Feeds

SQL string in URL exposes sex offender data

And much more, in Oklahoma coding fiasco

Remote control for virtualized desktops

Better known for its presentation of stunning examples of how not to develop code, The Daily WTF this week exposed a horrendous case of information loss when it published an article on a critical flaw in the Oklahoma Department of Corrections website.

Thanks to developers seeding browser GET requests with the SQL queries required to retrieve the data the visitor wants to see and then failing to perform any input validation on the information being presented in those queries, it was possible (until recently) to extract any sensitive information from the database at will.

While having the ability to do this to any database of personal information maintained by a government body is a problem, the fact that it concerned the state's Sexual and Violent Offender Registry means that there is more likely to be individuals and groups of people with a motivation to obtain or hide records in the database, and not necessarily socially beneficial motivation.

Muddying the picture was the fact that the database extended to every offender that had been sentenced to probation or incarceration within the Oklahoma Correction system, and not just those convicted of sexual or violent offences. A little bit of digging allowed the retrieval of Department of Corrections employee records and medical activity.

When notified of the flaw, the Department of Corrections modified the site so as to close the hole as reported, at least that is what initially appeared to be the case. It was soon discovered that the only change had been to perform a case-sensitive look up of some table data, effectively leaving the hole wide open. It wasn't until it was shown that employee data could be returned that the hole appeared to be closed off for good.

The unfortunate developers executed several critical errors in establishing the site. First, they allowed a database with sensitive content to face the outside Internet. Second, they allowed queries from the website to access any of the information in that database. Third, they placed the SQL queries required to extract information inside GET requests from the browser (most easily recognised as the part of the URL after the question mark(?) if it is there).

Finally, and possibly most critically, they did not perform any filtering of the anonymous GET requests, happily executing the SQL requests and returning the results.

Fortunately for the Oklahoma Department of Corrections, Alex Papadimoulis (the editor at The Daily WTF who uncovered the extent of the problem) did not appear to do any more than verify that SELECT statements could be modified at will.

If the administration of the database was anything like the weakness in the website, then it is considered extremely likely that the database user represented by the website had the ability to INSERT, DELETE, DROP, CREATE and had permissions on databases outside the one that held the sexual offender data.

Billy Hoffman, the SPI-Dynamics / Hewlett Packard security researcher best known for his Jikto XSS-scanner, points out that all it takes is a simple Google search to turn up many examples of sites which are more exposed than they might think (Google crawls without prejudice - if it is there then it is probably going to be found and archived, even if the nature of what has been archived is not currently known).

Readers should expect this story to gain a lot of attention over the coming days as online privacy advocates become aware of the problem and the enormous weakness that existed. While not the most egregious case of information loss from a website, business, or government department, the level of access that completely anonymous users had to sensitive data is a grave concern.

This article originally appeared at Sûnnet Beskerming

© 2008 Sûnnet Beskerming Pty. Ltd

Sûnnet Beskerming is an independent Information Security firm operating from the antipodes. Specialising in the gap between threat emergence and vendor response, Sûnnet Beskerming provides global reach with a local touch.

Intelligent flash storage arrays

More from The Register

next story
Bladerunner sequel might actually be good. Harrison Ford is in it
Go ahead, you're all clear, kid... Sorry, wrong film
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
Forget Hillary, HP's ex CARLY FIORINA 'wants to be next US Prez'
Former CEO has political ambitions again, according to Washington DC sources
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.