[HN Gopher] Linux distro downloads MySQL database password with ...
___________________________________________________________________
Linux distro downloads MySQL database password with curl to "fix"
security bug
Author : ddtaylor
Score : 68 points
Date : 2022-05-26 18:25 UTC (4 hours ago)
(HTM) web link (kernal.eu)
(TXT) w3m dump (kernal.eu)
| das_keyboard wrote:
| Response from the developer in the Linuxfx-Forums[1]:
|
| "Unfortunately there are people who like to gain popularity by
| doing this kind of reverse work, but we are working on a final
| solution. [...] The Linuxfx activation system was written in a
| basic way, because at the time we did not imagine that we would
| have so many users and would attract the attention of hackers."
|
| [1]:
| https://sourceforge.net/p/linuxfxdevil/discussion/general/th...
| ziddoap wrote:
| The ol' "We didn't think we'd be hacked!" excuse is getting
| very tired. There was a very small window in time where that
| was a legitimate excuse, but its been at least a decade or two
| since that time.
| gabereiser wrote:
| "We didn't think" should be the focal point here. Whether
| it's being hacked, or "no one would notice", or whatever. "We
| didn't think" means a hasty launch without thinking about
| side effects and consequences. Every good team will think
| about the "what if" scenarios. Any good engineer would have
| caught this and said "yeah, maybe we shouldn't do that..."
| saghm wrote:
| Not to mention the attempt to try to deflect the blame onto
| the people who exposed the bug. I don't think it's
| "unfortunate" for people to find things like this, and I
| don't care if their only motive is to gain popularity.
| josephcsible wrote:
| Someone needs to find a license that the LinuxFx company is
| violating and then sue to get them banned from distributing their
| malware anymore.
| yjftsjthsd-h wrote:
| Ah, the traditional "solution" to people finding a massive
| security problem in your software: Make it try to kill any
| tracing programs and failing that refuse to run if you can detect
| any debug-type tools running. That will surely prevent people
| from bypassing your utterly trivial client-side protections! /s
| munk-a wrote:
| Just a pro-tip to anyone looking to persist information coming in
| from remote clients... please, please, please _never_ directly
| expose your DB (or effectively expose your DB by having SQL
| generated by the client or using a library to autogenerate SQL
| based on a query request)... Just put a dumb layer of PHP
| /Node/Python/whatever you like between clients and the DB. It is
| immensely difficult to properly secure data if uncontrolled
| clients can connect to the DB - it is possible - but it takes far
| more work than you'd like to put in.
|
| Putting a thin application layer in front of the DB means that
| you're effectively whitelisting what operations are legal to run
| on the host and that makes your security life so much easier.
| agsdgasdasdg wrote:
| or, alternatively, always treat your database roles as though
| they can be directly manipulated by the end user, and you'll
| eliminate an entire class of injection vulnerabilities.
|
| my favorite example of this is SchemaVerse, a game fully
| implemented in pgsql.
|
| https://schemaverse.com/
| gkop wrote:
| Or just use NoSQL instead (eg. Mongo)
| saghm wrote:
| There are still some database injections that are possible in
| MongoDB (although they definitely tend to be less common due
| to the query language not being text-based). The most common
| type is when someone directly uses the data from a quest in
| the query without checking the type; for example, if you have
| a query that says "delete the user with id ____" and then
| pass in the id directly from the POST request without
| checking the type, someone could make a request with a body
| of `{ "$nin: [] }` (i.e. "not in the empty array"), which
| would then delete every user in the database. The fix, in
| this case, is just to check the type of the request data
| before serializing it into the query; in the example above,
| you could just return an error if you get anything other than
| a single user id.
| gkop wrote:
| Sorry, I made a stupid joke. Thanks for teaching me
| something here, this is more than I deserve.
| mjcl wrote:
| Please, yes. At a previous job, a department used a Windows
| accounting app that had a machine-level ODBC connection with
| the database credentials saved in it. A user figured out you
| could use Microsoft Query to pull data from the ODBC connection
| into Excel. This worked well until she accidentally deleted 90%
| of the vendor records from the database while trying to filter
| some data. I couldn't even really be upset at the user, a bunch
| of dumb product design decisions had to align like swiss cheese
| for this to happen.
| yabones wrote:
| They've made a windows 11 theme for KDE and added sketchy
| "license activation" software, what exactly is "Linuxfx" trying
| to accomplish?
| chungy wrote:
| They felt Linux users were being left out of bad experiences.
| So bring it to them!
| tiernano wrote:
| make money?
| anthk wrote:
| The same like Linspire back in the day.
| theamk wrote:
| If you are wondering which distro: you likely never heard of it
|
| It is Linuxfx, product of a Brazilian software company with the
| same name
| ev1 wrote:
| This is one of the funniest things I've ever read.
|
| > Linuxfx brings all the main tools of Microsoft Windows 11,
| this includes control panel, configuration screens, login,
| logout
| giomasce wrote:
| Apparently security bugs and privacy violations too.
| tentacleuno wrote:
| Oh my lord, these developers are not at all mature. Just after
| seeing this, and the following information below, I'll be
| recommending everyone stay away from LinuxFX. Their response to
| _very substantial_ security issues and the fact that (according
| to TechRadar) they bundle proprietary programs is enough of a red
| flag to me. $ curl
| http://www.linuxfx.org/linuxfx/x86/11.1/.http mysql
| 38695 204.2.195.229 kernalisdumb
| kernalislammer $ curl
| http://www.linuxfx.org/linuxfx/x86/11.1/.https
| idleassholes
|
| Any junior engineer would know that letting clients connect to
| your MySQL database is a terrible _terrible_ idea. No amount of
| (bad) obfuscation can fix that. It would be much more sensible to
| make a proxy application like NodeJS or PHP (as suggested by
| another commenter) that can then control public access to the
| internal database.
|
| N.B. According to Urban Dictionary (as this one is new to me),
| Lammer means "A person who knows very little about
| computers/computing. It also refers to a person who pretends to
| be a hacker but is not."
| [deleted]
| cmeacham98 wrote:
| The author didn't say how much money they made, but I wonder how
| the author of this theme they link as being used in the plasma
| version of linuxfx on their website would feel:
| https://www.pling.com/p/1367154/ - given that they seem to have
| straight up pirated it.
| ddtaylor wrote:
| Isn't that theme licensed under the GPLv3? AFAIK they do
| publish all of their changes on SourceForge. To be clear I
| think Linuxfx is trash, but that doesn't make it "pirating" GPL
| software.
| mschuster91 wrote:
| Ouch, the prior post (https://kernal.eu/posts/linuxfx/) is even
| worse. Just... how did anyone think that exposing a mysql
| database to the wide Internet is a good idea?!
| munk-a wrote:
| Even by the time of this post they've still got that DB exposed
| to the open internet - their update was just an attempt to
| obscure it, not an actual fix.
___________________________________________________________________
(page generated 2022-05-26 23:02 UTC)