lol programming fail. mysql hacked via sql injection

[Zargon]

http://thenextweb.com/industry/2011/03/27/irony-mysql-and-sun-websites-hacked-using-sql-injection/


hopeing for more details soon, of course there is no info on mysql.com/oracale/sun.com


once they tell me they've fixed the problem I can change my password...

 

[Markbnj]

I get why these kinds of stories are funny, and get so much attention, but really... I don't get it 🙂. So it's Mysql.com. They hire programmers like everyone else, and those programmers make mistakes. The real story is that _any_ major website is still vulnerable to injection attacks.

 

[JasonCoder]

I don't get why people laugh at others' misfortune but I can appreciate a snicker here. I mean it's mysql.com. And really if you're going to be a shining beacon of authority on a topic you really should be taking as many measures as you can to make sure you're not exposed to attacks like this.

Just my 2cents.

 

[Zargon]

I get why these kinds of stories are funny, and get so much attention, but really... I don't get it 🙂. So it's Mysql.com. They hire programmers like everyone else, and those programmers make mistakes. The real story is that _any_ major website is still vulnerable to injection attacks.

when your software own software is used against you to compromise your security in a common way, its a LOL because, well, there are tons of articles on there about the dangers of not sanitzing db inputs ETC.

jasoncoder: exactly, it sucks, I have an account there have to wonder who has that email address in their db of targets now. but I snicker because of what I posted above in response to markbnj.

just as funny if say, cisco got compromised because they forgot to change the default password or something else of that ilk.

its not haha funny, (well maybe a little) but its cringe funny

 

[Train]

I get why these kinds of stories are funny, and get so much attention, but really... I don't get it 🙂. So it's Mysql.com. They hire programmers like everyone else, and those programmers make mistakes. The real story is that _any_ major website is still vulnerable to injection attacks.

I dunno, I think the fact that it was MySQL's main site makes it more significant. When you make a DB that is the main part of a software stack that is heavily used around the world, you sorta have to set the example of the proper way to implement it.

I know I know, the db ITSELF is not responsible for the attack, it's the transition from the app to the db context that is the weakness. But any respectable vendor has some sort of use guidelines. If you go to MSDN and look at the SQL Server "best practices" they show examples of how to use their database with various front ends and avoid sql injection.

 

[Markbnj]

I know I know, the db ITSELF is not responsible for the attack, it's the transition from the app to the db context that is the weakness.

I guess that's the main reason I reacted the way I did. It's not like there was a flaw in the database. The mistake was likely made by one of their web developers.

 

[Morg.]

2011 / SQL Injection / lol

This once again proves that most programmers should not be allowed to code at all.

 

[Nothinman]

when your software own software is used against you to compromise your security in a common way, its a LOL because, well, there are tons of articles on there about the dangers of not sanitzing db inputs ETC.

The web interface accepting and executing the queries isn't the same as the backend DB software so I don't see the correlation.

just as funny if say, cisco got compromised because they forgot to change the default password or something else of that ilk.

No, this is more like Cisco getting compromised by a JSP exploit.

 

[Zargon]

I dunno, I think the fact that it was MySQL's main site makes it more significant. When you make a DB that is the main part of a software stack that is heavily used around the world, you sorta have to set the example of the proper way to implement it.

I know I know, the db ITSELF is not responsible for the attack, it's the transition from the app to the db context that is the weakness. But any respectable vendor has some sort of use guidelines. If you go to MSDN and look at the SQL Server "best practices" they show examples of how to use their database with various front ends and avoid sql injection.

this.

I know its their interaction with the DB and not the DB itself, but they should be a beacon of best practices in using and interacting with it