Slashdot Mirror

← Back to Stories (view on slashdot.org)

SQL Injection Turns BusinessWeek Into Viral Replicator

Posted by CmdrTaco on from the glad-it's-not-us dept.

martins writes "The website of popular magazine BusinessWeek has been attacked via SQL injection in an attempt to infect its readership with malware. Hundreds of pages in a section of BusinessWeek's website which offers information about where MBA students might find future employers have been affected."

22 of 116 comments (clear)

  1. Malic or incompetence? by Scutter · · Score: 4, Insightful

    Sophos informed BusinessWeek of the infection last week, although at the time of writing the hackers' scripts are still present and active on their site.

    It's bad enough to have an insecure site, but to ignore the break-in for a week or more is just unconscionable.

    --

    "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
    1. Re:Malic or incompetence? by ednopantz · · Score: 5, Interesting

      They just don't teach anything about security in schools. We interviewed an intern candidate this spring and asked her how one would avoid a SQL injection attack.

      Her response: "Don't use Microsoft products."

      Swing and a miss!

      The candidate's sample code had a big 'ol SQL injection vulnerability. Yet the instructor raved over his project.

  2. Hmm by LizardKing · · Score: 5, Funny

    It really is fscked. Every job advert is for Lehmans.

    1. Re:Hmm by $RANDOMLUSER · · Score: 4, Funny

      Hundreds of pages in a section of BusinessWeek's website which offers information about where MBA students might find future employers have been affected."

      So no great loss to society then.

      --
      No folly is more costly than the folly of intolerant idealism. - Winston Churchill
  3. Pity on the future MBAs by rainer_d · · Score: 3, Funny

    Ah-well, only kidding ;)

    --
    Windows 2000 - from the guys who brought us edlin
  4. That's frightening by Centurix · · Score: 4, Funny

    A replicant virus. Is it a virus or a replicant? Will it need retiring? If the website hosted a picture of a turtle on its back, will it rotate the picture 180 degrees? Will we know if it's a replicant virus or a real virus by the end of the article?

    --
    Task Mangler
  5. ATTENTION WEB DEVELOPERS by Anonymous Coward · · Score: 5, Insightful

    HAI!

    Just a friendly reminder - your Database Admin will be more than happy to set up multiple users for you with different permissions. For instance, a user with "write" privileges that can be used by the website backend page that the editors use, and a user with "read only" permissions that the public facing web server(s) will use when presenting the page to the public.

    That is all.

    1. Re:ATTENTION WEB DEVELOPERS by apathy+maybe · · Score: 4, Informative

      This is a very good point. Except that phpMyAdmin makes it really easy to set up a new database with a single user who has all rights, and the same name as the DB.

      So what I tend to do (and I do admit that I am a lazy SOB), is just create a new DB and user for every app.

      However, your idea is much better, and it would be nice if phpMyAdmin had such a feature... (Not that I'm about to code it in, on account of my being busy with other things, and never having even looked at the phpMyAdmin code beyond what is needed to install it.)

      However, an even better thing to do (then just create a read-only user), is to escape shit before you query the DB... PHP and MySQL have this nifty function mysql_real_escape_string which will do that for you. It is better then using the general escape functions in PHP, for reasons that I read just recently. Basically, it takes into account the character encoding for the DB... http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string

      --
      I wank in the shower.
    2. Re:ATTENTION WEB DEVELOPERS by Anonymous Coward · · Score: 3, Insightful

      Multiple DB users, proper escaping, you know it's not actually an either-or situation. If the only way you know to set up a database is through phpMyAdmin, then you need help reading the manual.

  6. Bobby Tables is at it again... by Anonymous Coward · · Score: 5, Funny

    Bobby Tables is at it again...

  7. Re:MBA students, appropriate. by jellomizer · · Score: 3, Interesting

    You haven't seen the modern MBA have you. Almost half of the MBA students have Computer Science Degrees and have been working professional for at least 5 years. Many of them while good at what they do, wants to further their career so go for an MBA so they be considered qualified for promotion. Not every one wants to be a basic programmer for the rest of their life, they much rather have influence in the process and the design and less time doing the drudge work.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  8. ' UNION UPDATE `users` SET karma='godlike';-- by nathan.fulton · · Score: 3, Interesting

    TFA: "the code injected into BusinessWeek's website points to a Russian website that is currently down and not delivering further malicious code."

    Seriously? Why is it that these people always point to their site? wouldn't you figure that, with a bit of injection, they could put the damn thing in the database? It's never made any sense to me. Anyone have any insights?

    Also, they always waste these opportunities to give replace real headlines with those from the Onion... if they're going to do something malicious, they should at least do it with style...

  9. more economic woes by prgrmr · · Score: 4, Funny

    Hundreds of pages in a section of BusinessWeek's website which offers information about where MBA students might find future employers have been affected

    I suppose McDonald's is going to have to rely on employing just the liberal arts majors for now.

