A Flashback to the Language Wars

By Jerry Pournelle

November 24, 2003

(A Flashback to the Language Wars :  Page 1 of 1 )

Column 280 (Continued from the Previous Week)

SQL Injection Attacks

One of the Microsoft Professional Developers Conference sessions was on known security vulnerabilities, not just in Microsoft products, but across the computer world. All of those shown have been found and in theory eliminated, but some of them were frightening.

As an example, they showed a SQL database dummied from a real one. This one held book reviews and ratings. With a few operations they were able to show us how all the ratings for books by particular authors could be inflated, and words like "not recommended" turned into recommendations; while rival works were given bad reviews. All this was done from outside the data base by SQL injection attacks. Most of those holes were generated by buffer overflows; more on those later.

But entire databases can be copied, or altered, or both; and once again the commercial incentives for attacks like that are quite high. These aren't just hacks for self esteem any longer.

The Insecure Future?

Years ago I wrote about a future in which everything was smart and it was all connected together. I mused that your refrigerator would natter with your toaster about your bank balance, and your new car might telephone you at the supermarket to ask if you really wanted to buy that expensive wine given that the car payment was due and your bank balance was low.

That's all happening now. You can buy a refrigerator with an IP address. UPS systems have long had IP addresses. Smarter VCRs and DVD players have embedded computing systems. TiVo and Replay devices have or can be given Internet access in order to update their program guides.

ITRON

The operating system in most of these devices is ITRON, which may be the most widely used operating system in the world even though most people have never heard of it. TRON, The Real-time Operating system Nucleus (of which ITRON is a sub-project), is a family of real-time embedded operating systems that have been around for almost 20 years; everything from cellphones to stereo components to microwave ovens runs one of the TRONs, and while BYTE.com > Chaos Manor > 2003