this post was submitted on 24 Jan 2024
372 points (98.4% liked)

Cybersecurity - Memes

1443 readers
2 users here now

Only the hottest memes in Cybersecurity

founded 11 months ago
MODERATORS
 
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 169 points 5 months ago (3 children)

How to say you're vulnerable to code injection without saying you're vulnerable to code injection.

[–] [email protected] 26 points 5 months ago* (last edited 5 months ago) (7 children)

Are they vulnerable though, if they already exclude it at the user input?

I yet have to learn SQL and is there a way to allow passwords with '); DROP TABLE... without being vulnerable to an injection?

nevermind i googled it, and there various ways to do so

[–] [email protected] 48 points 5 months ago (1 children)

This still smells though. Why is the raw, plain text password string getting anywhere near database queries in the first place?

[–] [email protected] 16 points 5 months ago

I doubt it is. they probably have a WAF that blocks these strings though and didnt want to bother reconfiguring it

[–] [email protected] 32 points 5 months ago* (last edited 5 months ago) (1 children)

Prepared statements, mostly. You define the query using variables, turn that query into a language-dependent object, assign values to those variables, then execute the statement. The values will be passed verbatim, without any parsing.

Or, since we're talking about a password, you could encode or encrypt it before inserting it into the query string. The fact that the website could be negatively affected by phrases in the cleartext password is very concerning.

[–] [email protected] 5 points 5 months ago

At best, it means they're storing your password instead of just a salted hash. And that's horrible.

[–] [email protected] 21 points 5 months ago

I noticed that upper case select, drop etc are not prohibited.

Poorly implemented user input filters are not a valid solution to being vulnerable to injection.

[–] [email protected] 11 points 5 months ago

Good old Bobby Tables

[–] [email protected] 8 points 5 months ago (2 children)

No one in their right mind is storing plain text passwords, or letting them anywhere near the database.

You convert the password to a hash, and store that. And the hash will look nothing like the password the user typed.

[–] [email protected] 11 points 5 months ago (1 children)

You're right. No one in their right mind would do that.

On the other hand, people not in their right mind often run things. Such as my old professional liability insurance. Which wrote the username and password in the yearly statements...

And also sent you the password through email if you forgot it...

Also you couldn't change it...

[–] [email protected] 6 points 5 months ago (1 children)

There was a popular companion app to a game I play that’s stored passwords as MD5 hashes for years and when they got hacked they were able to decrypt everything.

Bonus point, the app was released multiple years after md5 was cracked.

Developers (including myself) cannot be trusted to implement the correct process 100% of the time. It’s happened too many times for it to be a single person issue and has transcended into a problem with software engineers

[–] [email protected] 2 points 4 months ago

😬😬 that's crazy but good to know

[–] [email protected] 3 points 5 months ago

Lol. Yes, people do still build systems and store plain text passwords. I regularly get scammers sending me my throwaway passwords from crappy sites. Good thing I never reuse passwords, or email addresses.

[–] [email protected] 2 points 5 months ago

Parameterized queries.

load more comments (1 replies)
[–] [email protected] 8 points 5 months ago (1 children)

Maybe they filtered those strings to be safe, and put the notice there to answer the invertible "why won't it accept my password" queries.

It's a shitty password engine. But not necessarily uncleansed

[–] [email protected] 5 points 4 months ago* (last edited 4 months ago) (1 children)

If they're trying to protect themselves from code injection by rejecting certain user input like that, then they don't actually know how to protect themselves from code injection correctly and there may be serious vulnerabilities that they've missed.

(I think it's likely that, as others have said, they're using off-the-shelf software that does properly sanitize user input, and that this is just the unnecessary result of management making ridiculous demands. Even then, it's evidence of an organization that doesn't have the right approach to security.)

[–] [email protected] 2 points 4 months ago

I don't know, maybe they saw that classic XKCD comic and now they're thinking "hahah, I'm wise to your tricks, ya little shit"

[–] [email protected] 5 points 5 months ago

This is the result of some doc writer or middle manager not fully understanding what they've been told.

[–] [email protected] 56 points 5 months ago

Oh BobbyTables, you little rapscallion...

[–] [email protected] 54 points 5 months ago

Little Bobby drop tables

[–] [email protected] 49 points 5 months ago (3 children)

So they’re not hashing or salting the passwords too. Cool…

[–] [email protected] 14 points 5 months ago (2 children)

They might be doing it in the DB query, but they’re definitely not sanitized beforehand.

load more comments (2 replies)
[–] [email protected] 8 points 5 months ago (1 children)

Which makes me want to try and insert a password of a few megabytes worth of text. Should be fine, since there is no max lenght defined, right?

