7 ms·

I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being s

by vinhboy 14y ago

I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being super secure. I no longer think that...

Jach 14y ago
I don't know why anyone would expect a public facing PR website to have the same level of security as actual military use systems... Obligatory XKCD: http://xkcd.com/932/ http://xkcd.com/932/
- 46Bit 14y ago
  Most hackers aren't involved in government procurement and so assume that it will be done with extra care and attention, rather than the opposite for 10x the cost.
mattmanser 14y ago
You really did not need to click on the links to figure that out. And it's not SQL server that's the problem, it's the scripting language. asp means active server pages (VBScript). Very old. cfm means cold fusion markup (ColdFusion). Also very old. These are just very old websites built back in the day when no-one knew what they were doing. One of them even has 'legacyapps' in the address.
- bdcravens 14y ago
  ASP hasn't been updated in about 10 years, so yes it's old. ColdFusion, however, isn't "very old". It's an actively supported platform with new versions released within the past year (commercially and 2 open source alternatives). It contains current features such as ESAPI support (for security) and web sockets (for the whiz bang buzzwordians). The fact that it was released in 1995 is irrelevant - similarly aged languages include Java, Ruby, JavaScript, and PHP. You're correct that the age of the websites has much to do with the vulnerabilities. I think "no-one knew what they were doing" borders on insulting for anyone who's been building web apps for more than a few years, however. Rather, things like SQL injection weren't common then, and older, unsupported apps are thus easily exposed.
  - mattmanser 14y ago
    I'm not being insulting as I'm including myself in that broad brush. By a few years do you mean 8-10 years ago? As that's when VBScript was being phased out. And that's when cfm was even vaguely popular. cfm's dead today like Delphi's dead today. I actually remember SQLi becoming a hot topic just when I personally was switching from being a VBScript programmer to C#. When all the APIs were introducing parametrized queries and the debate of them vs stored procs was actually still raging. It was very easy to do stupid things then because all the APIs encouraged bad code, there wasn't much good advice on the net, there was no stack overflow and the books actually told you to write bad code. I'd look up a couple of classics but I've literally just sent all my old programming books to recycling. So either you weren't professionally programming back then or are looking back with rose tinted glasses. A lot of apps were vulnerable to SQLi back then. Look at this article from Jeff Atwood back in 2005: http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html http://www.codinghorror.com/blog/2005/04/give-me-parameteriz... Kinda goes without saying these days doesn't it? Would any programmer blog something as basic as this now?

by vinhboy 14y ago

I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being super secure. I no longer think that...

Jach 14y ago

I don't know why anyone would expect a public facing PR website to have the same level of security as actual military use systems... Obligatory XKCD: http://xkcd.com/932/ http://xkcd.com/932/

46Bit 14y ago
Most hackers aren't involved in government procurement and so assume that it will be done with extra care and attention, rather than the opposite for 10x the cost.

mattmanser 14y ago

You really did not need to click on the links to figure that out. And it's not SQL server that's the problem, it's the scripting language. asp means active server pages (VBScript). Very old. cfm means cold fusion markup (ColdFusion). Also very old. These are just very old websites built back in the day when no-one knew what they were doing. One of them even has 'legacyapps' in the address.

bdcravens 14y ago
ASP hasn't been updated in about 10 years, so yes it's old. ColdFusion, however, isn't "very old". It's an actively supported platform with new versions released within the past year (commercially and 2 open source alternatives). It contains current features such as ESAPI support (for security) and web sockets (for the whiz bang buzzwordians). The fact that it was released in 1995 is irrelevant - similarly aged languages include Java, Ruby, JavaScript, and PHP. You're correct that the age of the websites has much to do with the vulnerabilities. I think "no-one knew what they were doing" borders on insulting for anyone who's been building web apps for more than a few years, however. Rather, things like SQL injection weren't common then, and older, unsupported apps are thus easily exposed.
- mattmanser 14y ago
  I'm not being insulting as I'm including myself in that broad brush. By a few years do you mean 8-10 years ago? As that's when VBScript was being phased out. And that's when cfm was even vaguely popular. cfm's dead today like Delphi's dead today. I actually remember SQLi becoming a hot topic just when I personally was switching from being a VBScript programmer to C#. When all the APIs were introducing parametrized queries and the debate of them vs stored procs was actually still raging. It was very easy to do stupid things then because all the APIs encouraged bad code, there wasn't much good advice on the net, there was no stack overflow and the books actually told you to write bad code. I'd look up a couple of classics but I've literally just sent all my old programming books to recycling. So either you weren't professionally programming back then or are looking back with rose tinted glasses. A lot of apps were vulnerable to SQLi back then. Look at this article from Jeff Atwood back in 2005: http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html http://www.codinghorror.com/blog/2005/04/give-me-parameteriz... Kinda goes without saying these days doesn't it? Would any programmer blog something as basic as this now?