21 ms·

MySQL.com compromised via (guess what?) SQL injection

303 points by sucuri2 16y ago

riffraff 16y ago
while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ? (I'm aware this may make impossible to use some web frameworks which rely on rdbms reflection, but I have the feeling this is not the case)
- m0nastic 16y ago
  SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is". Aside from implementing bound parameters (which is useful for more than just preventing sql injection), we usually recommend using stored procedures if at all possible. It's really suboptimal to rely on the user to specify what table they're accessing.
- wulczer 16y ago
  Absolutely. The web application should be logging to the database as an unpriviledged user. Seems that by now most people have learned that running web services as root is a bad idea, but they still forget that they should also have an unpriviledged database user for them.
- deleted 16y ago
  [deleted]
- seldo 16y ago
  If you're using a web framework which is constantly querying the database to determine table structure, then you have two problems.
- kprobst 16y ago
  The database in this case has to share some of the blame. For years MySQL did not support parametrized queries or stored procedures (or did not promote them), and many of the people coding against it consistently claimed that they didn't need that kind of "enterprise crap" polluting their favorite DB. This gave way to a MASSIVE code base that is inherently vulnerable to injection attacks. So yeah, it's the fault of the developers but it's also the fault of the people who aggressively marketed and evangelized MySQL and helped create the ditch they're just now digging themselves out of. It's a bit like the VB/Access culture Microsoft promoted back in the day, which generated some of the most hideous corporate apps I've ever seen. Yes, some developers are bad, but the company or group doing the evangelizing/marketing also needs to share some responsibility.
  - FooBarWidget 16y ago
    You don't need parameterized queries or stored procedures for protection against injection. In fact they're not injection protection mechanisms at all. What you actually mean is that the database libraries should provide parameterized-style APIs. There's no need for the database's native wire protocol to explicitly support parameterization to implement this. For example Ruby on Rails's ActiveRecord provides an API that looks a lot like it uses parameterization under the hood: BlogComment.find(:all, :conditions => ['email = ?', 'foo@bar.com']) But if you look at the source code you'll see that it just constructs a normal SQL query by internally substituting the '?' with the escaped version of 'foo@bar.com'. It does not utilize the database parameterization APIs at all. If you think stored procedures protect you against SQL injection, consider the following code snippet: sql_exec("CALL InsertBlogComment('" + get_parameter("text") + "')")
    - awj 16y ago
      You're arguing against the periphery of his point. By waiting so long to provide parameterized queries, MySQL helped foster the attitude that they were "useless enterprise bloat". The lack of parameterized queries was likely an influencing factor in the non-support or non-advertisement of parameterized-style APIs. MySQL is a crucial part of its own community. You cannot hold the community responsible for this situation while giving MySQL a pass.
- xd 16y ago
  Sorry, but how is PHP at fault? You can shoot yourself in the foot with ANY programming language.
  - Natsu 16y ago
    PHP has been known to provide convenient footguns in the past (e.g. register_globals, mercifully depreciated), so it's not surprising that security-minded people give it a hard time. Think of it as the difference between the language keeping loaded footguns under its pillow with the safety off and keeping unloaded footguns in a locked gun safe. One is a lot less likely to get used than the other, even if either one will shoot your foot just as well.
    - xd 16y ago
      Rehashing old design floors is not an excuse to blame PHP for programmer error.
      - prodigal_erik 16y ago
        It doesn't seem fair to call a defect "old" if it wasn't seriously addressed between then and now. I had to pick up PHP (presumably because of heinous sins in a past life) and every tutorial I saw was still pasting user input into non-parameterized queries. There are apparently several different MySQL clients, and our production boxes still had the original (inexplicably still in existence) which didn't even support parameterized queries. And that was in 2007!
        damncabbage 16y ago
        Just hit the same issue here in 2011. Plesk, a popular package for managing shared hosting used by hosting companies, doesn't include the MySQL drivers for PDO (what's meant to be PHP's "standard" database library). Last week I had to rewrite an import script to use mysql_query(), with mysql_real_escape_string() and quotes for every query variable.
  - sausagefeet 16y ago
OstiaAntica 16y ago
Here's some background info on Blind SQL Injection: http://www.owasp.org/index.php/Blind_SQL_Injection http://www.owasp.org/index.php/Blind_SQL_Injection
- rrrhys 16y ago
  Thanks, great read (and interesting eye opener!)
albertzeyer 16y ago
I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-parsing-inside-of-mysql/ http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (for PHP, Python, etc.) would just use those [prepared statements](http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statements.html http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statem...), it would be like what I mean. Edit: Ah, I was wrong (as I hoped): For Python: https://launchpad.net/oursql https://launchpad.net/oursql
