Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery

RE: Warning our Fellow Monks

by Adam (Vicar)
on Oct 11, 2000 at 00:46 UTC ( [id://36124]=note: print w/replies, xml ) Need Help??

in reply to Warning our Fellow Monks

Ovid raises an important point, so for fun I am going to play devil's advocate:

How would any hacker/cracker/punk know to try that parameter with my script? Am I not protected by obscurity?

Replies are listed 'Best First'.
RE (tilly) 2: Warning our Fellow Monks
by tilly (Archbishop) on Oct 11, 2000 at 01:08 UTC
    You are not protected. That parameter is a standard thing to try, along with various variations of it. You may need to vary the number of ..'s, you may need to fool an RE or two, but there are a finite number of combinations to use, and eventually you will hit one.

    You see there are a limited number of basic attacks the attacker will be trying to get to happen. There are a collection of ways to fool standard code with standard mistakes into falling for something interesting. And your code has a set of input parameters. So the script kiddie is going to list your parameters, and then plug a series of inputs in, until something interesting happens, and this attack will be on the list of obvious things to try.

    Were your code written in C an attacker could similarly pass longer and longer parameters until they got evidence something crashed. Once it crashes then you play around figuring out at what length it crashes. Once you know that then you start putting interesting exploits at that position. Again, it takes virtually no knowledge of the specifics of the code to figure out how to abuse it. Perl is virtually immune to buffer overflows, but they make up the most commonly reported security errors.

    And that is the key. Identify an easy to make mistake, start trying it out in random places. Eventually you find a way in. The key is not to analyze any one target in depth and break in there, rather it is to rattle a lot of doors until one falls apart. And once you break one door, probably lots more have the same flaw...

    Another fun one is default passwords. For instance Microsoft's SQL Server had a default login for the longest time. It has been fixed for a year now, but plenty of sites still have the login. So go, try that key on enough sites, and eventually you will get a database of credit cards.

    It is as easy as that!

    Really. :-(

      Ding Ding Ding. And the always verbose tilly comes in with the answer I was looking for: Dumb Luck

      The malicious hacker does not need to know your code to abuse it. Some kid who knows LWP and has plenty of time on hand can easilly write a simple little script to go through a handful of different attacks on a list of sites that the kid has visited recently. Ooops... there goes your day. ++ for tilly

(jcwren) RE: (2) Warning our Fellow Monks
by jcwren (Prior) on Oct 11, 2000 at 00:55 UTC
    How would any hacker/cracker/punk know to try that parameter with my script? Am I not protected by obscurity?

    Not if they realized it came from Matts Script Archive...


    e-mail jcwren
      He he... I liked this answer. Say you foolishly put an ad on your site for the legendary archive. Hacker gets idea... This guy doesn't write secure code... lets find the holes! ++ for jcwren
RE: RE: Warning our Fellow Monks
by mirod (Canon) on Oct 11, 2000 at 00:51 UTC

    Maybe because due to an unrelated security hole the bad guy got your script code to be displayed?

    TIMTOWTDI applies to cracking too, the bad guys can get in through a single gaping hole but also through a series of just slightly insecure features in your code

      Still playing the Devil's Advocate here. (Thank's Ovid for recognizing the usefulness of playing dumb. )

      But no one sees this code...

      Except your co-worker that wants you fired cause your oversized paycheck puts a real damper on the funds available for raises. Or the new site Admin accidentally re-configured Apache to display CGI scripts as text files instead of running them. The list goes on. ++ for mirod

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://36124]
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others meditating upon the Monastery: (5)
As of 2024-04-17 14:59 GMT
Find Nodes?
    Voting Booth?

    No recent polls found