Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.freenet.ag!news2.euro.net!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <85b5c606-a1c7-480b-a900-622f61751b87@googlegroups.com>
References: <8e17232e-5b24-4040-9215-c4bd89f34fa2@googlegroups.com> <622d4a2d-0014-4254-b211-c8fd66510f74@googlegroups.com> <c2a09443-3c74-477b-af9f-a6f3473ebe88@googlegroups.com> <mailman.3029.1362669207.2939.python-list@python.org> <e63776b9-ba74-4349-9538-7fe95323d4be@googlegroups.com> <mailman.3033.1362670392.2939.python-list@python.org> <33f153b4-4f54-429a-a92d-387b679bf758@googlegroups.com> <20130307105137.a6cae268f7f074fbf5017b1d@lavabit.com> <CAPM-O+w_=e6FA8CA8W_UgxGXebXqNOqFWAf0BXa7FwRe6XYWgQ@mail.gmail.com> <mailman.3048.1362684995.2939.python-list@python.org> <0074be2d-1f52-4626-bf53-fd9591f16bf7@googlegroups.com> <mailman.3050.1362687355.2939.python-list@python.org> <98cd9065-94b0-4fb6-b2fd-6ed96880242d@googlegroups.com> <mailman.3066.1362714922.2939.python-list@python.org> <513a33d7$0$30001$c3e8da3$5496439d@news.astraweb.com> <1a79c210-3c50-43bb-8a78-5d5ef60922ec@googlegroups.com> <mailman.3095.1362772967.2939.python-list@python.org> <85b5c606-a1c7-480b-a900-622f61751b87@googlegroups.com>
Date: Sat, 9 Mar 2013 08:37:11 +1100
Subject: Re: An error when i switched from python v2.6.6 => v3.2.3
From: Chris Angelico <rosuav@gmail.com>
To: python-list@python.org
Content-Type: text/plain; charset=ISO-8859-7
Content-Transfer-Encoding: quoted-printable
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.3101.1362778641.2939.python-list@python.org>
Lines: 45
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:40904

On Sat, Mar 9, 2013 at 7:31 AM, =CD=DF=EA=EF=F2 =C3=EA=F133=EA <nikos.gr33k=
@gmail.com> wrote:
> I cant beleive how easy you hacked the webserver again and be able to rea=
d my cgi scripts source and write to cgi-bin too!
>
> I have added extra security by following some of your advice, i wonder if=
 youc an hack it again!
>
> Fell free to try if i'am not tiring you please!

Something to think about: There are roughly seven billion people on
this planet. You are just one of them; Steven is just one more. This
entire mailing list/newsgroup amounts to the most miniscule fraction
of the earth's population.

There is NO WAY that you are the smartest or most devious person on
Earth. Also, the three hours that you put in are *nothing* compared to
the collective time that the rest of the world will spend fiddling
with your site. Even if all of python-list/c.l.p spent a few hours
trying to get around your site's security, that's still not a huge
amount compared to the whole planet's deviousness.

You cannot build web site security on the basis of "well, I couldn't
get around it, and I tried for a few hours". I had this argument with
my boss just yesterday; I pointed out that there was a place where
user input was being put into an HTML attribute without being properly
escaped (and demonstrated that putting &#65; into the input was
equivalent to putting A in), and he asked me how it could possibly be
exploited. My response: That does not matter. The mere fact that I
could provably show a difference WAS the problem. With that, a
determined attacker could potentially figure out a real exploit; it
does not matter that I wasn't able to do so.

You need to change your thinking about security/safety. Instead of
trying to filter/clean tainted input before passing it to a system()
call, you need to either whitelist BRUTALLY first (eg insist that the
string be one of a particular set of strings - and no, it's not
sufficient to make sure that it has only characters from a particular
set, though that's a good start), or just plain don't give tainted
strings to os.system().

What you have is a MASSIVE potential attack vector. It's quite
possibly unsalvageably dangerous.

ChrisA