avoiding hacker attacks
DESCRIPTION
Avoiding Hacker Attacks. Objectives. You will be able to Avoid certain hacker attacks and crashes due to bad inputs from users. Getting Started. http://www.cse.usf.edu/~turnerr/Software_Systems_Development/Downloads/2011_04_14_More_Hacker_Attacks/ - PowerPoint PPT PresentationTRANSCRIPT
1
Avoiding Hacker Attacks
2
ObjectivesYou will be able to Avoid certain hacker attacks and
crashes due to bad inputs from users.
Getting Started http://www.cse.usf.edu/~turnerr/Software_Systems_Develo
pment/Downloads/2011_04_14_More_Hacker_Attacks/ File Alt_Databound_Combo_Box_for_Hacker_Attacks.zip
3
4
SQL Injection Attacks An Even More Insidious Threat
Potentially lets the hacker execute any SQL command. Can take over your database. Destroy your data. Worse, steal it without your knowing.
5
How to Invite SQL Injection Attacks Accept text input from the user and
make it a part of a SQL command.
Suppose we provide a TextBox for the user to enter a search term.
Program retrieves information about all products with that search term in their ProductName.
6
Add New Product_Info Form
7
TextBox for Search Term
8
How to Search with SQL The SQL "LIKE" operator permits us to
search for a text string containing a specified search target.
Two wildcard characters Percent sign (%) Underscore (_)
% matches any number of characters in a string, including none.
_ matches exactly one character
9
How to Search with SQL
SELECT * FROM ProductsWHERE ProductName LIKE '%Tofu%'
The string '%Tofu%' matches any ProductName including Tofu.
Copy Product_Info.cs http://www.cse.usf.edu/~turnerr/Software_Systems_Develo
pment/Downloads/2011_04_11_Hacker_Attacks/Product_Info.cs
Replace stub created by Visual Studio.
10
11
Product_Info.csusing System;using System.Collections.Generic;using System.Windows.Forms;
namespace Alt_Databound_Combo_Box{ public partial class Product_Info : Form { String Username; String Password; List<Product> product_list;
public Product_Info(String Username_, String Password_) { InitializeComponent(); Username = Username_; Password = Password_; }
12
Product_Info.csprivate void btnGetProductInfo_Click(object sender, EventArgs e){ String Search_Term = tbSearchTerm.Text;
product_list = Products.Get_Products(Username, Password, Search_Term);
if (product_list.Count > 0) { foreach (Product p in product_list) { MessageBox.Show(p.Product_name); } } else { MessageBox.Show("No product found"); } tbSearchTerm.Text = "";}
13
Reuse Some Code http://www.cse.usf.edu/~turnerr/Software_Systems_Develo
pment/Downloads/2010_10_26_Product_Browser/
Copy Product.cs and Products.cs into project folder.
Add to project.
14
Implement the Search Modify Get_Products to produce a
new version that gets products with ProductName containing a specified search term.
15
Products.cspublic static List<Product> Get_Products(String Username, String Password, String Search_Term){ SqlDataReader rdr; SqlConnection cn; List<Product> Product_List = new List<Product>(); cn = Setup_Connection(Username, Password); rdr = Get_SqlDataReader(cn, Search_Term);
while (rdr.Read()) { Product p = new Product(rdr);
Product_List.Add(p); } rdr.Close(); cn.Close(); return Product_List;}
16
Products.csprivate static SqlDataReader Get_SqlDataReader(SqlConnection conn, String Search_Term){ SqlCommand cmd = new SqlCommand(); cmd.CommandText = "SELECT * FROM Products " + " WHERE ProductName LIKE '%" + Search_Term + "%'"; cmd.Connection = conn; return cmd.ExecuteReader();}
17
Update Login Formprivate void btnLogIn_Click(object sender, EventArgs e){ if ((tbUserName.Text.IndexOf(';') >= 0) || (tbPassword.Text.IndexOf(';') >= 0)) { MessageBox.Show("Invalid input"); return; }
Product_Info pi = new Product_Info(tbUserName.Text, tbPassword.Text); this.Hide(); pi.ShowDialog(); this.Close();}
18
Program Used as Intended
19
An Innocent Error
20
Crash!
21
Program Subverted
22
Another Subversion
...
Getting All Products
23
Defense To foil this attack, and prevent crashes
from bad inputs, replace each single quote with a pair of single quotes.