- xd 16y ago
  SQL is a human readable language .. what do you mean by "real binary protocol" ?
  - albertzeyer 16y ago
    The language itself doesn't matter at all. Everybody would be fine to use some construct like: Select(args=["name", "id"], from="students") And maybe "name", "id" and "students" also could be replaced my some reference pointers. But in case someone really wants to keep the language, you could still do the parsing inside of the lib and thus for example disallow multiple commands in one statement and then only send some binary representation to the server (mostly like Prepared Statements in MySQL). Whereby I think that this step is obsolete and would in any way produce further problems. Btw., this is not exactly like NoSQL what I am talking about here.
    - xd 16y ago
      How can you say everyone should be fine using a simple construct like that, have you ever had to write a complex query on a non-trivial database?
      - 16y ago
drinian 16y ago
Doesn't really seem responsible to post the vulnerability details to the public list like that, all necessary shaming on weak passwords aside. I wonder if the timing on this has anything to do with Oracle's continued dismantling of the useful parts of the MySQL website.
fmavituna 16y ago
Same guys hit Sun.com via SQL Injection as well - http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulnerable-sql-injection/ http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulne... Shameless self plug: Netsparker ( My startup: http://www.netsparker.com/ http://www.netsparker.com/ ) could have identified both of these vulnerabilities.
- bjg 16y ago
  That product looks awfully similar to Metasploit ( http://www.metasploit.com/ http://www.metasploit.com/ ) , no? How is it different? I watched the demo video and couldn't really tell.
  - fmavituna 16y ago
    Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities. Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.
    - tptacek 16y ago
      You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering. Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?
      - fmavituna 16y ago
        I'm not comparing, I'm telling the difference. Just like Netsparker will not do port scanning, possibly Metasploit will not do full web app stuff. You can talk with someone from Rapid7 and they'll tell you the same thing. And for the record I love Metasploit, it's a fantastic tool. We have a good relationship with Rapid7 guys, they even has a module to import Netsparker results into Metasploit and we keep getting synced with them in new updates. > Or can we just let it suffice to say that HN isn't a great place to promote products on random threads? Personally I love seeing other HNers to send their relative products, projects, startups, commercial ideas, job ads in HN threads, I don't think there is anything wrong with that. You might think otherwise, that's why there is one upvote and one downvote button.
hammock 16y ago
6661, is that his ATM pin as well?
- kprobst 16y ago
  Or the combination on his luggage.
  - notyourwork 16y ago
    Or the code to his garage door.
    - listrophy 16y ago
      Or his iPhone unlock code.
  - kprobst 16y ago
    Wow, someone needs a big hug.
jedsmith 16y ago
Actual information with more details, minus zero-content blog: http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=twitterfeed&utm_medium=twitter http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t... http://pastebin.com/BayvYdcP http://pastebin.com/BayvYdcP
- jschrf 16y ago
  Thanks.
- deleted 16y ago
  [deleted]
- vog 16y ago
  I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication: http://news.ycombinator.com/item?id=2377013 http://news.ycombinator.com/item?id=2377013
  - sathyabhat 16y ago
    Because it was submitted ~10 hours prior to the link you posted.
mattmanser 16y ago
What really pisses me off about this is that you had to register just to be able to download the files. So they unnecessarily had a lot of people's username/passwords for absolutely no good reason.
- AmrMostafa 16y ago
  Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.
  - tyler_ball 16y ago
    It's not in a very obvious place. Downloading the mysql source is one of the most annoying experiences I've had on an OSS site. Iframes, select boxes, login forms! Just give me a list!
- rbanffy 16y ago
  Who downloads MySQL from their site?
  - lwat 16y ago
    Who downloads MySQL?
    - rbanffy 16y ago
      I do, every time I do an "aptitude install" or a "yum install", but not from their site. And the original source was probably downloaded from version control, not the public site. Also, when I do that with Drizzle, I am downloading a lot of MySQL with that. But I agree. Most of the time, I prefer PostgreSQL.
- riffraff 16y ago
  I redownloaded mysql yesterday and while it _seems_ you have to register you doin't actually have too
- 16y ago
d2 16y ago
Oracle's security team bear full responsibility for this breach. MySQL's founder Monty Widenius left Sun in 2005. Sun declined, Oracle bought them as a strategic buy and the portal has been neglected to the point of being compromised. One wonders what internal neglect MySQL is suffering behind the corporate veil.
- glenjamin 16y ago
  You're suggesting that this vulnerability was introduced by Oracle?
- morgo 16y ago
  Do you really think Monty had anything to do with coding the website anyway? The guys that write the actual database have nothing to with the web team. They didn't in MySQL days, they don't now.
Arxiss 16y ago
I can't believe that all these 'BIG names' are getting hacked by group of 2. What is next? Google.com goes down?

