Feeds

SQL string in URL exposes sex offender data

And much more, in Oklahoma coding fiasco

Designing a Defense for Mobile Applications

Better known for its presentation of stunning examples of how not to develop code, The Daily WTF this week exposed a horrendous case of information loss when it published an article on a critical flaw in the Oklahoma Department of Corrections website.

Thanks to developers seeding browser GET requests with the SQL queries required to retrieve the data the visitor wants to see and then failing to perform any input validation on the information being presented in those queries, it was possible (until recently) to extract any sensitive information from the database at will.

While having the ability to do this to any database of personal information maintained by a government body is a problem, the fact that it concerned the state's Sexual and Violent Offender Registry means that there is more likely to be individuals and groups of people with a motivation to obtain or hide records in the database, and not necessarily socially beneficial motivation.

Muddying the picture was the fact that the database extended to every offender that had been sentenced to probation or incarceration within the Oklahoma Correction system, and not just those convicted of sexual or violent offences. A little bit of digging allowed the retrieval of Department of Corrections employee records and medical activity.

When notified of the flaw, the Department of Corrections modified the site so as to close the hole as reported, at least that is what initially appeared to be the case. It was soon discovered that the only change had been to perform a case-sensitive look up of some table data, effectively leaving the hole wide open. It wasn't until it was shown that employee data could be returned that the hole appeared to be closed off for good.

The unfortunate developers executed several critical errors in establishing the site. First, they allowed a database with sensitive content to face the outside Internet. Second, they allowed queries from the website to access any of the information in that database. Third, they placed the SQL queries required to extract information inside GET requests from the browser (most easily recognised as the part of the URL after the question mark(?) if it is there).

Finally, and possibly most critically, they did not perform any filtering of the anonymous GET requests, happily executing the SQL requests and returning the results.

Fortunately for the Oklahoma Department of Corrections, Alex Papadimoulis (the editor at The Daily WTF who uncovered the extent of the problem) did not appear to do any more than verify that SELECT statements could be modified at will.

If the administration of the database was anything like the weakness in the website, then it is considered extremely likely that the database user represented by the website had the ability to INSERT, DELETE, DROP, CREATE and had permissions on databases outside the one that held the sexual offender data.

Billy Hoffman, the SPI-Dynamics / Hewlett Packard security researcher best known for his Jikto XSS-scanner, points out that all it takes is a simple Google search to turn up many examples of sites which are more exposed than they might think (Google crawls without prejudice - if it is there then it is probably going to be found and archived, even if the nature of what has been archived is not currently known).

Readers should expect this story to gain a lot of attention over the coming days as online privacy advocates become aware of the problem and the enormous weakness that existed. While not the most egregious case of information loss from a website, business, or government department, the level of access that completely anonymous users had to sensitive data is a grave concern.

This article originally appeared at Sûnnet Beskerming

© 2008 Sûnnet Beskerming Pty. Ltd

Sûnnet Beskerming is an independent Information Security firm operating from the antipodes. Specialising in the gap between threat emergence and vendor response, Sûnnet Beskerming provides global reach with a local touch.

Securing Web Applications Made Simple and Scalable

More from The Register

next story
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.