Slashdot Mirror
MySql.com Hacked With Sql Injection
iceco2 writes "MySql.com and associated sites were hacked today. Among other items some simple passwords were recovered and private emails were revealed. Ironically the attack was performed using a blind sql injection attack."
Some evidence of server issues here already. Another report: A proper link?
Help stamp out iliturcy.
Microsoft web serving products? How dumb can can a bot get? Turing fail.
Help stamp out iliturcy.
Should be: http://techie-buzz.com/tech-news/mysql-com-database-compromised-sql-injection.html
(There is an extra l in the summary's link.)
If you're a zombie and you know it, bite your friend!
I would expect MySQL.com to be hacked with an SQL injection bug. They didn't support parameterized queries until version 5 or so and most mysql examples floating around on the 'net involve building your own query string from unchecked user parameters.
Do you even lift?
These aren't the 'roids you're looking for.
Jesus fuck, people. It's not rocket surgery.
If you use bind variables, you CANNOT be SQL-injected.
If you don't, you can be.
It's that fucking simple. Do The Right Thing.
I herd you like Sql, so we injected Sql in your Sql so you can have Sql while you code MySql
After I finished visit all the funny sites I usually go to daily, that title made laught much much more than all of them.
... our local file station burnt down.
Even inside a big team of a big company it is amazing how so many people are working by themselves. That's the kind of error that a simple code review by an experienced programmer would have avoided (use bind variables/prepared statements).
Could've been worse. Imagine something like this had happened to Zend!
Ironic is when one's words say one thing and one's actions another that contradict it.
No, that's hypocrisy, not irony. Try again.
Burns: We're building a casino!
McAllister: Arrr. Give me 5 minutes.
If a website gets hacked, it is sad. If the website in question is the home of one of the products that is commonly used by websites, it is already ironic. Apparently even the builders of this product don't know how to secure a website using their product.
Too bad it's not "unbreakable" like Oracle's other database...
#DeleteChrome
There are several definitions of irony, you know. One is an outcome of events contrary to that which might have been expected. You would expect a website concerning SQL to be well-protected against SQL-injection; in such a situation, an attack of this kind would not succeed. The attack did succeed, hence the irony.
Ironic is when one's words say one thing and one's actions another that contradict it.
No, that is hypocritical. Situational Irony is where the outcome is has a humorous incongruity or discrepancy from what one would expect, or from what would normally be implied by the situation. The fact that the company which produces and sells MySQL wasn't using SQL correctly is indeed ironic.
You would expect a person correcting the summary's definition of irony to be aware that there are multiple definitions of irony. The grandparent was clearly ignorant of this fact, thus making the comment meta-ironic.
Merely related ideas are not "ironic". Ironic is when one's words say one thing and one's actions another that contradict it. If MySQL.com claimed SQL injections in MySQL were impossible, then this attack's success would be ironic. If MySQL.com attacked some DB with a SQL injection, that would be ironic. Not all coinciding events are "ironic".
So it would be ironic if MySQL.com was hit with an SQL injection if they were using MS SQL for their server DB?
Like this?
SQL injection attacks? What, is it 1998 again all of a sudden?
Are there really still people out there mashing user input together into a string that they then feed to the database?
Why would you even do this - it's not easier, the performance is worse, and it certainly doesn't make for more readable code.
This level of ineptitude is just shocking.
sic transit gloria mundi
Unlike the reserved words of a computer program, words in a natural language have a wide latitude of uses, from the strict to the colloquial. Here, I see the "irony" in how a site designed to promote some type of "SQL" turns out to suffer from an SQL flaw, in effect negating the product's virtues in the eyes of those who like to skim through IT news headlines. It's similar to the way you expect a dentist to have good teeth.
Ironic is when one's words say one thing and one's actions another that contradict it.
I think you're thinking of another word: hypocrisy, e.g., a politician who claims to stand for morality but goes out with a hooker.