303 points by sucuri2 16y ago

while I understand that sql injection is mostly a fault of the host programming language/developer (php in this case) and not of the dbms/dba, couldn't the latter have avoided this in part by limiting user privileges so that it was impossible to "list the internal databases, tables and password dump" e.g. "REVOKE SHOW DATABASES, SHOW VIEW" ? (I'm aware this may make impossible to use some web frameworks which rely on rdbms reflection, but I have the feeling this is not the case)

m0nastic 16y ago
SQL Injection isn't even really an issue with the host programming language. It's an issue with processing input that's submitted "as is". Aside from implementing bound parameters (which is useful for more than just preventing sql injection), we usually recommend using stored procedures if at all possible. It's really suboptimal to rely on the user to specify what table they're accessing.
wulczer 16y ago
Absolutely. The web application should be logging to the database as an unpriviledged user. Seems that by now most people have learned that running web services as root is a bad idea, but they still forget that they should also have an unpriviledged database user for them.
deleted 16y ago
[deleted]
seldo 16y ago
If you're using a web framework which is constantly querying the database to determine table structure, then you have two problems.
kprobst 16y ago
The database in this case has to share some of the blame. For years MySQL did not support parametrized queries or stored procedures (or did not promote them), and many of the people coding against it consistently claimed that they didn't need that kind of "enterprise crap" polluting their favorite DB. This gave way to a MASSIVE code base that is inherently vulnerable to injection attacks. So yeah, it's the fault of the developers but it's also the fault of the people who aggressively marketed and evangelized MySQL and helped create the ditch they're just now digging themselves out of. It's a bit like the VB/Access culture Microsoft promoted back in the day, which generated some of the most hideous corporate apps I've ever seen. Yes, some developers are bad, but the company or group doing the evangelizing/marketing also needs to share some responsibility.
- FooBarWidget 16y ago
  You don't need parameterized queries or stored procedures for protection against injection. In fact they're not injection protection mechanisms at all. What you actually mean is that the database libraries should provide parameterized-style APIs. There's no need for the database's native wire protocol to explicitly support parameterization to implement this. For example Ruby on Rails's ActiveRecord provides an API that looks a lot like it uses parameterization under the hood: BlogComment.find(:all, :conditions => ['email = ?', 'foo@bar.com']) But if you look at the source code you'll see that it just constructs a normal SQL query by internally substituting the '?' with the escaped version of 'foo@bar.com'. It does not utilize the database parameterization APIs at all. If you think stored procedures protect you against SQL injection, consider the following code snippet: sql_exec("CALL InsertBlogComment('" + get_parameter("text") + "')")
  - awj 16y ago
    You're arguing against the periphery of his point. By waiting so long to provide parameterized queries, MySQL helped foster the attitude that they were "useless enterprise bloat". The lack of parameterized queries was likely an influencing factor in the non-support or non-advertisement of parameterized-style APIs. MySQL is a crucial part of its own community. You cannot hold the community responsible for this situation while giving MySQL a pass.
xd 16y ago
Sorry, but how is PHP at fault? You can shoot yourself in the foot with ANY programming language.
- Natsu 16y ago
  PHP has been known to provide convenient footguns in the past (e.g. register_globals, mercifully depreciated), so it's not surprising that security-minded people give it a hard time. Think of it as the difference between the language keeping loaded footguns under its pillow with the safety off and keeping unloaded footguns in a locked gun safe. One is a lot less likely to get used than the other, even if either one will shoot your foot just as well.
  - xd 16y ago
    Rehashing old design floors is not an excuse to blame PHP for programmer error.
    - prodigal_erik 16y ago
      It doesn't seem fair to call a defect "old" if it wasn't seriously addressed between then and now. I had to pick up PHP (presumably because of heinous sins in a past life) and every tutorial I saw was still pasting user input into non-parameterized queries. There are apparently several different MySQL clients, and our production boxes still had the original (inexplicably still in existence) which didn't even support parameterized queries. And that was in 2007!
      - damncabbage 16y ago
        Just hit the same issue here in 2011. Plesk, a popular package for managing shared hosting used by hosting companies, doesn't include the MySQL drivers for PDO (what's meant to be PHP's "standard" database library). Last week I had to rewrite an import script to use mysql_query(), with mysql_real_escape_string() and quotes for every query variable.
- sausagefeet 16y ago

