Feeds

SQL string in URL exposes sex offender data

And much more, in Oklahoma coding fiasco

Internet Security Threat Report 2014

Better known for its presentation of stunning examples of how not to develop code, The Daily WTF this week exposed a horrendous case of information loss when it published an article on a critical flaw in the Oklahoma Department of Corrections website.

Thanks to developers seeding browser GET requests with the SQL queries required to retrieve the data the visitor wants to see and then failing to perform any input validation on the information being presented in those queries, it was possible (until recently) to extract any sensitive information from the database at will.

While having the ability to do this to any database of personal information maintained by a government body is a problem, the fact that it concerned the state's Sexual and Violent Offender Registry means that there is more likely to be individuals and groups of people with a motivation to obtain or hide records in the database, and not necessarily socially beneficial motivation.

Muddying the picture was the fact that the database extended to every offender that had been sentenced to probation or incarceration within the Oklahoma Correction system, and not just those convicted of sexual or violent offences. A little bit of digging allowed the retrieval of Department of Corrections employee records and medical activity.

When notified of the flaw, the Department of Corrections modified the site so as to close the hole as reported, at least that is what initially appeared to be the case. It was soon discovered that the only change had been to perform a case-sensitive look up of some table data, effectively leaving the hole wide open. It wasn't until it was shown that employee data could be returned that the hole appeared to be closed off for good.

The unfortunate developers executed several critical errors in establishing the site. First, they allowed a database with sensitive content to face the outside Internet. Second, they allowed queries from the website to access any of the information in that database. Third, they placed the SQL queries required to extract information inside GET requests from the browser (most easily recognised as the part of the URL after the question mark(?) if it is there).

Finally, and possibly most critically, they did not perform any filtering of the anonymous GET requests, happily executing the SQL requests and returning the results.

Fortunately for the Oklahoma Department of Corrections, Alex Papadimoulis (the editor at The Daily WTF who uncovered the extent of the problem) did not appear to do any more than verify that SELECT statements could be modified at will.

If the administration of the database was anything like the weakness in the website, then it is considered extremely likely that the database user represented by the website had the ability to INSERT, DELETE, DROP, CREATE and had permissions on databases outside the one that held the sexual offender data.

Billy Hoffman, the SPI-Dynamics / Hewlett Packard security researcher best known for his Jikto XSS-scanner, points out that all it takes is a simple Google search to turn up many examples of sites which are more exposed than they might think (Google crawls without prejudice - if it is there then it is probably going to be found and archived, even if the nature of what has been archived is not currently known).

Readers should expect this story to gain a lot of attention over the coming days as online privacy advocates become aware of the problem and the enormous weakness that existed. While not the most egregious case of information loss from a website, business, or government department, the level of access that completely anonymous users had to sensitive data is a grave concern.

This article originally appeared at Sûnnet Beskerming

© 2008 Sûnnet Beskerming Pty. Ltd

Sûnnet Beskerming is an independent Information Security firm operating from the antipodes. Specialising in the gap between threat emergence and vendor response, Sûnnet Beskerming provides global reach with a local touch.

Providing a secure and efficient Helpdesk

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.