So what they have a ton of usr@% grants on an open-to-the-world server? No vpn? jesus ....
Meh, security is a bit of a cross-cutting concern. People who are thinking about how read/write rows of data quickly might not have given it much thought that their product can be abused in this way.
I will give you that injection attack is a rather basic hack they should have thought about.
Ironically, the OP correcting someone else for not using ironic correctly is both hypocritical and ironic.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
Screwing up irony is the only thing that unleashes the linguists with such ferrousity.
Be relentless!
Merely related ideas are not "ironic". Ironic is when one's words say one thing and one's actions another that contradict it.
Like rain on your wedding day?
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
That simple passwords were revealed shows a lack of understanding or incompetence. The reason only "simple" passwords were revealed was from a poorly made SHA1 hashing function. Yes this is pure conjecture, but it is the only scenario that fits the facts.
The hackers acquired the database with the hashed passwords. Then the hackers ran the password hashes against a rainbow table which returned the matches for the simple passwords. Now the reason this is incompetence or ignorance is the simple inclusion of a half dozen or so special characters appended to the back of the password during the hash function would make these passwords unmatchable to all but the largest, slowest (super computer realm) rainbow tables. That's why the 'strong' passwords were not cracked.
To defeat all but the largest rainbow tables everyone uses this method is called SHA1+Salt, not my idea but a damn good one. Using salt in your SHA1 hash function prevents this sort of thing from happening. Imagine how many other accounts on other systems are now compromised!
Now there is a chance that the salt string was compromised also, but that's probably not likely because the salt is not (in my experience) is not stored in the database. Allowing SQL injection on a damn SQL site is bad enough, but could reasonably be a single bad coder, having such poor security protocols is incompetence on a grand scale.
I'm just glad the amateur hour over at MySql.com doesn't have my l/p.
Like Oracle not seeing it coming?
Be relentless!
...unleashes the linguists with such ferrousity.
And of course spellings... try ferocity.
If we're going to get on a grammar nazi binge, then it's worth pointing out that one of the definitions of Irony is actually exactly what the GP described... (merriam webster's exact words are "the use of words to express something other than and especially the opposite of their literal meaning".) He may not have expressed it properly, but I do think that was the meaning he was trying to get at.
Though interestingly enough, yet another definition of Irony is an incongruency between an expected result and an actual result... so in other words, MySQL's website being hacked with an SQL injection attack *is* ironic, because one would expect the makers of MySQL to have some idea of how to secure it properly. (it's not even that hard to lock down, which makes it even more humorous).
Though I must say... correcting somebody's already correct use of the word irony? Absolutely classic....
Why is "irony" so damn hard to define? Or more accurately, to define in such a way that this confusion doesn't keep happening?
hehe... wish I hadn't replied... that is a good one. :) mind if I... um... "borrow" it next chance I get?
Really, the people that think it is cool to tell people that they are using "irony" incorrectly are more frequently wrong than the people they are trying to prove linguistically inferior. You should look into what situational irony is and why it has been used correctly in this situation.
Go die in a hole. What complete, utter and total fucking twat.
Just bought a new quantum computer, but I'm uncertain how it works.
I think your pun detector is a little rusty.
Whoosh.
Hint: He's punning on "ferocity" and...ya know..."ferrous".
Loser Database.
The above is what makes me really enjoy reading /. :)
I think my funny bone broke under the strain..
-SS "Teach the ignorant, care for the dumb, and punish the stupid."
You can never sanitize inputs enough.
Repeat that to yourself 1,000 times. It's impossible(*).
Parameterized queries / bind variables are the only valid solution.
If you keep convincing yourself you don't need to use bind variables, and that you can sanitize your inputs enough you've already failed.
* - Of course it's mathematically possible to sanitize inputs enough; because theory, and reality don't have a damn thing to do with each other. Reality says you will fuck it up and the hackers will find it in less time than it takes you to read the code.