OstiaAntica 16y ago

Here's some background info on Blind SQL Injection: http://www.owasp.org/index.php/Blind_SQL_Injection http://www.owasp.org/index.php/Blind_SQL_Injection

rrrhys 16y ago
Thanks, great read (and interesting eye opener!)

albertzeyer 16y ago

I wonder a bit that there isn't a real binary protocol for SQL. Edit: It seems there are ways to work around server-side SQL parsing: http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-parsing-inside-of-mysql/ http://www.xarg.org/2011/01/is-it-possible-to-avoid-query-pa... I was thinking more about why it is allowed at all to send text-like SQL queries to a server. A binary protocol would both be simpler to handle and would have saved us from a lot of trouble. Edit: If all client-side libs (for PHP, Python, etc.) would just use those [prepared statements](http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statements.html http://dev.mysql.com/doc/refman/5.0/en/c-api-prepared-statem...), it would be like what I mean. Edit: Ah, I was wrong (as I hoped): For Python: https://launchpad.net/oursql https://launchpad.net/oursql

xd 16y ago
SQL is a human readable language .. what do you mean by "real binary protocol" ?
- albertzeyer 16y ago
  The language itself doesn't matter at all. Everybody would be fine to use some construct like: Select(args=["name", "id"], from="students") And maybe "name", "id" and "students" also could be replaced my some reference pointers. But in case someone really wants to keep the language, you could still do the parsing inside of the lib and thus for example disallow multiple commands in one statement and then only send some binary representation to the server (mostly like Prepared Statements in MySQL). Whereby I think that this step is obsolete and would in any way produce further problems. Btw., this is not exactly like NoSQL what I am talking about here.
  - xd 16y ago
    How can you say everyone should be fine using a simple construct like that, have you ever had to write a complex query on a non-trivial database?
    - 16y ago

drinian 16y ago

Doesn't really seem responsible to post the vulnerability details to the public list like that, all necessary shaming on weak passwords aside. I wonder if the timing on this has anything to do with Oracle's continued dismantling of the useful parts of the MySQL website.

fmavituna 16y ago

Same guys hit Sun.com via SQL Injection as well - http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulnerable-sql-injection/ http://tinkode27.baywords.com/sun-com-sun-mycrosystems-vulne... Shameless self plug: Netsparker ( My startup: http://www.netsparker.com/ http://www.netsparker.com/ ) could have identified both of these vulnerabilities.