[–] [email protected] 3 points 5 months ago

If there is no overwrought prohibition of something I know that at least in America that means it’s

  1. Affirmatively legal and
  2. Legislatively encouraged by the FREEE Act

So give ’em hell!

load more comments (1 replies)
[–] [email protected] 43 points 5 months ago

Obligatory Little Bobby Tables: https://xkcd.com/327/

And for those who feel like saying they've already seen it: https://xkcd.com/1053/

[–] [email protected] 22 points 4 months ago (1 children)

I don't believe this is real. This isn't real, right?

[–] [email protected] 21 points 4 months ago

This is real - I took the screenshot myself.

[–] [email protected] 20 points 4 months ago

What zero string sanitation does to a mfr

[–] [email protected] 18 points 5 months ago

We could still have some fun with ALTER TABLE

[–] [email protected] 17 points 5 months ago (12 children)

Some of the strongest and easy to remember passwords are just a few words strung together with a few numbers.

For example: Simpsons7-Purple4-Monkey1-Dishwasher8

Just remember "Simpsons Purple Monkey Dishwasher" and "7418". You're probably never going to forget that and I just tossed it into a password strength tester and it said it would take about 46 billion years to randomly guess it.

[–] [email protected] 35 points 5 months ago

It would take me about 5 seconds because you just told me what it is genius

[–] [email protected] 14 points 4 months ago (1 children)

Now remember these types of passwords, all different for different services. It's not a realistic expectation. Password managers are a must nowadays if you want to protect your accounts. But these types of passwords are also easier to type out.

[–] [email protected] 8 points 4 months ago

My tactic is use a memorizeable passphrase as the unlock for the vault and assorted gibberish for anything in the vault

[–] [email protected] 11 points 4 months ago (1 children)

Correct horse battery staple

load more comments (1 replies)
[–] [email protected] 9 points 4 months ago (1 children)
[–] [email protected] 13 points 4 months ago

Yeah, a bunch of asterisks works too.

[–] [email protected] 8 points 5 months ago

Password strength checkers are taking an approach that's naive for this case. The actual strength depends on the size of the dictionary and the number of words you randomly choose out of it.

Bcrypt has a length limit of 72 characters, so very long passwords generated this way can be silently truncated. Developers can avoid this problem by running sha256 on the input before giving it to bcrypt, but that isn't common.

[–] [email protected] 7 points 4 months ago (1 children)

Or you could just use a password manager

[–] [email protected] 7 points 4 months ago

For maximum security your password manager should have a password and you have no choice but to remember that password.

[–] [email protected] 7 points 5 months ago (1 children)

I'll never understand why spaces are commonly not allowed in passwords.

load more comments (1 replies)
[–] [email protected] 4 points 4 months ago

Memorising 1 password like that sure, but according to bitwarden I have 209 passwords, no way I can ever remember them all

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago) (1 children)

If the structure of it is known it becomes much faster. Word+single digit^4 isn't all that hard.

For the vast majority of purposes, it'll be fine. And certainly as long as that particular structure isn't commonplace, it won't be easy to guess anyway. But password strength testers don't consider that - guessing "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" randomly also takes billions of years, so they can give a bit of a sense of false security.

[–] [email protected] 3 points 4 months ago* (last edited 4 months ago)

Eh it's still pretty hard.

If we check the numbers of English words from https://www.merriam-webster.com/help/faq-how-many-english-words and take a conservative estimate of 400 000 at the bottom of the page.

That means with the exact format of (word)(number)- 4 times has (without repeating words) 400000*9*399999*9*399998*9*399997*9 = 167957820891293697014400000 combinations. https://www.wolframalpha.com/input?i=400000939999893999979399996*9

The fastest super computer at the moment apparently sits at 1.1 quintillion Hz. Or 1.1 billion billion.

If that computer could make 1 guess every clock cycle it would still take it over 4 years (167957820891293697014400000 / 1.1quintillion = ~52 months ) to run through all possibilities.

Now that is a very fast computer, and we haven't included the possibility of various numbers of words, different delimiter, or where and how often numbers appear. So unless you've really pissed off the US gov I don't think you have to worry about it.

There's a reason passphrases are the currently recommended way to generate secure passwords that are hard to guess but easy to memorize/type in.

load more comments (3 replies)
[–] [email protected] 14 points 5 months ago

I consider this an invitation.

[–] [email protected] 12 points 5 months ago
[–] [email protected] 11 points 5 months ago

Looking at that I wouldn't be surprised if those rules are just client-side validation.

[–] [email protected] 10 points 5 months ago

Ima just use my butthole with a biometric scanner.

[–] [email protected] 9 points 4 months ago

submits Drop Table as passphrase

Grabs popcorn

[–] [email protected] 5 points 5 months ago

Didn't say anything about truncate!

[–] [email protected] 3 points 5 months ago

Anyone taking bets on them sanitising user passwords?

load more comments
view more: next ›