4 ms·

SQL injection is super trivial to prevent, right? How are we still falling for this? Is there any compliance audit regime that would catch this (presumably DoE

SQL injection is super trivial to prevent, right? How are we still falling for this? Is there any compliance audit regime that would catch this (presumably DoE has some pretty strict compliance protocols?), or is all compliance stuff just security theater?

rainonmoon 3y ago
You could say that about most of the OWASP Top 10. If the discourse is any way to judge, most web developers are more invested in constantly re-litigating JavaScript framework wars than learning the extremely trivial design patterns that would resolve most of their security issues. Speaking as a penetration tester, the things devs will let go to prod while managing the information of millions of customers is enough to make you lose hope in the concept of digital infrastructure.
Dalewyn 3y ago
>SQL injection is super trivial to prevent, right? How are we still falling for this? Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.
- dontlaugh 3y ago
  In most environments, it’s more effort to interpolate values into queries than to use parameters.
  - silon42 3y ago
    Huh, no? Tt's very easy to do it incorrectly. It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
    - throwaway894345 3y ago
      Don't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).
  - magicalhippo 3y ago
    Not only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.
johntiger1 3y ago
Unfortunately with security exploits, you're looking for the weakest link in a chain of X million people. All you need is one careless dev/analyst and you get compromised
- throwaway894345 3y ago
  That makes sense, but the aerospace industry seems to be able to solve for sloppy devs. Why can’t we secure our national infrastructure similarly? (To be clear, I don’t think we need aerospace-grade correctness for every piece of DoE software, but surely we can solve for low hanging fruit like “SQL injection attacks”)
_8j50 3y ago
That aside, a WAF would have stopped this.
perlgeek 3y ago
Basically all these file transfer solutions are crap, from a quality and security perspective. Procurement works by ticking off features of a list, possibly comparing prices. Quality and security are hard to quantify, and often cannot really assessed by the purchase managers themselves, so they don't play a major role in purchasing decisions. Thus, vendors aren't really incentivized to make robust, reliable and secure software, they are incentivized to sell their software.

rainonmoon 3y ago

You could say that about most of the OWASP Top 10. If the discourse is any way to judge, most web developers are more invested in constantly re-litigating JavaScript framework wars than learning the extremely trivial design patterns that would resolve most of their security issues. Speaking as a penetration tester, the things devs will let go to prod while managing the information of millions of customers is enough to make you lose hope in the concept of digital infrastructure.

Dalewyn 3y ago

>SQL injection is super trivial to prevent, right? How are we still falling for this? Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.

dontlaugh 3y ago
In most environments, it’s more effort to interpolate values into queries than to use parameters.
- silon42 3y ago
  Huh, no? Tt's very easy to do it incorrectly. It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
  - throwaway894345 3y ago
    Don't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).
- magicalhippo 3y ago
  Not only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.

johntiger1 3y ago

Unfortunately with security exploits, you're looking for the weakest link in a chain of X million people. All you need is one careless dev/analyst and you get compromised

throwaway894345 3y ago
That makes sense, but the aerospace industry seems to be able to solve for sloppy devs. Why can’t we secure our national infrastructure similarly? (To be clear, I don’t think we need aerospace-grade correctness for every piece of DoE software, but surely we can solve for low hanging fruit like “SQL injection attacks”)

_8j50 3y ago

That aside, a WAF would have stopped this.

perlgeek 3y ago

Basically all these file transfer solutions are crap, from a quality and security perspective. Procurement works by ticking off features of a list, possibly comparing prices. Quality and security are hard to quantify, and often cannot really assessed by the purchase managers themselves, so they don't play a major role in purchasing decisions. Thus, vendors aren't really incentivized to make robust, reliable and secure software, they are incentivized to sell their software.