SoylentNews is people
SoylentNews
One of the hackers suspected of being behind the TalkTalk breach, which led to the personal details of at least 150,000 people being stolen, used a vulnerability discovered two years before he was even born.
That method of attack was SQL injection (SQLi), where hackers typically enter malicious commands into forms on a website to make it churn out juicy bits of data. It's been used to steal the personal details of World Health Organization employees, grab data from the Wall Street Journal, and hit the sites of US federal agencies.
"It's the most easy way to hack," the pseudonymous hacker w0rm, who was responsible for the Wall Street Journal hack, told Motherboard. The attack took only a "few hours."
But, for all its simplicity, as well as its effectiveness at siphoning the digital innards of corporations and governments alike, SQLi is relatively easy to defend against.
(Score: 3, Interesting) by MichaelDavidCrawford on Saturday November 28 2015, @01:10AM
TCP has had out-of-band signaling since the very beginning - urgent data.
At one time, building a simple circuit that generated a 2600 Hz tone, conventionally packaged in a red or blue box, would yield the in-band signal for dropping an Amercian five-cent piece into a payphone. How much did the phone phreaks actually cost anyone by calling Brazil for three days? Even so, Ma Bell instituted out-of-band signalling, that's why your connection is briefly cut off when you pop in a quarter.
We have SQL injection because, out-of-the-box, SQL databases only provide in-band signaling. Surely there is a wrapper somewhere that takes care of this? You could have two text I/O queues, in gets the SQL the other gets the payload data and it is simply not possible to get through that wrapper without the two being separated.
It's quite telling, now that it even occurs to me, that in twenty-eight years as a software engineer no one has ever asked me what SQL injection was. Not in job interviews, not on the job, not even outside of work.
Yes I Have No Bananas. [gofundme.com]
(Score: 1, Informative) by Anonymous Coward on Saturday November 28 2015, @02:59AM
No, out-of-the-box all modern SQL databases/libraries support parameterized statements, which is the SQL version of out-of-band signalling. You write the statement with placeholders for the user provided values and then provide those values in a separate argument from the query string. You could have a check that you only call SQL library functions with query strings that are compile-time constants to make sure this isn't messed up. Or you could use an ORM and never write SQL directly.