 years ago

Do you really think Monty had anything to do with coding the website anyway?

The guys that write the actual database have nothing to with the web team. They didn't in MySQL days, they don't now.

Arxiss• 15 years ago

I can't believe that all these 'BIG names' are getting hacked by group of 2. What is next? Google.com goes down?

MySQL.com compromised via (guess what?) SQL injection

Related Stories