That's rich...
No, that's "redundancy".
It's similar to the way you expect a dentist to have good teeth.
Or a barber to be neatly-trimmed?
Doesn't make much sense on consideration- if there were only two dentists in town, I'd go to the one with the worst teeth, as the one with superior teeth is enjoying the services of his competitor.
We like repartee.
bobby-tables.com: A guide to preventing SQL injection
My other car is a 1984 Nark Avenger.
No. None of that Morrisette babble is ironic.
--
make install -not war
No, irony is what I described it as, and not what the person I corrected used it as.
The people making up stats like you just are far too many on Slashdot (as elsewhere), regardless of whether there are more of them than there are people citing stats correctly.
I have no problem expecting that MySQL.com will be compromised by a vulnerability in MySQL. That is not ironic, situational or otherwise. It is two entirely consistent conditions, not any that defy truly reasonable expectations.
--
make install -not war
A1: Because Alanis Morissette screwed it up forever.
A2: Because there are several types of irony, which are only loosely related to each other.
Cue the "well this never happened when they weren't owned by oracle" in 5..4..3
I think your pun detector is a little rusty.
True that! I think by the time I wrote that, the irony of the matter was completely lost on me!
Wow. This is why I come to /.
You're missing the function to add the dots after the slashes.
"What in the name of Fats Waller is that?"
"A four-foot prune."
Now you guys are steeling each others' jokes.
How many more years will slashdot have an off-by-one error on your Score in your profile?
MySQL.com is just related to the database.
Ironic would be if a beginner-level screw-up like this happened to a language distributor like Zend.
Do you think Expensify will mind if I keep the mySQL experience on my resume?
What is this "database" thing I keep hearing about? :-p
Why can't
Which is ironic. Don't ya think?
Comment removed based on user account deletion
The comment was "it's NOT rocket surgery", and I therefore responded with an equally fictitious "brain science" comment. There is no "brain science". There is the study of the mind - psychology/psychiatry, and the study of nerves - neurology/neuroscience. But as far as I know, there are probably only 10 encephalologers in the world, and no one has managed to meet them because they fall asleep within 30 yards of them.
Seven puppies were harmed during the making of this post.
Maybe create a little negative press for MySQL and in the process Oracle looks better.
boycott slashdot February 10th - 17th check out: altSlashdot.org
posting to kill a mis-clicked comment moderation
The cool thing about situational irony is that expectations are a personal matter, so if GGP finds it ironic, he is using the term correctly whatever your expectations were. In other words, you may not find it ironic, but it is still not a misuse of the term in the sense that you are trying to imply. It is like you are trying to argue that he is misusing the term "delicious" when he applies it to ice cream because you don't personally enjoy ice cream.
Unfortunately for you, there is no SI unit for either irony or deliciousness, so you'll have to find some other arcane grammar rule to correct in other people's posts to feel good about yourself. I'd suggest who/whom, split infinitives, or dangling participles (a few of my favorites). Just the other day I made a comment regarding a poster using "loose" when they meant "lose", and I even got to make a reference to his mom during the course of the correction, so there are plenty of opportunities if you just apply yourself.
Stop the ferrous wheel; I want to get off.
That's why I said "expect". However, I'd still expect a dentist to have good teeth, even in a two- or one- dentist town. I expect a dentist to know all the tricks of having good teeth, like flossing, brushing after every meal, etc. If he sees a nasty cavity that could lead to bad teeth, I expect him to go and visit (even to the point of going out of town) another dentist who's just as good or a just a wee bit worse than him. Unless he's a self-schooled dentist who doesn't belong to any medical association, you'd expect him to have some contacts. Barbers probably are different since it's not the sort of profession where you have to pass an exam to get licensed, "high-end" hair "stylists" excepted.
Similarly I'd "expect" the MySql site to be free from, at the very least, exploitable security holes in their "star" product, even if that can never be true in practice. Image counts for a lot.