Re: Larkin, Power BASIC cannot be THAT good:

On Thu, 11 Jun 2009 20:48:33 +0100, Martin Brown wrote:

Manipulating data as structured text using string manipulation functions
is the road to hell. I'm convinced this approach has created more security
flaws than buffer overflows ever have.

I'm not so sure.

I haven't conducted a rigorous survey, but that's my impression from
being subscribed to BugTraq for the last 13 years.

Injection attacks in (mostly) PHP scripts are the low-hanging fruit of
vulnerability analysis; the phrase "shooting fish in a barrel" comes to
mind. Some days you might see a dozen posts from one wannabe security
researcher who just went looking for the most obvious bugs in PHP scripts,
and found no shortage of them.

Google says:

Results 1 - 10 of about 154,000 for "sql injection attack"

Okay, so by page 10 it's lowered its estimate to 73,400, but it's still
not exactly obscure.

Sure, you *can* write correct code in Perl; it just makes doing a
half-arsed job so much easier than doing it right.

I am not so purist as to insist on perfection. A write once and throw
away program can be done in whatever language makes the job easiest. The
only tricky thing is making sure that the code really works as intended.

Security doesn't matter if the program will only be run by its author on
data created by its author; there's no mileage in exploiting your own
account.

Unfortunately, code which reads and/or writes structured text formats is
frequently used in exposed environments, either on web servers or for
processing data obtained straight off the 'net.

.

Relevant Pages

  • Re: Larkin, Power BASIC cannot be THAT good:
    ... Some days you might see a dozen posts from one wannabe security ... researcher who just went looking for the most obvious bugs in PHP scripts, ... I had in mind jobs which are essentially turning the rubbish formatted dump of raw data that some manufacturer outputs into a format that is useful to their customer. ... You would not believe the number of expensive instruments that output measurement data in the most user hostile and bulky formats possible. ...
    (sci.electronics.design)
  • How to update a database row from a form?
    ... Though I program in php for some years, I started thinking a lot about the security in my php scripts. ... When I add/insert/delete to a form I usually have a hidden input box with the of the record I want to update. ... This is quite a security risk but these forms are administration forms, assuming that the administrator won't edit hidden values and mess with it's data. ...
    (comp.lang.php)
  • Re: How to update a database row from a form?
    ... the security in my php scripts. ... This is quite a security risk but these forms are administration forms, ... Howzabout using a basic crypt function (with a key embedded in the php ... script) to encrypt the ID of the record for display as a hidden field. ...
    (comp.lang.php)
  • Re: include, relative path
    ... _outside_ the document root for security reasons. ... also on the server online so I didn't bother so much... ... For what regarding security reasons I'm pretty curios, ... Nobody can reach my php scripts on the server... ...
    (alt.php)
  • [UNIX] AFFLIB Multiple Buffer Overflows
    ... Get your security news from a reliable source. ... AFFLIB Multiple Buffer Overflows ... Remote Stack-based Buffer Overflow Through Use of LastModified: ... A portion of a potentially untrustworthy parameter is copied into a buffer ...
    (Securiteam)