Tag: security

Patch Problems

I ran across this article a week or so ago, but hadn’t had a chance to put anything out. There were three patches put out in July for various products that caused issues with other software, one of which was SQL Server. can cause issues with SQL Server 2012, though it looks like the patch was pulled. Be careful if you have administrators that tend to apply the monthly security patches.

Overall, despite the tone of the article, I’m not sure how bad this is in terms of patches. While the errors are problematic and annoying, I’m not sure these are critical issues. These aren’t causing reboots or re-installations of Windows. I’ve certainly seen worse patches released, though not in quite some time. The most disturbing item in the piece was the fact that the Windows 8/RT servicing stack update cannot be uninstalled. That’s a bit of an issue, and it concerns me as we move towards a more automated, bulk patch process.

It’s one thing for me to uninstall an application on my phone and reinstall a patched one when there’s an issue. I’ve had this happen, with vendors releasing a new version in a day or two (or for all I know, the old version), that I can reinstall. It’s quite another thing for a large vendor like Microsoft to release a patch that cripples large numbers of devices. It’s easy to pick on Microsoft, but imagine Apple, Verizon, Dropbox, etc. releases a version that crashes machines or devices. It might be significantly harder to even reconnect these devices to recover from patches that crashed core, kernel level software.

Software has bugs, and it will always have bugs. Patches will always be needed, and IMHO, should be included as part of some warranty for digital goods. However I think patching needs to be considered at the beginning, with installation and removal, as well as user option-to-install, built into all software for sale.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 17.5MB)

MP4 iPod Video ( 20.8MB)

MP3 Audio ( 4.2MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

August 13, 2013

Review Your Code

I hope that SQL Injection becomes a disease of the past at some point in the future, one that is eradicated from the world except for very rare, isolated cases. However that’s not the state of the world now, and probably not what we’ll see anytime soon. I don’t often see large scale attacks, but I wasn’t surprised when a piece from Denny Cherry appeared recently.

What was disconcerting was the attack he referenced, which was automated and self-spreading, but injecting code into hacked sites that more and more users would end up with code that joins their system to a botnet.

What’s worse? Most virus detectors didn’t pick up the code.

What’s really, really bad? Bored hackers, criminals, or anyone else could get details of the exploit on the Internet and start searching for injected machines they could easily alter or take control of in their own creative way.

In Denny’s piece, he gives advice that’s easy to follow, and shouldn’t delay development time. Most developers could easily build templates to use when writing queries, or formatted the parameterized queries. Not doing so is laziness or ignorance, and it’s dangerous.

It’s 2013. I’d say that if you write code after today that’s susceptible to SQL Injection, you ought to be fired. Plenty of people would argue that if you’ve written code in the last couple of years you should be let go, but I’m offering amnesty. Go buy Denny’s book. Go read about secure coding. Learn how to write code that doesn’t make this kind of attack easy.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 14.6MB)

MP4 iPod Video ( 17.9MB)

MP3 Audio ( 3.6MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

August 12, 2013

Fix Your Code

If you have an ASP.NET site, you might want to double check how the data access is coded. No matter whether you’ve enabled TDE, column level encryption, have strong firewalls or anything else, if you are vulnerable to SQL Injection, someone will get through.

Perhaps just for fun. Another massive attack took place recently. These attacks will get more automated, and if you are on a well known platform, then you might be vulnerable. Even if you are on custom software, it’s entirely possible a disgruntled employee or a kid engaging in vandalism might attack your site.

It’s not hard to stop SQL Injection. You just need to learn how and code securely.

August 2, 2013

Data Farming

This editorial was originally published on Oct 13, 2008. It is being re-run as Steve is out today, traveling to a SQL in the City event and SQL Saturday in Sacramento.

It’s a fictional story, or at least I hope it is, but Bruce Schneier has a great piece on Identity Farming, a long term way to create false identities that would fit great in the spy world. Mr. Schneier doesn’t see a practical point in doing it, but it’s interesting from a data standpoint because he brings up a point. This could be done without a real person existing to back up all the data that’s created.

The part that strikes me from this piece is that all too often we make assumptions about the people or entities that created all the data we use. One bad foreign key, orphaned child row, or incorrectly transformed piece of data could snowball downhill at a tremendous rate and it might be hard to determine what is wrong.

The blog entry talks about our data shadows, which grow larger and larger all the time. Unless you are actively trying to limit yours, every day that are likely new entries in some database about your life. And more and more, various companies and institutions interact with our data shadows instead of us. Credit checks, marketing efforts, when we board an airplane or make a purchase, all of these require checks on the shadow of data in our lives, not necessarily ensuring that the shadow is tightly linked to each of us.

I’ve had more than my share of confusion because of my name; it’s common, in almost every database, and shared by thousands, if not millions of people. On on hand it means that I’m a little lost in the flood of “Steve Joneses” out there. On the other hand it makes it hard to correct mistakes. If there are 6 people with the same name and you have an orphaned record, who do you link it to? Do you guess? Infer it from the other data? I’d like to think you need to somehow research this, contact me, and make a note that the quality of this data could be suspect.

People working with information try to be accurate, but they get busy, and mistakes occur. I’m sure I’ll find more and more over time, and I don’t have a great solution for what might work better. I’d like to think that we would implement better checks for data quality, fuzzy searches, and somehow assign “risk” values to data. Something to let people know that there might have been some issue.

It’s a thorny problem, one that’s not going away, and likely to become more problematic in the future.

Steve Jones

Video and Audio versions

Today’s podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

Follow Steve Jones on Twitter to find links and database related items and announcements.

Windows Media Video ( 34.9MB)

MP4 iPod Video ( 30.1MB)

MP3 Audio ( 5.8MB)

Feeds are available at iTunes and Mevio

To submit an article, rant or editorial,
log in to the Contribution Center

July 25, 2013