Feeds

SQL string in URL exposes sex offender data

And much more, in Oklahoma coding fiasco

Secure remote control for conventional and virtual desktops

Better known for its presentation of stunning examples of how not to develop code, The Daily WTF this week exposed a horrendous case of information loss when it published an article on a critical flaw in the Oklahoma Department of Corrections website.

Thanks to developers seeding browser GET requests with the SQL queries required to retrieve the data the visitor wants to see and then failing to perform any input validation on the information being presented in those queries, it was possible (until recently) to extract any sensitive information from the database at will.

While having the ability to do this to any database of personal information maintained by a government body is a problem, the fact that it concerned the state's Sexual and Violent Offender Registry means that there is more likely to be individuals and groups of people with a motivation to obtain or hide records in the database, and not necessarily socially beneficial motivation.

Muddying the picture was the fact that the database extended to every offender that had been sentenced to probation or incarceration within the Oklahoma Correction system, and not just those convicted of sexual or violent offences. A little bit of digging allowed the retrieval of Department of Corrections employee records and medical activity.

When notified of the flaw, the Department of Corrections modified the site so as to close the hole as reported, at least that is what initially appeared to be the case. It was soon discovered that the only change had been to perform a case-sensitive look up of some table data, effectively leaving the hole wide open. It wasn't until it was shown that employee data could be returned that the hole appeared to be closed off for good.

The unfortunate developers executed several critical errors in establishing the site. First, they allowed a database with sensitive content to face the outside Internet. Second, they allowed queries from the website to access any of the information in that database. Third, they placed the SQL queries required to extract information inside GET requests from the browser (most easily recognised as the part of the URL after the question mark(?) if it is there).

Finally, and possibly most critically, they did not perform any filtering of the anonymous GET requests, happily executing the SQL requests and returning the results.

Fortunately for the Oklahoma Department of Corrections, Alex Papadimoulis (the editor at The Daily WTF who uncovered the extent of the problem) did not appear to do any more than verify that SELECT statements could be modified at will.

If the administration of the database was anything like the weakness in the website, then it is considered extremely likely that the database user represented by the website had the ability to INSERT, DELETE, DROP, CREATE and had permissions on databases outside the one that held the sexual offender data.

Billy Hoffman, the SPI-Dynamics / Hewlett Packard security researcher best known for his Jikto XSS-scanner, points out that all it takes is a simple Google search to turn up many examples of sites which are more exposed than they might think (Google crawls without prejudice - if it is there then it is probably going to be found and archived, even if the nature of what has been archived is not currently known).

Readers should expect this story to gain a lot of attention over the coming days as online privacy advocates become aware of the problem and the enormous weakness that existed. While not the most egregious case of information loss from a website, business, or government department, the level of access that completely anonymous users had to sensitive data is a grave concern.

This article originally appeared at Sûnnet Beskerming

© 2008 Sûnnet Beskerming Pty. Ltd

Sûnnet Beskerming is an independent Information Security firm operating from the antipodes. Specialising in the gap between threat emergence and vendor response, Sûnnet Beskerming provides global reach with a local touch.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Bono: Apple will sort out monetising music where the labels failed
Remastered so hard it would be difficult or impossible to master it again
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.