The server replaces pairs of single quotes with one single quote. Treats that single quote as part of the
string rather than as a delimiter. Only way to include a single quote
character in a text string in a SQL query.
24
Escape Single Quotes
In Products.cs:private static SqlDataReader Get_SqlDataReader(SqlConnection conn, String Search_Term){ SqlCommand cmd = new SqlCommand();
Search_Term = Search_Term.Replace("'", "''");
cmd.CommandText = "SELECT * FROM Products " + " WHERE ProductName LIKE '%" + Search_Term + "%'"; cmd.Connection = conn; return cmd.ExecuteReader();}
25
Attempted Subversion
26
Search Term with Apostrophe
27
Other Defensive Measures Use the MaxLength property of TextBox to
limit how many characters a user can enter. For numeric input, parse the input and
convert the resulting numeric value back into a string to splice into the command.
On exceptions, provide only a generic error message. The actual error message from the exception
might provide useful information to a hacker. Use parameterized commands or stored
procedures.
End of Section
28
Parameterized Command A command string that uses placeholders
in the SQL text. Placeholders replaced by dynamically
supplied values at run time. Uses the Parameters collection of the
command object. Specific to ADO.NET.
The command object checks the parameter value for attempted SQL injection attacks.
29
Parameterized Command Example Rather thanSELECT * FROM Customers WHERE CustomerID = 'ALFKI' where ALFKI was read from a TextBox
writeSELECT * FROM Customers WHERE CustomerID = @CustID
@CustID will be replaced by a string containing a real customer ID at run time.
Note: No quotes around @CustID
30
Using a Parameterized Commandprivate static SqlDataReader Get_SqlDataReader(SqlConnection conn, String Search_Term){ SqlCommand cmd = new SqlCommand();
//Search_Term = Search_Term.Replace("'", "''");
cmd.CommandText = "SELECT * FROM Products" + " WHERE ProductName LIKE @Parm1";
cmd.Parameters.AddWithValue("@Parm1", "%" + Search_Term + "%");
cmd.Connection = conn; return cmd.ExecuteReader();}
31
Attempted Subversion
32
Term with Apostrophe
33
Blank Entry
Everything matches!
34
Blank Entry If we don't want the user to be able to
ask for all products, we have to check for a zero length string in the TextBox.
private void btnGetProductInfo_Click(object sender, EventArgs e){ String Search_Term = tbSearchTerm.Text;
if (Search_Term.Length == 0) { MessageBox.Show("No search term entered"); return; } ...
35
Blank Entry
End of Section
36
Stored Procedures We can store SQL commands in the
database and executed them from there.
A safer alternative to constructing SQL commands and executing them.
Visual Studio and ADO.NET provide support for this.
37
Stored Procedures The Northwind Traders database
has a lot of stored procedures.
Click on the + beside Stored Procedures in Server Explorer to expand the section.
38
Northwind Stored Procedures
39
Northwind Stored Procedures
40
Northwind Stored Procedures We can execute these stored
procedures from the Server Explorer. Right click on a stored procedure and
select Execute.
41
Executing a Stored Procedure
42
Executing a Stored Procedure
43
Results
44
Viewing a Stored Procedure
To view the stored procedure right click on the procedure and select Open.
45
Viewing a Stored Procedure
46
Viewing a Stored Procedure
47
Adding a Stored Procedure To add a new stored procedure from
the Server Explorer, right click on Stored Procedures and select Add New Stored Procedure.
Note that the new stored procedure will be a part of the database.
Stays there until you delete it.
48
Adding a Stored Procedure
49
Adding a Stored Procedure
50
Adding a Stored Procedure
51
Saving the New Stored Procedure
Click icon to save the new stored procedure
52
Executing the Stored ProcedureVisual Studio changes "CREATE" to "ALTER".
We can now execute the procedure from the Server Explorer
53
Executing the Stored Procedure
54
Supplying the Parameter Value
55
Results from the Execution
Results
56
Executing a Stored Procedure from C#
We can execute a stored procedure from within our program.
In Products.cs add using System.Data;
57
Executing a Stored Procedure Programatically
private static SqlDataReader Get_SqlDataReader(SqlConnection conn, String Search_Term){ SqlCommand cmd = new SqlCommand();
cmd.CommandType = CommandType.StoredProcedure; cmd.CommandText = "Product_Search";
cmd.Parameters.AddWithValue("@Param1", "%" + Search_Term + "%");
cmd.Connection = conn; return cmd.ExecuteReader();}
58
Program in Action
End of Presentation