4 ms·
SQL injection is probably the primary attack. You might also have unsecured endpoints that give too much information (eg. /query_user_info?email=me@yahoo.com).
by TACIXAT 10y ago
SQL injection is probably the primary attack. You might also have unsecured endpoints that give too much information (eg. /query_user_info?email=me@yahoo.com). If you have endpoints that can be leveraged to achieve remote code execution, you then have someone on the system who can pivot to a database. An employee's machine could be compromised. An employee could leak them.
There are probably one hundred paths to database dumps. This is why principles like defense in depth, least privs, whitelisting, are all important to apply system wide. If your team doesn't know how to do it, hire a company to do security audits or study like crazy.
- cheiVia0 10y agoWhy is SQLi still a problem in 2016? Aren't we all using ORMs and SQL interfaces that only support prepared statements?
- ramimac 10y agoWe really aren't; even discounting people who home-roll it, many companies just don't use existing security features of languages well. An example I've seen in action is Rails' html_safe, which I've seen multiple developers use to make user supplied content "safe," when really it is meant to demarcate data that you have ensured is safe to include
- deleted 10y ago[deleted]
- cheiVia0 10y agoAny thoughts on how can Ruby's html_safe be fixed to avoid that misuse of it?
- ramimac 10y agoI'm in no way an expert, so I don't know how qualified I am to comment. I'd say the issue isn't html_safe's functionality, but rather a common misunderstanding and misuse. In my experience this is steeped in the name "html_safe" itself, which leads developers to make incorrect assumptions. Really the problem is bad or uninformed developers, and you can only do so much to mitigate that.
- mikeash 10y agoI'd like to see the type system used to improve this stuff, by using more specialized types for different kinds of data. I don't think it's ultimately sensible that items as diverse as filesystem paths, SQL statements, HTML code, and raw user input are all represented as "strings." Imagine if instead you had a Path type, an SQLStatement type, an HTML type, and a UserInput type, and combining two items of mismatched types without the appropriate conversion/encoding was a hard error.
- mattnewton 10y agoHere there isn't a type system, but his example of bad developers are going out of their way to defeat defaults by casting the HTML as "safe", so I don't know what hope there is for an automated solution.
- smacktoward 10y agoNot to mention the staggering number of tiny applications that were cobbled together in the Dark Ages and never updated.
- imh 10y agoIf I have a simple side project, and can't afford to hire someone else to secure it, but still want to follow best practices, where can I learn them? Books? Courses? Anything anyone here recommends?
- mplewis 10y agoOWASP is a great place to learn about web security. Check out their 2013 PDF, linked on this page [0]: it gives a fantastic overview, including best practices, technical details, and ways to fix issues. [0]: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...
- roninb 10y agoI'm not an expert by any means but will a 2013 PDF still be relevant in 2016? Are the best practices from 3 years ago still sufficient? I feel like half of the "best ciphers to use in 2013" are deprecated due to insecurity, but that might be ignorance on my part. Edit: I see now that this informs readers about several classes of vulnerabilities and doesn't speak to specific frameworks or libraries being used to avoid or block them. This is probably good info, even 3 years from now.
- mplewis 10y agoYep! It's still very up to date. Tons of vulnerabilities and attacks still apply in 2016 – CSRF, XSS, SQL injection, etc. The bright side is that modern web frameworks are smart enough to handle 90% of them automatically if you follow the rules.
- geoffreyhale 10y agoSecure? Don't do it yourself. Use a library or a framework with security packages built-in.
- imh 10y agoI don't mean to implement security libraries myself. The problem is I don't even know what kinds of things to find libraries for.