Feeds

SQL string in URL exposes sex offender data

And much more, in Oklahoma coding fiasco

The Power of One Infographic

Better known for its presentation of stunning examples of how not to develop code, The Daily WTF this week exposed a horrendous case of information loss when it published an article on a critical flaw in the Oklahoma Department of Corrections website.

Thanks to developers seeding browser GET requests with the SQL queries required to retrieve the data the visitor wants to see and then failing to perform any input validation on the information being presented in those queries, it was possible (until recently) to extract any sensitive information from the database at will.

While having the ability to do this to any database of personal information maintained by a government body is a problem, the fact that it concerned the state's Sexual and Violent Offender Registry means that there is more likely to be individuals and groups of people with a motivation to obtain or hide records in the database, and not necessarily socially beneficial motivation.

Muddying the picture was the fact that the database extended to every offender that had been sentenced to probation or incarceration within the Oklahoma Correction system, and not just those convicted of sexual or violent offences. A little bit of digging allowed the retrieval of Department of Corrections employee records and medical activity.

When notified of the flaw, the Department of Corrections modified the site so as to close the hole as reported, at least that is what initially appeared to be the case. It was soon discovered that the only change had been to perform a case-sensitive look up of some table data, effectively leaving the hole wide open. It wasn't until it was shown that employee data could be returned that the hole appeared to be closed off for good.

The unfortunate developers executed several critical errors in establishing the site. First, they allowed a database with sensitive content to face the outside Internet. Second, they allowed queries from the website to access any of the information in that database. Third, they placed the SQL queries required to extract information inside GET requests from the browser (most easily recognised as the part of the URL after the question mark(?) if it is there).

Finally, and possibly most critically, they did not perform any filtering of the anonymous GET requests, happily executing the SQL requests and returning the results.

Fortunately for the Oklahoma Department of Corrections, Alex Papadimoulis (the editor at The Daily WTF who uncovered the extent of the problem) did not appear to do any more than verify that SELECT statements could be modified at will.

If the administration of the database was anything like the weakness in the website, then it is considered extremely likely that the database user represented by the website had the ability to INSERT, DELETE, DROP, CREATE and had permissions on databases outside the one that held the sexual offender data.

Billy Hoffman, the SPI-Dynamics / Hewlett Packard security researcher best known for his Jikto XSS-scanner, points out that all it takes is a simple Google search to turn up many examples of sites which are more exposed than they might think (Google crawls without prejudice - if it is there then it is probably going to be found and archived, even if the nature of what has been archived is not currently known).

Readers should expect this story to gain a lot of attention over the coming days as online privacy advocates become aware of the problem and the enormous weakness that existed. While not the most egregious case of information loss from a website, business, or government department, the level of access that completely anonymous users had to sensitive data is a grave concern.

This article originally appeared at Sûnnet Beskerming

© 2008 Sûnnet Beskerming Pty. Ltd

Sûnnet Beskerming is an independent Information Security firm operating from the antipodes. Specialising in the gap between threat emergence and vendor response, Sûnnet Beskerming provides global reach with a local touch.

Boost IT visibility and business value

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.