>> VIEWER-SUBMITTED CC << Explain to me how there's a sequel,
when there was never--
what was the first one?
Uhh...
[laughter]
[robot voice] The Modern Rogue is not vulnerable to SQL injections.
Most Modern Rogue episodes, I feel like I at least
have a toehold on what's going on.
This, I am totally out of my depth.
I need to rely on a programmer, like you, Jason,
or UT's very own, Jgor.
Thank you so much, hacker extraordinaire.
So SQL is used everywhere
Right?
That is the most common database management application
Anytime you have to enter information
Or retrieve information using a website
It's interacting with SQL.
So, every timetime you're typing something in an open box,
odds are this is SQL structure
in the back end and you're saying there's a flaw
in SQl, full stop.
SQL injections are the most common type of
hack they are used everywhere;
you can see them hacking the United States
government stealing credit cards from
online vendors in fact any hack or data breach
that you can think of in the last 10 years,
most of them are going to be
from sequel injections.
Explain to us just the general concept of how it works
Sure. So a sequel or structured query
language is just a way of querying a
back-end database and pulling out just
the information that you want so it's
kind of like a programming language
you're defining a string of commands and
it knows what to do with those commands
in order to retrieve what you wanted.
Problem is some of this is commands and
some of this is data.
So like the data
would be when i type in "My name is Brian Brushwood"
and the commands are you know
i don't know like load this website or
whatever right?
Yeah so "Brian Brushwood"
is the data but that's put right in the
same string as all of these command
sequences wait so the system doesn't
know whether it's listening to a command
or the data so if my name was "Brian
go to line 20... uhh repeat this command do X Y Z the other thing
and then when it reads it
it does it.
essentially that's exactly it, yeah.
We're telling the- the backend system
to execute exactly what we want
after our data.
now this vulnerability is
really widespread but it's also
exceptionally easy to protect against.
Okay now this is the part I don't understand
if it's so easy to protect against it
why isn't everybody insulated?
Well, uh, you
do have to learn a little bit about how
the mitigation strategies you're
supposed to use and some people just
aren't willing to put in that extra step of effort
to learn how to do it the right way
Most people don't invest in
their IT security until it's too late.
Got it. So they're just like "The thing works,
I'm not worried about it,
I don't see any problems; just keep on running it like it is."
it's never a problem,
until it's a problem.
Okay, legally we have to
be very, very clear that the very act of attempting
a SQL injection is,
to the best of our knowledge
but the very act of attempting any of
this is a felony, correct?
Yes. again,
not lawyers, but don't do it.
Yes, okay, BUT
what might one look like?
So say we have a login page:
you got your username and your password
uhh
if they're not protecting
against that separation from the commandand and the data
our username, the data,
we put a tick ( ' ) and suddenly everything after
that becomes commands so we just say
alright stop checking here.
Let's not check the password.
Wait a minute are you
telling me there's fully functional
websites out there where all you have to
do is add a tick mark ( ' ) and then at that
point you're executing code on their
on their website?
how ba-
what percentage of websites are vulnerable to this?
A lot
We could Google something right now
and I can almost guarantee you that something
in one of those results would be vulnerable.
Well...
[Jason laughs]
That's very tempting however I
know that would be a felony to test and
so we're not gonna do that what's it
like to actually do a sequel injection
so for example if we go to say demoed
test-fire net this is a security tool
that set up specifically so you can test
either your security tools or your
security knowledge and understand how
the attacks were all Toro mutual it's a
fake credit union or bank of some sort
we've got all the typical functionality
of a bank so wait this is a website
that's not an actual bank that I assume
has actual accounts that nobody ever
uses to check bank accounts that don't
exist but this is all here just for you
to try to penetrate exactly okay all
right go on so we have this sign in
functionality here at the top and I
happen to know one of the test accounts
Jay Smith has done
at aalto our mutual and his password is
demo one two three four okay so we could
login we see that we have our checking
account here got our savings account I'm
going to sign out we're going to try
signing it again this time let's say all
we know is he's a user name we know
jaysmith has an account on this Bank
it's going to get mad at us if we don't
fill in the password field so I'm just
gonna type a bunch of random characters
here but it doesn't matter because up
here and the username we're gonna put
kick and when you say tick that's the
sixth is single got a single quote yeah
and at this point we have ended the user
input the the data j smith and now we're
going to start tacking on our own sequel
commands now we could get as complicated
as we want here but simplest one is just
to put a sequel comment character which
is dash dash and then usually a space at
the end what that does is it comments
out everything else in this command
sequence after the username one of the
things that comes after the user name is
this password check okay so if I
understand this correctly it's running
code and it gets as far as like inter
username is sees the username then by
putting the dash dash it assumes
whatever is next is a comment
unfortunately the next text is also make
sure to check for a password you got and
so that becomes a comment and it does
not run that part exactly and and so
does it work here give it a shot that's
deeply disturbing yeah now imagine that
you can take these sequel commands and
just do whatever you wanted to this
site's database I would assume in order
to do anything of value you would have
to understand the current layout the
structure the things that this is most
likely to do so that you punch in
commands that will actually be
meaningful right now if we were doing
that by hand yes we would have to first
of all traverse through all the database
names table names call names and figure
out exactly what we would want to pull
out from the database but this has been
around so long and it's been so polished
and perfected that there are tools that
will do all of this work for us all we
have to do is know that this page is
vulnerable we point a tool at it and it
will pull out every single piece of data
from that database Wow including credit
card numbers no hold on how does it do
it does it
just keep on running like random code to
see what what it gets back or it first
of all identifies the vulnerable
behavior it knows what to look for for
example you put a tick in there and
suddenly the page contents change maybe
we put a tick or one equals one and now
the page has gone back to its legitimate
content because one equals one is always
true so once it confirms that vulnerable
behavior it knows certain strings to
inject in there to say okay now give me
all of the list of databases names all
the list of table names all the list of
column name here's a nice pretty list of
wow and one of the things that they do
is they will intentionally throw up
errors in that they'll enter some
information and sequel will come back
and say this bit of data is incorrect
well now you've told me what that bit of
data is right so if this is such a
widespread known vulnerability what is
being done about it like are there their
best practices that are being propagated
or is there some kind of new back-end
that's in the works or is this just like
whoopsie doodle everybody should be
better about locking their doors so we
do know how to address this you best
practice state that you should use
prepared statements or parameterised
queries that specifically identify okay
this is our command structure command
structure this pieces data so never
treat it as part of the command it's
just developers have not taken the time
yet to follow these best practices they
just naively put a everything in one
string and say okay go ahead and
evaluate this one so it's not like this
is gonna fix itself in the next 20
minutes if you're making a website you
need to make sure that you are actively
going out and finding out what best
practices are to make sure you're not
subject to one of these and likewise
anytime you are using a service you need
to ask them what are you doing to
protect against a sequel injection yes
this is very much training on the side
of the developer they need to understand
the risks and then know the the proper
way to do it what's funny is that when
this was discovered it was like the mid
to late 90s and it was first written
about in a zine called frac and when it
was brought to Microsoft's attention
Microsoft is the developer of sequel
Microsoft denied it for
teen years and the problem itself hasn't
changed and it's still around and it's
still very widespread so be careful
about what information you put out there
uh ya know also get out of my house
filthy hackers all of you I don't trust
any of you I'm not comfortable with any
of this go okay I don't like it