Slashdot Mirror
Ruby On Rails SQL Injection Flaw Has Serious Real-Life Consequences
vikingpower writes "As a previous Slashdot story already reported, Ruby on Rails was recently reported to suffer from a major SQL injection flaw. This has prompted the Dutch government to take the one and only national site for citizens' digital identification offline (link in Dutch, Google translation to English). Here is the English-language placeholder page for the now-offline site. This means that 16 million Dutch citizens cannot authenticate themselves anymore with government instances, and that those same government instances can not communicate anything to those same citizens anymore."
Fixes were released, so it looks like it's on their sysadmin team now.
Should have used ASP.NET
That's all.
That's just silly, since the fix can be easily applied. It really nothing compared to all the wordpress exploits out the that never get patched.
Te serious flaw is not SQL Injection but remote code execution (CVE-2013-0156)
16Mileon Dutch people cant authenticate? Smoke them if you've got them.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
I too get mad when I can't authenticate myself with the government on a daily basis. I'm sure enraged citizens in Amsterdam and The Hague are burning copies of the pickaxe as we speak.
This is a different security vulnerability that was brought to light a few days ago, which was given the full detail in this article. Finder method SQL Injection vulnerability Any Rails version that was build for the last 6 years is affected by this. This is a serious security flaw, it is sternly advised that you update your application immediately if your Rails version is in the bucket. You can refer to this discussion for more details.
You can't even say :dyke anymore, it's women_in_comfortable_shoes()
That's even beginning to sound like... Full Life Consequences!
eh, ruby is a decent enough language. No comment on the users or RoR except to say a certain segment of idiots jumped from PHP to Ruby and are now (hopefully) jumping over to node.js.
And this, children, is why you actually need to know and understand SQL before you go off and start writing database applications, without depending on a "framework" to do it for you.
This signature intentionally left blank.
Why is stuff like this even being made available using some generic framework built by a bunch of students?
How the hell can something be designed so badly that it is possible to have a database injection vulnerability? What kind of broken isolation of layers allows that to happen?
This is what happens when you privatise government.
Rails is a vulnerability. Using it is like using PHP so don't count on security.
Down for upgrades? Down for an evaluation of whether upgrades are needed? Down for code fixes? Down because they need to evaluate what happened after confirming attack happened?
The actual vulnerability was not automatically present; it's easy to use Rails and not have this vulnerability affect you, because while the vulnerability is nominally in the code base, there's no paths to trigger it without specific code -- so either you'd have to use a specific third-party library, or write your own code which does the same things. So it might well be that the site is not actually vulnerable -- and they're just being cautious.
Which I don't think is overreacting.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
Why is a toy programming environment like Ruby on Rails used for such a critical infrastructure?
their sysadmin team now."
I laughed
1- Maybe implementing, validating, testing... the fix does take a bit of time ?
2- This sounds so much like a teenager "But Daddy, I know last time I went out I got back past curfew drunk and smelling of cigarettes... but that was LAST TIME, I'm trustworthy now... what's the hold-up ?"
The Cloud - because you don't care if your apps and data are up in the air.
This means that 16 million Dutch citizens cannot authenticate themselves anymore with government instances ON LINE, and that those same government instances can not DIGITALLY communicate anything to those same citizens anymore.
So instead, you make a phone call?
Privacy is terrorism.
It is a computer system. Like *every* computer system, it has flaws and one of those flaws can be a security flaw. The real issue is how the flaw is being handled. One can deny it, one can secretly fix it or one can take responsiblity, inform its users and fix the issue. The last is the only correct way and it is the way the DigiD issue was handled. So, no 'real-life consequences', just another side effect of the digital age. It will soon be solved and live goes on. Nothing to see, move along.
It doesn't have to be like this. All we need to do is make sure we keep talking.
"vital piece of a country infrastructure."
And they use a framework which allows for SQL injections, it now transpires ? A "dynamic" framework hacked together by hobo-programmers ? Yeah, this was some kind of scheme by politicians to help their web-brogrammer friends into a nicely paying PORKBARREL CONTRACT.
If these politicos had been serious, they would have used the L4 kernel and a tried and tested Ada compiler for that purpose. They would have hired the people who secure Airbuses against crash-by-cyber-attack. But these are Software Engineers, not long-haired hippe Web-Brogrammers.
The suuuper-dynamic web-brogrammer hippies apparently discover in the year 2013 what the consequences of "non-existent random initialization of cryptographic keys and generators" are. I guess they are all social science majors and have never ever thought about the concept of randomness. After all, "society is a system with well-defined rules". The world is deterministic and randomness does not exist. I am sure their socialworker-in-chief hashes "decides" on their random numbers.
It actually is a cryptographic issue, but in their "dynamic web shallowness" there exist only "SQL Injections". These are all muppets without a computer science education. That is the core of the problem. Stay away from them at all cost.
Here's a nickel and a proper programming language, boy: http://lazarus.freepascal.org/
..code in Cobol and S/360 assembly. That Ruby thing is for the hobos to put a thin layer of crap in front of the well-paid pros and their mainframes.
Because the brogrammers who built the propaganda website for a politico now need a proper pork project. Meanwhile the real work is done on Cobol by adults in the national retirement insurance agency.
I do think this incident, very much like the DigiNotar issue raised the question "can computers actually be used for anything truly important ??"
As it stands, the answer is a resounding "NO". We can NOT sign legally binding contracts using computers. We cannot rely on digital authentication to conduct government business. It seems we have to show up at a local government office and use some meatspace method of authenticating our important business. It seems that personally knowing people is actually a requirement for proper security.
The whole notion of "we are modern and use computers for everything" has been royally fucked through all bodily openings.
Wait until MOSSAD assassinates someone with stolen/counterfeittted Dutch ID cards/passports (based on data lifted from that super-insecure "dynamic" site), before you say "no but".