  10. Re:MBA students, appropriate. by SQLGuru · · Score: 4, Interesting

    Many of them while good at what they do

    Not every one wants to be a basic programmer for the rest of their life

    Pretty much all of the *GOOD* programmers *DO* want to program for the rest of their lives (while I wouldn't say "basic programmer"....most want to be Dev Lead / Architect type of coders, but coders none the less). And being Dev Lead / Architect is not the type of position that goes to the MBA grads.....MBAs are for people who want to go into Management / Project Management.

    I've been in the industry since 1994 and am one of the top database developers in my company. And I don't see myself as being a manager any time soon. I enjoy programming too much. [This is in a large corporation where a manager is not a technical manager; small companies where "Dev Lead" equates to manager might be a different situation.]

    Layne

  11. Re:Bobby Tables is at it again (obligatory link) by CaraCalla · · Score: 5, Informative

    http://xkcd.com/327/

  12. Nit pick time. by BitterOldGUy · · Score: 5, Informative

    Many of them while good at what they do, wants to further their career so go for an MBA so they be considered qualified for promotion.

    To nitpick:

    That depends on your company and their policies. Therefore ask HR. I did once to see what they'd do for me. The answer was that I'd get a $3,000 raise for having a graduate degree. I asked for clarification regarding why she put that way; "You mean, I would get the raise regardless of what masters degree I received?"

    "Yes. Of course your manager has to approve it."

    Another thing to clarify, and I've found this out the hard expensive way: getting an MBA does NOT automatically give you a ticket into management. Here's what I was told by several folks: You need management experience for an MBA to mean something. Without the experience, the MBA is worthless. So now, I'm a coder with an MBA - it's not doing me any good. And like a stupid SOB, I paid for it with student loans. I did it when I was out of work thinking that it would get me a management job. Schools are so quick to tell you that their MBA will further your career. BS! Experience matters more than the degree - and networking (i.e. It's who you know.)

    So here's what I would do differently, get into management, see if my company requires an MBA for my position, get them to pay for it, bust my ass in night school, some profit! But if they don't require it, I don't see the point in getting one.

    And there's going to be a HUGE glut of MBAs. With this down economy, MBA enrollments have gone through the roof. Which means, in two years, the already huge glut of MBAs is going to get bigger.

    1. Re:Nit pick time. by nomadic · · Score: 3, Funny

      So now, I'm a coder with an MBA - it's not doing me any good. And like a stupid SOB, I paid for it with student loans.

      Look on the bright side; it was only 2 years of student loans, I had to do 3 years of law school to be in the same situation.

  13. Re:MBA students, appropriate. by retchdog · · Score: 3, Funny

    No, I just have to spend time around them occasionally since my field happens to be very useful in finance and business. You can tell, because when you enter the business-popular classes (time series; baby stochastic analysis; &c.) the first thing that hits you is a wave of cheap cologne covering the stench of desperation.

    --
    "They were pure niggers." – Noam Chomsky
  14. AND I don't mean ... by BitterOldGUy · · Score: 4, Insightful
    to disparage education. It's just that the days of getting more education to advance in your career, at least in corporate America, are gone. All you need are the basics; which usually is a BS in your field. It's who you know. And even then, if thy're snobs who don't associate with "your kind of people" it doesn't matter either. We're rapidly becoming a downwardly mobile society.

    I'm just ... look at my user name...

  15. Re:MBA students, appropriate. by jellomizer · · Score: 4, Insightful

    To be a good Architect you often need a strong business knowledge. Yea Yea You know how to program you so smart (being that I learned to program at 6 years old) it doesn't take a genius to program. But in reality being able to be a good programmer doesn't mean you can design or create solutions that solve real business problems. I have been in the industry for a long time too. Working as a consulting I was actually the top database developer for multiple companies, including many fortune 500 companies. However I found that creating the code is a piece of cake, however the hard part is trying to understand the business process, then filtering out what is needed and not for the code to run successfully without having to run extra work, as well understand what is happening so in a case the software fails (or hardware) you can come up with a quick workaround solution for the employees until you can get a working version. Business knowledge is a key area. If you are working in a business environment getting Masters in computer science wouldn't be as useful as getting an MBA.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  16. Re:MBA students, appropriate. by David+Gerard · · Score: 5, Informative

    Depends. Alan Cox is a top-class programmer who got an MBA because there was this whole other world that intersected with what he did that he didn't understand.

    --
    http://rocknerd.co.uk
  17. Re:MBA students, appropriate. by Free+the+Cowards · · Score: 3, Interesting

    I'd be really curious to know what he thought of it afterwards, and whether having an MBA really helped him understand this other world. I get the distinct impression that an MBA is the business-world equivalent of an MSCE: it gives you some basic knowledge and impresses the clueless but isn't really very useful.

    --
    If you mod me Overrated, you are admitting that you have no penis.