4 ms·
Well this is a buffer overflow attack, not injection, but hey, it's in a SQL program! Though SQL injection and other injection attacks are definitely not dead.
by seeknotfind 2y ago
Well this is a buffer overflow attack, not injection, but hey, it's in a SQL program!
Though SQL injection and other injection attacks are definitely not dead. All it takes is one programmer mistake and poof! Lots of XSS rely on accidentally injection of some value. Also hey lots of LLM based attacks are injection. Injection is not dead... oh no oh no
- avery17 2y agoI always thought the internet would get more sophisticated and secure as time went on and my days of SQL injection were limited to my teenage years but it seems as the internet becomes more accessible the number of armature developers putting insecure websites up in rising raidly.
- crooked-v 2y agoWeb dev land has a borderline pathological obsession with NEW NEW NEW, which contributes to much of it.
- jakubmazanec 2y agoThat's not the reason why web development is in its current state (not bad, actually). The reason is simple: it is difficult and therefore costly to make good and secure web app, and their owners are not willing to spend money/energy on this. Actually I would argue the speed of changes in web development is useful, because it lowers this cost. HN folks love to hate on e.g. Next.js and Vercel, but there's a reason they're so popular (though you should still spend much more resources on UX and security than average Next.js dev does).
- barryrandall 2y agoA lot of companies with SQL injection vulnerabilities remediated them by buying security appliances advertised to stop SQL injection attacks. That works for a while until time and turnover result in someone optimizing the appliance out of the stack. Then the cycle repeats.
- jiggawatts 2y agoThose things are digital snake oil. If you turn on the web application firewall (WAF) features your app breaks. If you “tune” it to fix that, you let the attackers back through. You can’t use a dumb appliance to fix developer stupidity.
- barryrandall 2y agoThat doesn’t stop businesses from falling for the sales pitch.
- bigiain 2y agoOr auditors from ticking that box.
- fulafel 2y agoNo, it's a desync by integer overflow, there's no overflowing buffer. Due to the incorrect length field, the db server starts parsing the next db protocol message from the middle of attacker-supplied data which gives the attacker control of db commands. (A case could be made for calling it a buffer underflow maybe?)
- yencabulator 2y agoIt's request smuggling, not a buffer overflow.