Slashdot Mirror
MySql.com Hacked With Sql Injection
iceco2 writes "MySql.com and associated sites were hacked today. Among other items some simple passwords were recovered and private emails were revealed. Ironically the attack was performed using a blind sql injection attack."
Some evidence of server issues here already. Another report: A proper link?
Help stamp out iliturcy.
Microsoft web serving products? How dumb can can a bot get? Turing fail.
Help stamp out iliturcy.
Should be: http://techie-buzz.com/tech-news/mysql-com-database-compromised-sql-injection.html
(There is an extra l in the summary's link.)
If you're a zombie and you know it, bite your friend!
Jesus fuck, people. It's not rocket surgery.
If you use bind variables, you CANNOT be SQL-injected.
If you don't, you can be.
It's that fucking simple. Do The Right Thing.
I herd you like Sql, so we injected Sql in your Sql so you can have Sql while you code MySql
After I finished visit all the funny sites I usually go to daily, that title made laught much much more than all of them.
Even inside a big team of a big company it is amazing how so many people are working by themselves. That's the kind of error that a simple code review by an experienced programmer would have avoided (use bind variables/prepared statements).
Ironic is when one's words say one thing and one's actions another that contradict it.
No, that's hypocrisy, not irony. Try again.
Burns: We're building a casino!
McAllister: Arrr. Give me 5 minutes.
If a website gets hacked, it is sad. If the website in question is the home of one of the products that is commonly used by websites, it is already ironic. Apparently even the builders of this product don't know how to secure a website using their product.
There are several definitions of irony, you know. One is an outcome of events contrary to that which might have been expected. You would expect a website concerning SQL to be well-protected against SQL-injection; in such a situation, an attack of this kind would not succeed. The attack did succeed, hence the irony.
Perhaps you need a little refresher on irony.
Few but the most naive would expect the MySQL.com site to be written by nubies and rubes so unsophisticated as to depend on remedial examples of anything found "floating around the 'net". To the contrary, most people would expect MySQL.com to be maintained to somewhat high levels of security in particular at the level of the database. This is the construction of the irony in this case.
"How ironic, now he's blind after a life of enjoying being able to see." -- Homer Simpson.
Ironic is when one's words say one thing and one's actions another that contradict it.
No, that is hypocritical. Situational Irony is where the outcome is has a humorous incongruity or discrepancy from what one would expect, or from what would normally be implied by the situation. The fact that the company which produces and sells MySQL wasn't using SQL correctly is indeed ironic.
You would expect a person correcting the summary's definition of irony to be aware that there are multiple definitions of irony. The grandparent was clearly ignorant of this fact, thus making the comment meta-ironic.
Like this?
Let's think if Oracle has something to gain from intentionally tarnishing the reputation of a product they want to kill.
I'm not saying it's foul play for sure, just pointing out they do have an incentive to do so.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Ironically, the OP correcting someone else for not using ironic correctly is both hypocritical and ironic.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
Screwing up irony is the only thing that unleashes the linguists with such ferrousity.
Be relentless!
Like Oracle not seeing it coming?
Be relentless!
If we're going to get on a grammar nazi binge, then it's worth pointing out that one of the definitions of Irony is actually exactly what the GP described... (merriam webster's exact words are "the use of words to express something other than and especially the opposite of their literal meaning".) He may not have expressed it properly, but I do think that was the meaning he was trying to get at.
Though interestingly enough, yet another definition of Irony is an incongruency between an expected result and an actual result... so in other words, MySQL's website being hacked with an SQL injection attack *is* ironic, because one would expect the makers of MySQL to have some idea of how to secure it properly. (it's not even that hard to lock down, which makes it even more humorous).
Though I must say... correcting somebody's already correct use of the word irony? Absolutely classic....
When interviewing people for QA positions, I routinely ask "Do you know what an SQL injection attack is?"
I have never yet interviewed a candidate who answered yes.
So, then I explain what an SQL injection attack is, and ask how they would test for vulnerability to one.
Almost without exception, the answer is "I guess I would try entering some special characters and keywords into the GUI, and see what happens."
http://xkcd.com/756//
Go die in a hole. What complete, utter and total fucking twat.
Just bought a new quantum computer, but I'm uncertain how it works.
I think your pun detector is a little rusty.
Whoosh.
Hint: He's punning on "ferocity" and...ya know..."ferrous".
The salt isn't a second secret, it's there to prevent the use of a pre-constructed rainbow table for the standard hash functions. Without a rainbow table, you can still do dictionary attacks of weak passwords--and there is no way to prevent this short of not using passwords for authentication. This only harms people who use guessable passwords and re-use passwords between sites.
When interviewing people for QA positions, I routinely ask "Do you know what an SQL injection attack is?"
Hahaha, reminds me of what I used to do to interns. We used to get a bunch of interns every year, and every year we'd have them develop small web applications for internal use. They'd work on their project and after a few weeks we'd come in and evaluate their work, steer them in the right direction (if that wasn't necessary earlier) and do a few tests.
The first thing I always asked was "Do you have a backup?" and after the inevitable googling of the mysqldump command I'd be an utter bastard and sneak in a DROP TABLE, or DELETE FROM statement in the URL bar, right after id=x, and surely enough most of the times it would work.
"It looks really great, but I think there's a problem with it. Maybe you want to check the logfiles to see what happened." to see if they'd see what was the problem, and if they didn't I would explain an SQL injection attack to them. Few of them managed to find the solution on google, but most immediately suggested such things as "I'll check for ; in the string" which inevitably led to me trashing their tables about 10 minutes later. I have to say, once they had their tables dropped twice they became real careful of permissions and handling SQL statements.
In a way I hope they learned something from having a complete bastard as a mentor, although I'm sure that a few of them have already forgotten about that one time a single statement ruined their database. Oh well...
There is one incorrect assumption in your reasoning. You don't have to use one salt for all passwords, you can easily use a different salt per entry, and store it along side the password. This way, even if your database is compromised, and the salts are know, you still have to create a different rainbow table for each entry to be able to try and guess the password. This effectively kills the ability of the breacher to fish around for insecure passwords.
bobby-tables.com: A guide to preventing SQL injection
My other car is a 1984 Nark Avenger.