The History of SQL Injection, the Hack That Will Never Go Away

“When you go to a webpage, and you make a request, that parses part of the data in the request back to a server,” Hunt said. “For example, you read a news article, and the news article, in the address bar it has, “id=1”, and that gives you news article number 1, and then you get another one with ID 2.”

But, “with a SQLi attack, an attacker changes that ID in the address bar to something that forces the database to do something it’s not meant to do,” Hunt said, such as returning a piece of private data.

Source: The History of SQL Injection, the Hack That Will Never Go Away | Motherboard

Another commonly used piece of software is sqlmap. “It crawls the pages on the website, similar to how a search engine crawler might, looks for input forms on the website, and submits the forms with inputs that might cause a MySQL syntax error,” Al-Bassam added.

Exploring the Wall Street Journal’s Pulitzer-Winning Medicare Investigation with SQL

This is a SQL-based introduction to the data and analysis behind the Wall Street Journal’s Pulitzer-winning “Medicare Unmasked” investigative project. It also doubles as a helpful guide if you’re attempting the midterm based on the WSJ Medicare’s investigation.

Source: Exploring the Wall Street Journal’s Pulitzer-Winning Medicare Investigation with SQL | Public Affairs Data Journalism at Stanford University

To follow along in this walkthrough, you can download my SQLite database here:

Computer program fixes old code faster than expert engineers

From there, the Helium system then replaces the original bit-rotted components with the re-optimized ones. The net result: Helium can improve the performance of certain Photoshop filters by 75 percent, and the performance of less optimized programs such as Microsoft Windows’ IrfanView by 400 to 500 percent.

“We’ve found that Helium can make updates in one day that would take human engineers upwards of three months,” says Amarasinghe. “A system like this can help companies make sure that the next generation of code is faster, and save them the trouble of putting 100 people on these sorts of problems.”

Source: Computer program fixes old code faster than expert engineers | MIT News

Having the ability to automatically fix bad code is like when they introduced auto focus on cameras to automatically fix bad focus or auto tunes to fix bad singing.  The downside might be that development chooses to do less code reviews releasing more bad code into the wild relying on these automatic techniques to fix everything.

Here’s another article recently published by MIT News about this concept.

Remarkably, the system, dubbed CodePhage, doesn’t require access to the source code of the applications whose functionality it’s borrowing. Instead, it analyzes the applications’ execution and characterizes the types of security checks they perform. As a consequence, it can import checks from applications written in programming languages other than the one in which the program it’s repairing was written.

Source: Automatic bug repair | MIT News

ExifTool by Phil Harvey

ExifTool is a platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files. ExifTool supports many different metadata formats including EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP and ID3, as well as the maker notes of many digital cameras by Canon, Casio, FLIR, FujiFilm, GE, HP, JVC/Victor, Kodak, Leaf, Minolta/Konica-Minolta, Nikon, Nintendo, Olympus/Epson, Panasonic/Leica, Pentax/Asahi, Phase One, Reconyx, Ricoh, Samsung, Sanyo, Sigma/Foveon and Sony.

Source: ExifTool by Phil Harvey

10 Years of Git: An Interview with Git Creator Linus Torvalds

Ten years ago this week, the Linux kernel community faced a daunting challenge: They could no longer use their revision control system BitKeeper and no other Software Configuration Management (SCMs) met their needs for a distributed system. Linus Torvalds, the creator of Linux, took the challenge into his own hands and disappeared over the weekend to emerge the following week with Git. Today Git is used for thousands of projects and has ushered in a new level of social coding among programmers.

via 10 Years of Git: An Interview with Git Creator Linus Torvalds | Linux.com.

So git was basically designed and written for my requirements, and it shows.

ffmpeg – encode video in reverse?

Dump all video frames

$ ffmpeg -i input.mkv -an -qscale 1 %06d.jpg

Cat video frames in reverse order to FFmpeg as input
$ cat $(ls -t *jpg) | ffmpeg -f image2pipe -vcodec mjpeg -r 25 -i - -i backwards.wav
-vcodec libx264 -vpre slow -crf 20 -threads 0 -acodec flac output.mkv

via ffmpeg – encode video in reverse? – Stack Overflow.

The above ffmpeg command examples turned out to be very useful.  Previously I had to do this manually in Avidemux.

The output of my IP camera is VGA 640×480 and I needed to slice that up into a  10×10 array of little areas  (100 jpeg files) using the following:

convert input.jpg -crop 64x48  +repage  +adjoin  myoutputfile_%02d.jpg

Motion detect reveals a lot of false positives which must be filtered out manually.  In order to automate this I  compare time n to time n+1 in only a couple of the 100 little jpegs separated in the above command.   So far I’m using this:

compare -metric MAE time_n_number.jpg time_n+1_number.jpg  null: 2>&1

A changed portion of the jpeg will generate a high number which can be compared to a threshold in a script allowing me to eliminate most all false positive motion detects.

More detailed explanation for the Image compare commands in the ImageMagick package can be found here:

ImageMagick v6 Examples –Image Comparing

Therefore my entire process consists of separating the video into jpegs, finding changes in areas where there shouldn’t be changes and if not reassembling the jpegs back into a video file again all done automatically via bash scripting.

There probably are more elegant solutions but this works for now.

NHS grows a NoSQL backbone and rips out its Oracle Spine

The switch from relational hadn’t been too hard because Riak is a key-value store, which made modeling relatively easy. Key value-stores are relatively simple database management systems that store just pairs of keys and values.

McCaul reckoned, too, migration of data had been made possible because the structure of patient records lent themselves to Riak’s key-value mode

via NHS grows a NoSQL backbone and rips out its Oracle Spine • The Register.

IEEE Guides Software Architects ToSecure Software Design

The document spells out the 10 common design flaws in a straightforward manner, each with a lengthy explainer of inherent weaknesses in each area and how software designers and architects should take these potential pitfalls into consideration. The 10, in no particular order, are:

  • Earn or give, but never assume, trust
  • Use an authentication mechanism that cannot be bypassed or tampered with
  • Authorize after you authenticate
  • Strictly separate data and control instructions, and never process control instructions received from untrusted sources
  • Define an approach that ensures all data are explicitly validated
  • Use cryptography correctly
  • Identify sensitive data and how they should be handled
  • Always consider the users
  • Understand how integrating external components changes your attack surface
  • Be flexible when considering future changes to objects and actors

via IEEE Guides Software Architects ToSecure Software Design | Threatpost | The first stop for security news.

5 new guides for mastering OpenStack

Sometimes things go wrong, and instances can go down in unexpected ways. Even if the instance has disappeared, OpenStack might still think it’s there. If this happens, one way to deal with it is to delete these phantom instances directly from OpenStack’s database. This guide will show you how to do that with a simple script.

via 5 new guides for mastering OpenStack | Opensource.com.