Tag Info

Hot answers tagged

112

First and foremost here, the priority is to close the security holes. If you're working directly with the engineer who wrote this, document everything and give it to that engineer. If not, tell your employer the security issues are bigger than initially thought and that the site needs a lot of work. Ask to work with the main developer who's on the site, ...


77

There's a difference between ignorance and incompetence. There was a time when you didn't know what SQL injection was either, and there's no reason to believe the original programmer isn't capable of fixing the problems once he is made aware of them. So tell them. Be specific and objective, and make yourself available to answer questions, provide examples ...


23

Stored procs don't automatically protect against injection. What about this CREATE PROC proc @id VARCHAR(5) AS BEGIN EXEC("SELECT * FROM Client WHERE ClientId = " + @id); END Using parameterised queries will protect you against injection, whether they are in procs or not.


20

Your job isn't to redo the site for him. It's to fix the small bug. However, if you've noticed security issues that should be fixed you can bring it up with the site owner and offer insight on what the problem might be. Don't berate or talk negatively about the original developer or comment on how horrible the code is. Be respectful and professional. You ...


17

SQL actually has encapsulation built into the language, specifically in the part you're talking about, for preventing injection. The basic idea is, if you're escaping your SQL queries as you build them, you're doing it wrong. Wrong way: SQL = 'select * from MY_TABLE where NAME = ' + Escape(nameParam); RunQuery(SQL); Query encapsulation in SQL is called ...


17

First and foremost - fix the thing they hired you for. If you don't do that, then you'll be perceived as the type of consultant who's interested in making more work for themself, rather than getting the job done. Along with the fixes, you need to give them a list of the stuff you've noticed that's wrong from a security perspective, and why these things are ...


17

I'd tell him. If he gets mad about you informing him rather than abusing your new found knowledge, do you really want to work for him? You owe it to the users of the site as well...


14

It's important that you take Security Vulnerability Disclosure seriously. Improper disclosure may in some jurisdictions be a crime, and is certainly Not Cool. Good disclosure involves privately notifying the vendor and giving them a grace period in which they must provide a fix and a full disclosure (if customers have been impacted). After that grace period, ...


13

It won't do anyone any good to not report the issues. If you had a specific task you were hired for complete it but document other security issues as you see them and report them to the appropriate individual, probably the individual that you are reporting to for the task you were hired for. This is a situation where strong soft skills are going to come in ...


12

Well....it depends. If your client is a bank - no, they can't go live. They should fire the team, and start again. If your client is a site dedicated to showing funny pictures of kittens, doesn't deal with money or personally identifiable information - then sure, go live. The fact they asked you to do an audit in the first place suggests there is at least ...


11

So is a set of (enforced) rules such as this an appropriate alternative to stored procedures in preventing SQL injection attacks? If not, why not? No, because they inflict rather a heavy penalty on the developers. A per-item breakdown: 1. No client/application had direct access to the database tables. Use roles. Clients should only be able to ...


8

You have a few options, but before you delve in to them I'd take a very good look at the Open Web Application Security Project. OWASP has some brilliant documents and guidelines. Personally, I'd begin by conducting a full and proper code review. Rather than checking for traditional issues, take a strong look at Secure Coding practice. (Once again, OWASP has ...


7

In addition to the other answers what you might want to do is point the developer at some resources on how easily SQL injection issues can be exploited, for example sqlmap which is an automated SQL Injection exploitation tool. What I've found to be effective in demonstrating the seriousness of this kind of issue in the past is showing what can be done ...


7

No question I'd tell him. I might frame it as you were just poking around doing some research on what's already there, gearing up to jump into the project as quick as possible (maybe mention some things that you think were done well, if nothing else, to stroke his ego). Then drop the bomb, but immediately follow it be explaining that you are aware of these ...


6

I'm not sure your rules do protect you completely. The first problem is that you state they're enforced but, as well as coming with a significant overhead, I've never seen perfect enforcement. Secondly my reading of them is that rules like these might make things harder to exploit but they don't prevent it. For instance, not having direct access to the ...


5

Are SQL Injection vulnerabilities in a PHP application acceptable if mod_security is enabled? No, at least not if you ask me. If SQL injections are acceptable for the client, there is nothing you need to worry about. You could ask yourself why they did ask you to review the scripts anyway, but I won't bother, take the money and say goodbye. There is ...


4

Nothing scares more than a live demo of an exploit. Since you're able to clone the database and I presume the website, why not clone the site on your local machine and demonstrate how a sql inject can be detrimental. Conduct a live demo for your peers in the office where you hack your site and show them just how dangerous and easy to pull off this form of ...


3

Is my position here too harsh? Even if they fix the SQL Injection and XSS problems can I ever endorse the release of an unmaintainable tangle of spaghetti code? No, your position is not too harsh. You need to adopt a very simple approach: Fix the vulnerabilities, organize the code, and then it will get endorsed. Anything less than this will ensure that ...


3

Your initial reaction is that of a developer purist. You see rubbish and you think it should be fixed. Trouble with this approach is that commercially it is very unlikely to be acceptable to the client, and it is probably not commercially realistic. You need to give the client an answer which addresses all the relevant points, as well as giving a plan for ...


3

I feel that, as a software engineer, you have an ethical responsibility to report security problems to the appropriate people as soon as you know of the problem. The only decision that you have to make is when to report the potential problem, and that depends on how severe the potential problem is and the impact that a breach would have. When reporting any ...


2

Ask one of your friends to report it to him. That way, the users are protected, and the trust issues and other problems don't affect your potential employment.


2

Sometimes companies can be really touchy about security holes. Whatever you do, don't make the information public. RCMP most likely won't do much as they generally don't find security vulnerabilities high on their list of priorities (more in the CSIS domain AFAIK). Really, IMO you have two courses of action: Keep your mouth shut. If your main objective is ...


2

To look at it from a different angle, if the developers think that massive repetition is a "conceptual problem, not a practical one," then you have more serious concerns than security issues that--at this point at least--truly are theoretical. A codebase that's full of needless repetition is going to be unmaintainable: when they try to change something, ...


1

I would like to clarify whether you're just using the DBAL part of Doctrine, or all of it. From my understanding, DBAL is a "lower-level" part of Doctrine, that just focuses on communicating with the database. If you are using Doctrine with Symfony (the most commonly used way I have seen it used), and have created the appropriate entity / repository / query ...


1

This article from Adobe discusses most of the issues you'll need to deal with. The best protection against SQL injection is to use a parametric query - that is, a query that is complete and can be compiled by the SQL engine but that you attach data to after the fact. I haven't used Coldfusion in many years, but it appears that it doesn't support parametric ...


1

This is nuts. You don't go all covert-whistleblower at the first sign of a bug. You will find thousands of bugs in your career. This is no different. You do what you're supposed to do: Raise a severity 1 ticket in your bug tracker: this could be the equivalent of an e-mail to the lead dev. Provide written repro steps Provide a written unit or integration ...


1

Let's face it, it's a vulnerability. You're done your practicum already. As mentioned earlier, this is not in the juristiction of the RCMP. As only a vulnerability and it is doubtful that there is any direct risk of financials, it rules out only more places to go. The only real authority would be the board of education or school district acting as the ...


1

You could always send a description of the vulnerability in an anonymous email. This allows them to fix it without any possible ramifications on you.



Only top voted, non community-wiki answers of a minimum length are eligible