Re: Ebay hacked

From	Rich <rich@example.invalid>
Newsgroups	comp.misc
Subject	Re: Ebay hacked
Date	2014-05-26 13:17 +0000
Organization	My Linux Box
Message-ID	<llveso$ru6$1@dont-email.me> (permalink)
References	(2 earlier) <vg3oayn5gh3.fsf@coffee.modeemi.fi> <llqipl$59h$1@dont-email.me> <budrskFf0vtU2@mid.individual.net> <ar1a5b-gp7.ln1@news.chingola.ch> <bug7a1Fu8ktU1@mid.individual.net>

Show all headers | View raw

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 26/05/2014 6:53 AM, Paul Sture wrote:
> > On 2014-05-25, Sylvia Else <sylvia@not.at.this.address> wrote:
> >> On 25/05/2014 2:53 AM, Rich wrote:
> >>
> >>>
> >>>     "Spaces and certain symbols (< >[ ]//) are not allowed in password."
> >>>
> >>> A properly designed password storage (using a hashing function such as
> >>> bcrypt or scrypt) does not care what symbols are in the password.
> >>>
> >>> Caring about specific symbols in the password implies they are not
> >>> following proper password storage models.
> >>>
> >>
> >> I wonder where the restriction is enforced - both on the client and at
> >> the server, or just in the client? How many here would be surprised if
> >> it were the latter?
> >
> > It would not surprise me to find that there was a server side restriction
> > at some time in the past, and they implemented client side validation for
> > that.
> >
> > Roll on a few years to the point where that server side restriction no
> > longer exists, but because folks have lost track of all the services
> > involved nobody can say for sure that nothing still has it.
> >
> > Thus the validation code lives on, and nobody has the guts to rip it out.
> >

> The concern is that the restriction exists to prevent some kind of 
> injection vulnerability. If the restriction either never exists on the 
> server, or is removed therefrom, then the vulnerability is exposed.

This is possible, or at least this might be why the fools think they
need the restriction.  But given their set of characters I'm not seeing
anything consistently that indicates attempting to block an injection
attack.

Square brackets [] are meta-chars for at least Unix shell's and regular
expressions, but they omitted at least $ (shell variable substitution)
and . (regular expression "any char").  Implying that Unix shell's or
regular expressions are not what they are filtering against.

Angle brackets <> are redirect characters in Unix shells, but again
without $ they left out a meta-character.

None of the set of six are meta-characters for SQL (there single quote
' is the big one).  So this does not look to be driven by SQL injection
prevention.

Forward slashes / are directory separators in Unix, but if they are
literally storing passwords as names in a directory tree, then they
really are incompetent.

The list seems rather arbitrary (although I suppose to the incompetent
who first picked the set, there was a very good reason known only to
him/her).

> Some while ago, I had to go to some considerable lengths to convince
> a senior system architect that a server could not trust client-side
> Java code. He was sure that doing so was how the banks had been
> implementing the Internet banking services.

Ouch.  And this was a "senior" system architect?  Wow, that is both
frightening and sad both at the same time.

> I dare say there are plenty of people who think that since you've
> just downloaded the code (Java, Javascript, or whatever) to the
> client, that the code can be trusted to do what you intend.

Ah, yes, the old DRM ruse.  Too many still fall for this one.

> It's hard to see how we'll ever get security when such fundamental 
> misunderstandings persist.

Very true.  If that "senior"'s opinion is more widespread than just
that one individual (I suspect the answer here is yet) then it is no
wonder none of these companies can get security right.

Thread

Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-22 17:38 +1000
  Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-22 13:35 +0000
    Re: Ebay hacked Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-05-24 14:32 +0100
  Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-22 15:59 +0000
    Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-23 17:06 +0300
      Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:13 +0000
        Re: Ebay hacked Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-24 20:45 +0100
          Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:33 +1000
            Re: Ebay hacked Jerry Peters <jerry@example.invalid> - 2014-05-25 20:19 +0000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 21:50 +0000
      Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:53 +0000
        Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-24 21:12 +0300
          Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 18:33 +0000
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:37 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 13:46 +0000
                Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 16:55 +1000
                Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:42 +0200
          Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-27 13:38 +0200
        Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:32 +0000
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:36 +1000
          Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 14:00 +0000
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 17:18 +0200
          Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 22:53 +0200
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:03 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:17 +0000
                Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-27 15:18 +1000
          Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-26 06:57 +0000
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:07 +1000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:21 +0000
              Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-27 05:53 +0000
            Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:19 +0000
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:46 +0200
      Re: Ebay hacked "BartC" <bc@freeuk.com> - 2014-05-24 20:54 +0100
        Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 20:24 +0000
        Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:35 +0000
  Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-23 00:28 +0100
    Re: Ebay hacked simple@machines.gopher - 2014-05-23 14:30 +0000
      Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 00:36 +1000
        Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-24 13:34 +0200
    Re: Ebay hacked mm0fmf <none@mailinator.com> - 2014-05-23 18:21 +0100
      Re: Ebay hacked Tim Streater <timstreater@greenbee.net> - 2014-05-23 18:39 +0100
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:29 +1000
      Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-23 21:57 +0000
      Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:28 +1000
    Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-26 15:27 +0100
      Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 14:32 +0000

csiph-web