bjg 16y ago
That product looks awfully similar to Metasploit ( http://www.metasploit.com/ http://www.metasploit.com/ ) , no? How is it different? I watched the demo video and couldn't really tell.
- fmavituna 16y ago
  Metasploit mostly focuses on Infrastructure and exploiting known vulnerabilities. Netsparker is solely focused on web application security (detection & exploitation). For example Netsparker can crawl AJAX/Javascript apps, support form authentication etc. Metasploit on the other hand possibly will never do that kind of stuff.
  - tptacek 16y ago
    You are comparing a $1000 commercial product to open source Ruby code. Metasploit is sponsored by Rapid7, which does in fact have a product that is competitive with your offering. Do we need to get into a detailed discussion of why I think the plug for your scanner is inappropriate for this thread? Or can we just let it suffice to say that HN isn't a great place to promote products on random threads?
    - fmavituna 16y ago
      I'm not comparing, I'm telling the difference. Just like Netsparker will not do port scanning, possibly Metasploit will not do full web app stuff. You can talk with someone from Rapid7 and they'll tell you the same thing. And for the record I love Metasploit, it's a fantastic tool. We have a good relationship with Rapid7 guys, they even has a module to import Netsparker results into Metasploit and we keep getting synced with them in new updates. > Or can we just let it suffice to say that HN isn't a great place to promote products on random threads? Personally I love seeing other HNers to send their relative products, projects, startups, commercial ideas, job ads in HN threads, I don't think there is anything wrong with that. You might think otherwise, that's why there is one upvote and one downvote button.

hammock 16y ago

6661, is that his ATM pin as well?

kprobst 16y ago
Or the combination on his luggage.
- notyourwork 16y ago
  Or the code to his garage door.
  - listrophy 16y ago
    Or his iPhone unlock code.
- kprobst 16y ago
  Wow, someone needs a big hug.

jedsmith 16y ago

Actual information with more details, minus zero-content blog: http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=twitterfeed&utm_medium=twitter http://seclists.org/fulldisclosure/2011/Mar/309?utm_source=t... http://pastebin.com/BayvYdcP http://pastebin.com/BayvYdcP

jschrf 16y ago
Thanks.
deleted 16y ago
[deleted]
vog 16y ago
I really don't understand why people are upvoting this meaningless blog crap, instead of upvoting the HN entry of the original publication: http://news.ycombinator.com/item?id=2377013 http://news.ycombinator.com/item?id=2377013
- sathyabhat 16y ago
  Because it was submitted ~10 hours prior to the link you posted.

mattmanser 16y ago

What really pisses me off about this is that you had to register just to be able to download the files. So they unnecessarily had a lot of people's username/passwords for absolutely no good reason.

AmrMostafa 16y ago
Not entirely true. There is a "No thanks, take me to download" link at the bottom of the form you get after clicking the download link.
- tyler_ball 16y ago
  It's not in a very obvious place. Downloading the mysql source is one of the most annoying experiences I've had on an OSS site. Iframes, select boxes, login forms! Just give me a list!
rbanffy 16y ago
Who downloads MySQL from their site?
- lwat 16y ago
  Who downloads MySQL?
  - rbanffy 16y ago
    I do, every time I do an "aptitude install" or a "yum install", but not from their site. And the original source was probably downloaded from version control, not the public site. Also, when I do that with Drizzle, I am downloading a lot of MySQL with that. But I agree. Most of the time, I prefer PostgreSQL.
riffraff 16y ago
I redownloaded mysql yesterday and while it _seems_ you have to register you doin't actually have too
16y ago

d2 16y ago

Oracle's security team bear full responsibility for this breach. MySQL's founder Monty Widenius left Sun in 2005. Sun declined, Oracle bought them as a strategic buy and the portal has been neglected to the point of being compromised. One wonders what internal neglect MySQL is suffering behind the corporate veil.

glenjamin 16y ago
You're suggesting that this vulnerability was introduced by Oracle?
morgo 16y ago
Do you really think Monty had anything to do with coding the website anyway? The guys that write the actual database have nothing to with the web team. They didn't in MySQL days, they don't now.

Arxiss 16y ago

I can't believe that all these 'BIG names' are getting hacked by group of 2. What is next? Google.com goes down?